Criminal Complaint — United States v. Daniel Navarro and Julie Le (Central District of California, Document 1)

Summary

A Criminal Complaint by telephone or other reliable electronic means, Case No. 2:22-MJ-2689-DUTY, filed 07/11/22 in the Central District of California against Daniel Navarro and Julie Le. It charges a violation of 18 U.S.C. § 2423(a), Transportation with Intent to Engage in Criminal Sexual Activity with a Minor, on or about July 11, 2022, in the county of San Luis Obispo, and is signed /s/ by FBI Special Agent Brian J. Sullivan. The attached affidavit also supports warrants to search a vehicle, the persons of Navarro and Le, and five digital devices seized on July 10, 2022. Its statement of probable cause begins with a July 1, 2022 runaway juvenile report about a fifteen-year-old minor victim in Nipomo, California.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Text recognized from a scanned document; may contain errors.

Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page1of30 Page ID#:1

AO 91 (Rev. 11/11) Criminal Complaint (Rev. by USAO on 3/12/20) LC) Original OO Duplicate Original

UNITED STATES DISTRICT COURT errs Ge ne tercoums
07/11/2022

CENTRAL DISTRICT OF CALIFORNIA
BY: gj DEPUTY

for the

Central District of California

United States of America
Plaintiff
Vv.
DANIEL NAVARRO Case No. 2:22-MJ-2689-DUTY
JULIE LE
Defendants.

CRIMINAL COMPLAINT BY TELEPHONE
OR OTHER RELIABLE ELECTRONIC MEANS

I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
On or about the date of July 11, 2022, in the county of San Luis Obispo in the Central District of California,

defendant(s) violated:
Code Section Offense Description

18 U.S.C. § 2423(a) Transportation with Intent to Engage in
Criminal Sexual Activity with a Minor

This criminal complaint is based on these facts:

Please see attached affidavit.

Continued on the attached sheet.

/s/ Brian J. Sullivan

Complainant’s signature

FBI Special Agent Brian J. Sullivan

Printed name and title
Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1 by telephone.

Date: July 11, 2022

Judge’s signature

City and state: Santa Barbara, California Honorable Louise A. LaMothe, United States Magistrate Judge

Printed name and title
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 2of30 Page ID #:2

AFFIDAVIT
I, Brian P. Sullivan, being duly sworn, declare and state

as follows:

I. PURPOSE OF AFFIDAVIT

1. This affidavit is made in support of a criminal
complaint and arrest warrants charging Daniel NAVARRO
(“NAVARRO”) and Julie LE (“LE”) with a violation of 18 U.S.C.
§ 2423(a) (Transportation with Intent to Engage in Criminal
Sexual Activity with a Minor).

2. This affidavit is also made in support of an
application for a warrant to search:

a. A 2017 black Honda Civic, California License
Plate Number 8BSB973, and Vehicle Identification Number (“VIN”)
2HGFC2F73HH577891, registered to Julie LE (“LE”) (the “SUBJECT
VEHICLE”), as described more fully in Attachment A-1!;

b. The person of Daniel NAVARRO (“NAVARRO”), as
described more fully in Attachment A-2;

Cc. The person of LE, as described more fully in
Attachment A-3; and

d. Five digital devices seized from the SUBJECT
VEHICLE by law enforcement on July 10, 2022, as described more
fully in Attachment A-4 (the “SUBJECT DEVICES”).

3. The requested search warrants seek authorization to
seize evidence, fruits, or instrumentalities of violations of:

S§ 2423(a) (Transportation with Intent to Engage in Criminal

1 Contingent upon the arrival of the SUBJECT VEHICLE in the
Central District of California.
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 3o0f30 Page ID#:3

Sexual Activity with a Minor)); 2422(b) (Enticement of a Minor
to Engage in Criminal Sexual Activity); 225l(a), (e) (Attempted
Production of Child Pornography) (the “Subject Offenses”), as
described more fully in Attachment B, which is incorporated
herein by reference.

4. The facts set forth in this affidavit are based upon
my personal observations, my training and experience, and
information obtained from various law enforcement personnel and
witnesses. This affidavit is intended to show merely that there
is sufficient probable cause for the requested complaint and
search warrant, and does not purport to set forth all of my
knowledge of or investigation into this matter. Unless
specifically indicated otherwise, all conversations and
statements described in this affidavit are related in substance
and in part only.

II. BACKGROUND OF AFFIANT

5. I am a Special Agent with the Federal Bureau of
Investigation (“FBI”) and have been so employed since January
2003. I am currently assigned to the Los Angeles Field Office,
Central Coast Safe Street Taskforce (“CCSSTF”). CCSSTF is a
task force comprised of agents and officers from federal, state,
and local agencies, who are assigned to investigate gang-related
crimes and large-scale drug trafficking matters. Additionally,
I currently serve as a Team Leader on the FBI’s Child Abduction
Rapid Deployment (“CARD”) team which specializes in locating
kidnapped, abducted, and missing children throughout the United

States. I have served as a member of CARD for approximately the
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 4of30 Page ID#:4

past ten years as and as a team leader for the past approximate
five years. In this capacity, I have received hundreds of hours
of training and have participated in more than fifteen
enforcement actions related to kidnapped, abducted, or otherwise
missing children.

