Court filing — No. 6:23-cr-00209 (Dkt. 1, M.D. Fla.)

Summary

A criminal complaint affidavit by Kevin Kaufman, a Special Agent with the Federal Bureau of Investigation since 2004, filed October 11, 2023 as Document 1 in Case 6:23-cr-00209-WWB-LHP in the U.S. District Court for the Middle District of Florida. The affidavit is submitted in support of a criminal complaint against Brian D. Hamilton for a violation of 18 U.S.C. § 2252A(a)(2). It states the agent's belief that there is probable cause that on or about July 22, 2023 Hamilton received child pornography, and describes the agent's assignment to the FBI Crimes Against Children/Innocent Images Unit in Orlando. The filing is 14 pages.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 1