6. In my capacity as an FBI agent, I have also assisted
in investigations related to violations of federal law related
to child exploitation, child pornography, and sexual enticement
of a minor. I have also participated in the execution of
numerous search warrants, many of which involved child
exploitation and/or child pornography offenses.

7. Through my training and experience, I have become
familiar with the methods of operation used by people who are
involved with offenses involving the sexual exploitation of
children. I have attended training classes and seminars
concerning computer crimes and the sexual exploitation of
children on the Internet. This training has given me an
understanding of how people involved with offenses relating to
the sexual exploitation of children use the Internet to further
those offenses. My experience in investigations in this regard
has supplemented my understanding of how people involved in
offenses relating to the sexual exploitation of children use the
Internet to further those offenses. Through my training and
experience, I have become familiar with the methods of operation
used by people who commit offenses involving the sexual

exploitation of children and how people use the Internet to
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page5of30 Page ID#:5

commit crimes arising from, and related to, the sexual
exploitation of children.
III. TRAINING AND EXPERIENCE ON CHILD EXPLOITATION OFFENSES,

COMPUTERS, THE WORLDWIDE INTERNET COMPUTER COMMUNICATION
NETWORK, AND DEFINITION OF TERMS

8. In this affidavit, the terms “minor,” “sexually

explicit conduct,” “visual depiction,” “producing,” and “child
pornography” are defined as set forth in 18 U.S.C. § 2256. The
term “computer” is defined as set forth in 18 U.S.C.

9. Based upon my training and experience in the
investigation of child pornography, and information related to
me by other law enforcement officers involved in the
investigation of child pornography, I know the following

information about the use of computers with child pornography:

a. Computers and Child Pornography. Computers and

computer technology have revolutionized the way in which child
pornography is produced, distributed, and utilized. Child
pornographers can now produce both still and moving images
directly from a common video camera and can convert these images
into computer-readable formats. The use of digital technology
has enabled child pornographers to electronically receive,
distribute, and possess large numbers of child exploitation
images and videos with other Internet users worldwide.

b. File Storage. Computer users can choose their

method of storing files: either on a computer’s hard drive, an
external hard drive, a memory card, a USB thumb drive, a smart

phone or other digital media device, etc. (i.e., “locally”) or
on virtual servers accessible from any digital device with an
Internet connection (i.e., “cloud storage”). Computer users
frequently transfer files from one location to another, such as
from a phone to a computer or from cloud storage to an external
hard drive. Computer users also often create “backup,” or
duplicate, copies of their files. In this way, digital child
pornography is extremely mobile and such digital files are
easily reproduced and transported. For example, with the click
of a button, images and videos containing child pornography can
be put onto external hard drives small enough to fit onto a
keychain. Just as easily, these files can be copied onto
compact disks and/or stored on mobile digital devices, such as
smart phones and tablets. Furthermore, even if the actual child
pornography files are stored on a “cloud,” files stored in this
manner can only be accessed via a digital device. Therefore,
viewing this child pornography would require a computer,
smartphone, tablet, or some other digital device that allows the
user to access and view files on the Internet.

on Internet. The term “Internet” is defined as the
worldwide network of computers -- a noncommercial, self-
governing network devoted mostly to communication and research
with roughly 500 million users worldwide. The Internet is not
an online service and has no real central hub. It is a
collection of tens of thousands of computer networks, online
services, and single user components. In order to access the
Internet, an individual computer user must use an access

provider, such as a university, employer, or commercial Internet
Service Provider (“ISP”), which operates a host computer with
direct access to the Internet.

d. Internet Service Providers. Individuals and

businesses obtain access to the Internet through ISPs. ISPs
provide their customers with access to the Internet using
telephone or other telecommunications lines; provide Internet e-
mail accounts that allow users to communicate with other
Internet users by sending and receiving electronic messages
through the ISPs’ servers; remotely store electronic files on
their customer’s behalf; and may provide other services unique
to each particular ISP. ISPs maintain records pertaining to the
individuals or businesses that have subscriber accounts with
them. Those records often include identifying and billing
information, account access information in the form of log
files, e-mail transaction information, posting information,
account application information, and other information both in
computer data and written record format.

e. IP Addresses. An Internet Protocol address (“IP

Address”) is a unique numeric address used to connect to the
Internet. An IPv4 IP Address is a series of four numbers, each
in the range 0-255, separated by periods (e.g., 121.56.97.178).
In simple terms, one computer in a home may connect directly to
the Internet with an IP Address assigned by an ISP. What is now
more typical is that one home may connect to the Internet using
multiple digital devices simultaneously, including laptops,
tablets, smart phones, smart televisions, and gaming systems, by

way of example. Because the home subscriber typically only has
Case 2:22-mj-02689-DUTY Document 1 Filed 07/11/22 Page 8of30 Page ID#:8

one Internet connection and is only assigned one IP Address ata
time by their ISP, multiple devices in a home are connected to
the Internet via a router or hub. Internet activity from every
device attached to the router or hub is utilizing the same
external IP Address assigned by the ISP. The router or hub
“routes” Internet traffic so that it reaches the proper device.
Most ISPs control a range of IP Addresses. The IP Address for a
user may be relatively static, meaning it is assigned to the
same subscriber for long periods of time, or dynamic, meaning
that the IP Address is only assigned for the duration of that
online session. Most ISPs maintain records of which subscriber
was assigned which IP Address during an online session.

IV. TRAINING AND EXPERIENCE ON INSTAGRAM

10. Based on my training and experience, knowledge of the
investigation, information provided by other law enforcement
officers, and review of publicly available information, I know
the following.

a. Instagram owns and operates a free-access social-
networking website. Instagram allows its users to create their
own profile pages, which can include a short biography, or
“bio,” a photo of themselves, and other information. Users can
access Instagram through the Instagram website or by using a
special electronic application (“app”) created by the company
that allows users to access the service through a mobile device.

b. Instagram permits users to post photos and videos
to their profiles on Instagram and otherwise share photos and

videos with others on Instagram, as well as certain other
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 9of30 Page ID #:9

social-media services, including Flickr, Facebook, and Twitter.
When posting or sharing a photo or video on Instagram, a user
can add the following to the photo/video: a caption; various
“tags” that can be used to search for the photo/video (e.g., a
user may add the tag “#vw” so that people interested in
Volkswagen vehicles can search for and find the photo/video) ;
location information, including geotags or a specific location
name; and other information. A user can also apply a variety of
“filters” or other visual effects that modify the look of the
posted photos and videos. In addition, Instagram allows users
to make comments on posted photos and videos, including photos
and videos that the user posts or photos and videos posted by
other users of Instagram. Users can also “like” photos and
videos, meaning that they can express approval of a photo or
video by using Instagram’s “like” feature.

Cc. Instagram allows users to have “friends,” which
are other individuals with whom the user can share information
without making the information public. Friends on Instagram may
come from either contact lists maintained by the user, other
third-party social media websites and information, or searches
conducted by the user on Instagram profiles. Instagram collects
and maintains this information.

d. Instagram also allows users to “follow” another
user, which means that they receive updates about posts made by
the other user. Users may also “unfollow” users, that is, stop
following them or block them, which prevents the blocked user

from following that user.
Case 2:22-mj-02689-DUTY Document 1 Filed 07/11/22 Page 10 of 30 Page ID #:10

e. Instagram allows users to post and share various
types of user content in their galleries, including photos,
videos, captions, comments, and other materials. Such items can
contain metadata, i.e., content about the data such as the date
and time the photo or video was taken. Instagram collects and
maintains user content that users post to Instagram or share
through Instagram.

f. Instagram users may send photos and videos to
select individuals or groups via Instagram Direct. Information
sent via Instagram Direct does not appear in a user’s feed,
search history, or profile.

g. Instagram users may also make audio or video
calls to other Instagram users.

V. STATEMENT OF PROBABLE CAUSE

ll. Based on my review of law enforcement reports,
conversations with other law enforcement agents, and my own
knowledge of the investigation, I am aware of the following:

A. July 1, 2022 - A.T.’s Mother Reports Her Missing

12. On July 1, 2022, around 6:30 a.m., San Luis Obispo
County Sherriff’s Office (“SLOSO”) deputies responded to a
runaway juvenile report at a residence in Nipomo, California.
P.L. reported that her step-granddaughter, fifteen-year-old
minor victim A.T., had been staying with P.L. for the past two
months. On the morning of July 1, 2022, around 1:00 a.m., a
Ring camera captured footage of A.T. sneaking out the front door
of P.L.’s residence. P.L. did not know where A.T. had gone, and

A.T. had not returned. A.T. did not have any known friends in
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 11of30 Page ID#:11

the area.* A.T. was aware that her family was planning to throw
A.T. a quinceafiera party on July 2, 2022, the day after she
disappeared. P.L. stated that the guinceafiera party was very
important to A.T.

13. Deputies contacted A.T.’s father, C.T., who resides
in Santa Maria. cC.T. did not know his daughter’s whereabouts.
Deputies also contacted A.T.’s mother, J.C., who resides in
Arizona. J.C. did not know her daughter’s whereabouts.

14. After receiving the report, SLOSO deputies searched
the South San Luis Obispo County area and issued a “Be On the
Lookout” (“BOLO”) for A.T.

B. July 3, 2022 — SLOSO Detectives Interview A.T.’s
Cousin, J.D., and Learn That A.T. Had an Online
Relationship with An Older Man

15. On July 3, 2022, SLOSO detectives spoke to J.D., A.T’s
cousin, in Nipomo, California. J.D.’s father, V.D., was present
during the interview. During the interview, J.D. provided the
following information:

a. J.D. said that she lives in Santa Maria but
frequently stayed with A.T. at their grandmother’s, P.L.’s,
residence in Nipomo, California. J.D. told detectives about a
person who she knew as “Angel” who could be involved in A.T.’s
disappearance.

b. J.D. first learned of “Angel” approximately one
year ago. J.D. was having a sleepover with A.T. at P.L.’s

residence when she overheard A.T. speaking to a male voice on

2 Investigators later learned A.T.’s primary residence
during the school year is in Arizona where A.T.’s mother lives;
A.T. lives with her father in California during the summer.

10
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 12 of30 Page ID #:12

her phone through Instagram. J.D. asked A.T. who she was
speaking to, and A.T. responded that the person was a friend.
J.D. could hear the male asking A.T. why A.T. was in California
rather than Arizona. J.D. also said that the male sounded “mad”
that A.T. was in California.

c. A.T. did not initially identify the man but later
told J.D. that his name was “Angel” and that he was 15 years
old. A.T. only said that she had met “Angel” through her
brother who had in turn met him through a video game. J.D. said
that A.T. had never seen “Angel” because he refused to show his
face. “Angel” only communicated through text or voice contact.

d. J.D. began speaking to “Angel” herself, separate
from A.T., in March 2022 after A.T. used J.D.’s cell phone to
contact “Angel.” “Angel” began separately communicating with
J.D. by text on J.D.’s cell phone number. J.D. thought “Angel”
was Hispanic because he spoke primarily English with some
Spanish. J.D. also thought that “Angel” was older because he
used “big words” and did not understand slang or “teen words.”

e. “Angel” primarily used phone number (213) 349-
3752 to contact J.D. but also used number (707) 884-0322.

f. During March or April 2022, “Angel” contacted

J.D. and asked if J.D. wanted to run away. “Angel” said that he

3 Sheriff’s Detectives later used software available to law
enforcement to help identify the possessor of these phone
numbers. Detectives learned that both numbers were Voice Over
Internet Protocol (“VOIP”) numbers which deliver voice
communication or text messages over internet service bypassing
the need or requirement for cellular service or traditional
landline communication systems. These phone numbers are often
difficult to track or trace to a specific location because they
can be accessed from any internet accessible location.

11
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 13 of 30 Page ID #:13

and J.D. could go places and “do things.” J.D. replied “no.”
When “Angel” asked why, J.D. stopped responding. About six
minutes later, A.T. asked J.D. why she was being mean to
“Angel.” J.D. said she was not going to run away with anyone.
A.T. told J.D. that J.D. did not need to run away with “Angel,”
they could just hang out. J.D. did not hear from “Angel” for
the next month.

g. Approximately three days before A.T. went
missing, “Angel” re-established contact with J.D. “Angel” told
J.D. she had not heard from him because he was busy and had a
family problem he had to fix “before something happened.”

h. J.D. was present at the Santa Maria Mall with
A.T. on June 29, 2022, two days before A.T. disappeared, when
A.T. spoke with “Angel” through Instagram. A.T. used her
Instagram account for communication because her regular cellular
service was not activated at that time. A.T. also occasionally
uses Snapchat to communicate.

i. “Angel” spoke to A.T. more often than he did
with J.D. A.T. trusted “Angel” and would answer his questions
directly.

5. About one week ago, J.D. and A.T. realized that
“Angel” was speaking to them through different Instagram
accounts. “Angel” used Instagram account “dn84831” to contact
A.T. This account used by “Angel” displayed username “D N” and
displayed a 49ers logo next to his username. Angel used
Instagram account “t.707.dn” to communicate with J.D. This

account used by “Angel” also displayed username “D N” but hada

12
blank icon next to his user name. J.D. was present when A.T.
spoke to “Angel” through A.T.’s Instagram so J.D. knew “Angel”
was the same person uSing two separate Instagram accounts.

k. On June 30, 2022, the day before A.T.
disappeared, J.D. spoke to “Angel” on the phone. At the
conclusion of the call, the phone connection became poor and
Angel stated he was going through a tunnel.

1. J.D. attempted to contact “Angel” on the day A.T.
disappeared, at about 3:00 p.m. The call went through, however,
“Angel” did not answer and J.D. did not leave a message.

m. J.D. said that “Angel” went by the name Daniel.

n. J.D. further said that A.T. was looking forward
to her quinceafiera’ which was supposed to take place the day
after her disappearance. A.T. had already bought an expensive
dress and was counting down the days to her event. J.D. was
very concerned that A.T. had not returned home because the
quinceafiera was so important to her.

16. On July 3, 2022, SLOSO Detectives interviewed the
victim’s grandmother, P.L. P.L. said that on the morning of
July 1, 2022, she got “Angel’s” contact information from her
granddaughter, J.D., and texted “Angel” at (213) 349-3752.
“Angel” said that he did not know what P.L was talking about and

did not know where A.T. was.

4 I know that a quinceafiera is a traditional party held for
girls turning 15 in several cultures, including in America for
girls of Latina or Hispanic descent. A quinceafiera is the
equivalent of a “Sweet Sixteen” party. It is considered an
important milestone in a child’s life and is highly celebrated,
often with a large party.

13
Cc. A.T.’s Younger Sister, L.T., Confirms A.T.’s
Involvement with “Daniel”

17. On July 3, 2022, around 2:00 p.m., SLOSO Detectives
spoke with A.T.’s twelve-year-old sister, L.T. During the
interview, L.T. provided the following information:

a. L.T. was very close to A.T. A.T. spent most of
her time in her bedroom on her phone looking at TikTok or
Instagram. A.T. did not have many real-life friends or friends
at school.

b. A.T. talks to a boy named “Daniel” all the time
on Instagram. Daniel was about the same age as A.T. but the two
never met in person. Daniel played the video game Roblox with
A.T. and L.T.’s older brother.

on L.T. believed that Daniel lived in Los Angeles
but had also traveled to and stayed in Mexico. At some point,
Daniel said he was shot and placed into a coma. During this
period, A.T. began speaking with a family member of Daniel’s,
though L.T. was not sure who. L.T. showed detectives a picture
of someone who L.T. believed was Daniel. The picture depicted a
teenage Hispanic male wearing a generic football jersey with no
team or identifying insignia.

d. A.T. kept her relationship and communications
with Daniel a secret from her mother. A.T. told her mother that
Daniel was a friend from her school in Arizona but that was not
true. L.T. said that Daniel was the only secret that A.T. kept

from her mother.

14
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 16 of 30 Page ID #:16

e. On the night A.T. left, L.T. said she saw
headlights of a vehicle pull up and stop across the street from
P.L.’s residence, somewhere around 10:00 p.m. or 11:00 p.m. on
June 30, 2022. L.T. said she saw a large dark vehicle stopped
on the other side of the street. The car continued down the
street and then turned around at the end of the street and drove
back by the residence.

f. When L.T. brought up the car driving down their
street to A.T., A.T. told L.T. to go back to bed. L.T. then saw
A.T. get onto L.T.’s tablet and begin texting with someone.

g. Since A.T. disappeared, L.T. reported that A.T.’s
TikTok account has not had any activity. L.T. thought that was
odd because her sister was always on TikTok.

D. Instagram Provides Records Showing that NAVARRO Was

“Angel” and That He Attempted to Entice A.T. to Have a

Sexual Relationship

18. On July 4, 2022, the Honorable Gale Peron of the San
Luis Obispo County Superior Court signed a search warrant for
the three Instagram accounts associated with “Angel” that A.T.
and J.D. identified as well as A.T.’s own Instagram account.
Specifically, the accounts associated with “Angel” were
“DN84831,”" “T.707.dn,” and “dn.2021.01” (collectively, the
“Navarro Accounts”).

19. On July 7, 2022, Instagram provided subscriber
information related to the Navarro Accounts. Each of the
Navarro Accounts identified the subscriber as NAVARRO with a

birthdate of January 18, 1984. A search of California

15
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 17 of 30 Page ID #:17

Department of Motor Vehicles records for NAVARRO reveals that
January 18, 1984, is his actual birthdate.

20. A review of one of NAVARRO’s Instagram accounts,
“dn.2021.01,” revealed conversations between NAVARRO and A.T. on
A.T.’s Instagram account in which NAVARRO professed his love for
A.T. and discussed having sex with A.T. in order to impregnate
her.

a. On February 8, 2022, A.T. and NAVARRO began to
communicate online. A.T. explicitly told NAVARRO that she was
14 years old and from Arizona. The conversation quickly turned
romantic. The two began to call each other “baby” and profess
their love for each other.

b. On March 21, 2022, NAVARRO and A.T. had the
following text exchange about A.T. bearing NAVARRO’s child:

NAVARRO: Baby I want you so bad
NAVARRO: I want a baby

NAVARRO: Please

A.T.: Ok, I’1l give u one.
NAVARRO: Really

NAVARRO: When do we start?

A.T.: When ever [sic] we can

NAVARRO: Ok do I cum inside you?

A.T.: Yea

NAVARRO: Ok baby

16
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 18 of 30 Page ID #:18

Cc.

On March 26, 2022, NAVARRO and A.T. had the

following exchange about NAVARRO getting pictures of A.T. in the

shower:

d.

A.T.: I can’t take long because my little cousin
still has to take a shower

NAVARRO: Ok baby

NAVARRO: Dammnnn baby

NAVARRO: Booty

NAVARRO: Damn baby

A.T.: Baby

NAVARRO: Pussy baby

NAVARRO: Can I see you with legs open

A.T.: Hold on baby

NAVARRO: Dammmnn baby

NAVARRO: Baby you’re pussy looks bomb
A.T.: Baby

NAVARRO: I want you so bad

A.T.: Can I see you

NAVARRO: Play with your self [sic]

On the evening of her disappearance, NAVARRO and

A.T. had a conversation about A.T. leaving with NAVARRO:

A.T.: baby when you came did you see where all
the cars are from our grandma’s house
A.T.: Will [sic] there is a door where the kinda

where the cars are parked and there is another

17
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 19 of 30 Page ID #:19

door on the others side and there isn’t a camera

there

A.T.: baby I’m sorry but I can’t I’m not ready
feel like I’m abandoning baby . .. andI can’t
do that to them I’m sorry
e. On July 1, 2021, at 12:10 a.m., just a few
minutes before A.T. left her grandmother’s house, NAVARRO
messaged A.T., “you made me promises. remember to leave with me.
what about making our baby.” A couple of minutes later,
NAVARRO messaged A.T. “Juju is upset and can’t believe we drove
all this way to hear your excuses.”
f. At 12:33 a.m., NAVARRO messaged A.T., “Juju is
driving back to you wtf.” A minute later, NAVARRO messaged,

“Wow juju has your back.” A.T. then messaged, “I’m not gonna

break the promise with you .. . I’m not gonna be so scared and
I’m not gonna stay .. . I’ll go for real this time.”

g. At 12:38 a.m., NAVARRO messaged A.T., “We just
got here . . . Run to the corner.”

21. A review of NAVARRO’s other Instagram account,
“dn84831,” revealed additional communications between NAVARRO
and A.T. in which NAVARRO and A.T. said “I love you” to one
another.

22. In the same account, NAVARRO communicated with other
females who identified themselves as 14- and 15-years-old.
NAVARRO told another 15-year-old female that he wanted her to

have his baby. NAVARRO sent a photo of a penis to another 15-

18
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 20 of 30 Page ID #:20

year-old female. NAVARRO also requested nude photographs from
multiple other 14- and 15-year-old females.

E. Instagram Records Show NAVARRO and LE Worked Together
to Procure Underage Females for NAVARRO

23. The Instagram account, “dn.2021.01,” revealed
discussions between NAVARRO and another Instagram account,
“le.julie01,” concerning underage females. In the messages,
NAVARRO and “le.julie01” exchanged screen shots of social media
profiles associated with apparent underage females. NAVARRO
then instructed “le.julie01” to message the underage females
associated with the various profiles informing the females that
NAVARRO was a friend. NAVARRO referred to “le.julie0l1” as
“JuJu” during these conversations.

24. The publicly accessible profile for “le.julie0d1”
showed a picture of a female in her late teens or early
twenties. The profile identified “le.julie01” as a cheerleader
who graduated in 2019. In March 2022, “le.julie01” sent NAVARRO
images of money order receipts that contained LE’s name, her
address in Garden Grove, California, and her cell phone number,
(714) 482-8815 (“Le Cell”). California DMV records for LE
listed the same Garden Grove address as the one shown on the
money orders in the “le.julie01” account. In response to a
search warrant, T-Mobile later identified the subscriber of Le
Cell as LE.

25. Subsequent search of border crossing records revealed
that LE and NAVARRO crossed the United States-Mexico border

together on several occasions in 2022.

19
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 21 of 30 Page ID#:21

F. Ping Information for NAVARRO’s and LE’s Cell Phones
Show That They Traveled to Nipomo at the Time of
A.T.’s Disappearance and Then Traveled to Mexico

26. Instagram also provided information about the IP
addresses that were used by NAVARRO to access the account,
“dn.2021.01.” On June 30, 2022, this account used IP address
2607: £6b90:73a0:6a10:04c6:bbd2:7lba:ccal (the “Suspect IP
Address”) to log on to Instagram. SLOSO Detectives used
publicly accessible resources to determine that the Suspect IP
Address was associated with T-Mobile.

27. On July 7, 2022, the Honorable Barry T. LaBarera, San
Luis Obispo County Superior Court, signed a search warrant
directing T-Mobile to provide information about the Suspect IP
Address.

28. In response, T-Mobile stated that the Suspect IP
Address was associated with NAVARRO’s account. The account
listed NAVARRO’s name, true date of birth, and cell phone
number, (909) 331-7658 (“Navarro Cell”).

29. On July 7, 2022, the Honorable Gale Peron of the San
Luis Obispo County Superior Court signed a warrant directing T-
Mobile to provide historical GPS location information for
Navarro Cell and Le Cell. GPS location data for both Navarro
Cell and Le Cell placed both phones in the Nipomo area near
A.T.’s house around the time that A.T. disappeared, between
midnight and 1:00 a.m. on July 1, 2022. The phones then left
the Nipomo area around 1:20 a.m. on July 1, 2022, were pinging
in the area of a gas station in Santa Barbara, California, and

then traveled the US-101 freeway into the Los Angeles area

20
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 22 of 30 Page ID #:22

ultimately arriving at the area of Chula Vista, California, near
the United States-Mexico border around 6:20 a.m. on July 1,
2022.

G. NAVARRO and LE Return to the United States, Are
Arrested, and Admit They Took A.T. from Nipomo and
Transported Her to Mexico

30. On July 10, 2022, around 9:30 p.m., LE and NAVARRO

crossed the border into the United States from Mexico driving in
the SUBJECT VEHICLE together. Both were detained on outstanding
arrest warrants issued by the San Luis Obispo County Superior

Court.

31. Detectives Mirandized both NAVARRO and LE and both

agreed to speak with detectives.

a. LE stated that she and NAVARRO had developed an
online relationship with A.T. over social media. LE knew that
A.T. had recently turned 15 years of age. LE learned that A.T.
was not happy in her home environment, so she and NAVARRO drove
to A.T.’s residence where they picked up A.T. and transported
her across the border into Mexico. LE and NAVARRO had A.T.
conceal herself in the back seat of their car so she would not
be detected. LE said that she and NAVARRO had taken A.T. to
NAVARRO’s father’s residence in Mexico.

b. NAVARRO told law enforcement that he had gone to
a city starting with the letter “N” in California in late June
or early July 2022. NAVARRO further admitted that he and LE had

taken A.T. to NAVARRO’s father’s residence in Mexico.

21
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 23 of 30 Page ID #:23

H. Law Enforcement Recovers the SUBJECT DEVICES from the
SUBJECT VEHICLE

32. Upon their arrival at the border on July 10, 2022, law
enforcement searched the SUBJECT VEHICLE and recovered the
SUBJECT DEVICES from the car.

I. July 11, 2022 - Law Enforcement Recovers A.T. from
NAVARRO’s Father’s House in Mexico

33. On July 11, 2022, SLOSO detectives spoke with M.L.,
who is NAVARRO’s ex-wife with whom she shares custody over their
two children. M.L. said that NAVARRO and LE had picked up M.L.
and NAVARRO’s two kids on July 8, 2022, and brought them to
NAVARRO’s father’s house in Tijuana, Mexico.

34. M.L. sent law enforcement videos of her children that
LE had taken on her cell phone and sent to M.L. on July 8 and 9,
2022. The videos were date and time stamped and had geolocation
data associated with each video, including the latitude and
longitude where they were taken. Detectives used Google Earth
to locate the area associated with the videos and obtained a map
of that area. Detectives showed the map to LE who confirmed
that the map showed NAVARRO’s father’s residence where A.T. was
currently.

35. Later that evening, Mexican law enforcement went to
NAVARRO’s residence, found A.T., and took her into protective
custody. A.T. is expected to be reunited with her father soon.

VI. TRAINING AND EXPERIENCE ON INDIVIDUALS WHO HAVE A SEXUAL
INTEREST IN CHILDREN

36. Based on my training and experience, and the training

and experience of other law enforcement officers with whom I

22
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 24 of 30 Page ID #:24

have had discussions, I have learned that individuals who view
and possess multiple images of child pornography are often
individuals who have a sexual interest in children and in images
of children, and that there are certain characteristics common
to such individuals:

a. Individuals who have a sexual interest in
children or images of children may receive sexual gratification,
stimulation, and satisfaction from contact with children; or
from fantasies they may have viewing children engaged in sexual
activity or in sexually suggestive poses, such as in person, in
photographs, or in other visual media, or from literature
describing such activity. These individuals often maintain
possession of these items for long periods of time and keep
their collections in numerous places - in digital devices in
their homes, in their cars, in their workplaces, or on their
persons.

b. Individuals who have a sexual interest in
children or images of children also may correspond with and/or
meet others to share information and materials (including
through digital distribution via the Internet); conceal such
correspondence as they do their sexually explicit material; and
often maintain lists of names, addresses, and telephone numbers
of individuals with whom they have been in contact and who share
the same interests in child pornography. These individuals
often maintain possession of these items for long periods of

time.

23
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 25 of 30 Page ID #:25

c. Digital child pornography on a digital device is
easy to maintain for long periods of time. Modern digital
devices often have extremely large storage capacities.
Furthermore, cheap and readily available storage devices, such
as thumb drives, external hard drives, and compact discs make it
simple for individuals with a sexual interest in children to
download child pornography from the Internet and save it -
simply and securely - so it can be accessed or viewed
indefinitely.

d. Furthermore, even if a person deleted any images
of child pornography that may have been possessed or
distributed, there is still probable cause to believe that there
will be evidence of the illegal activities - that is, the
possession, receipt, and/or distribution of child pornography -
on the SUBJECT DEVICES or on his person. Based on my training
and experience, as well as my conversations with digital
forensic experts, I know that remnants of such files can be
recovered months or years after they have been deleted from a
computer device. Evidence that child pornography files were
downloaded and viewed can also be recovered, even after the
files themselves have been deleted, using forensic tools.
Because remnants of the possession, distribution, and viewing of
child pornography is recoverable after long periods of time,
searching the SUBJECT DEVICES could lead to evidence of the
child exploitation offenses.

e. Individuals who have a sexual interest in

children will often use female friends, acquaintances, or

24
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 26 of 30 Page ID #:26

girlfriends to communicate with, and gain the trust of, young
girls before sexually exploiting them. By using a female
friend, the individual with a sexual interest in children will
put a potential victim at ease and normalize the individual’s
sexual interest in the child victim.

VII. TRAINING AND EXPERIENCE ON DIGITAL DEVICES®

37. Based on my training, experience, and information from
those involved in the forensic examination of digital devices, I
know that the following electronic evidence, inter alia, is
often retrievable from digital devices:

a. Forensic methods may uncover electronic files or
remnants of such files months or even years after the files have
been downloaded, deleted, or viewed via the Internet. Normally,
when a person deletes a file on a computer, the data contained
in the file does not disappear; rather, the data remain on the
hard drive until overwritten by new data, which may only occur
after a long period of time. Similarly, files viewed on the
Internet are often automatically downloaded into a temporary
directory or cache that are only overwritten as they are
replaced with more recently downloaded or viewed content and may

also be recoverable months or years later.

° As used herein, the term “digital device” includes any
electronic system or device capable of storing or processing
data in digital form, including central processing units;
desktop, laptop, notebook, and tablet computers; personal
digital assistants; wireless communication devices, such as
paging devices, mobile telephones, and smart phones; digital
cameras; gaming consoles; peripheral input/output devices, such
as keyboards, printers, scanners, monitors, and drives; related
communications devices, such as modems, routers, cables, and
connections; storage media; and security devices.

25
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 27 of 30 Page ID #:27

b. Digital devices often contain electronic evidence
related to a crime, the device’s user, or the existence of
evidence in other locations, such as, how the device has been
used, what it has been used for, who has used it, and who has
been responsible for creating or maintaining records, documents,
programs, applications, and materials on the device. That
evidence is often stored in logs and other artifacts that are
not kept in places where the user stores files, and in places
where the user may be unaware of them. For example, recoverable
data can include evidence of deleted or edited files; recently
used tasks and processes; online nicknames and passwords in the
form of configuration data stored by browser, e-mail, and chat
programs; attachment of other devices; times the device was in
use; and file creation dates and sequence.

c. The absence of data on a digital device may be
evidence of how the device was used, what it was used for, and
who used it. For example, showing the absence of certain
software on a device may be necessary to rebut a claim that the
device was being controlled remotely by such software.

d. Digital device users can also attempt to conceal
data by using encryption, steganography, or by using misleading
filenames and extensions. Digital devices may also contain
“booby traps” that destroy or alter data if certain procedures
are not scrupulously followed. Law enforcement continuously
develops and acquires new methods of decryption, even for

devices or data that cannot currently be decrypted.

26
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 28 of 30 Page ID #:28

38. Based on my training, experience, and information from
those involved in the forensic examination of digital devices, I
know that it is not always possible to search devices for data
during a search of the premises for a number of reasons,
including the following:

a. Digital data are particularly vulnerable to
inadvertent or intentional modification or destruction. Thus,
often a controlled environment with specially trained personnel
may be necessary to maintain the integrity of and to conduct a
complete and accurate analysis of data on digital devices, which
may take substantial time, particularly as to the categories of
electronic evidence referenced above. Also, there are now so
many types of digital devices and programs that it is difficult
to bring to a search site all of the specialized manuals,
equipment, and personnel that may be required.

b. Digital devices capable of storing multiple
gigabytes are now commonplace. As an example of the amount of
data this equates to, one gigabyte can store close to 19,000
average file size (300kb) Word documents, or 614 photos with an
average size of 1.5MB.

39. The search warrant requests authorization to use the
biometric unlock features of a device, based on the following,
which I know from my training, experience, and review of
publicly available materials:

a. Users may enable a biometric unlock function on
some digital devices. To use this function, a user generally

displays a physical feature, such as a fingerprint, face, or

27
Case 2:22-mj-02689-DUTY Document1 Filed 07/11/22 Page 29 of 30 Page ID #:29

eye, and the device will automatically unlock if that physical
feature matches one the user has stored on the device. To
unlock a device enabled with a fingerprint unlock function, a
user places one or more of the user’s fingers on a device’s
fingerprint scanner for approximately one second. To unlock a
device enabled with a facial, retina, or iris recognition
function, the user holds the device in front of the user’s face
with the user’s eyes open for approximately one second.

b. In some circumstances, a biometric unlock
function will not unlock a device even if enabled, such as when
a device has been restarted or inactive, has not been unlocked
for a certain period of time (often 48 hours or less), or after
a certain number of unsuccessful unlock attempts. Thus, the
opportunity to use a biometric unlock function even on an
enabled device may exist for only a short time. I do not know
the passcodes of the devices likely to be found in the search.

40. Thus, the warrant I am applying for would permit law
enforcement personnel to, with respect to any device that
appears to have a biometric sensor and falls within the scope of
the warrant: (1) depress NAVARRO’s or LE’s thumb and/or fingers
on the device(s); and (2) hold the device(s) in front of
NAVARRO’s or LE’s face with his or her eyes open to activate the
facial-, iris-, and/or retina-recognition feature.

41. Other than what has been described herein, to my
knowledge, the United States has not attempted to obtain this

data by other means.

28
Case 2:22-mj-02689-DUTY Document 1 Filed 07/11/22 Page 30 of 30 Page ID #:30

CONCLUSION

42. For all of the reasons described above, there is
probable cause to believe that NAVARRO and LE have committed a
violation of 18 U.S.C. § 2423(a) (Transportation with Intent to
Engage in Criminal Sexual Activity with a Minor). There is also
probable cause that the items to be seized described in
Attachment B for the SUBJECT OFFENSES will be found in a search
of the vehicle, persons, and devices in Attachments A-1, A-2, A-

3, and A-4.

Attested to by the applicant in
accordance with the requirements
of Fed. R. Crim. P. 4.1 by
telephone on this 11th day of

ha 2022.

UNITED STATES MAGISTRATE JUDGE

29


File and source

File

1.pdf

Size

518,515 bytes

SHA-256

7c17c9f98d4d13730871790842682a4855f34f55be5925b75b65e6cc09a6d36b

Our copy

1.pdf

Original

No public link identified.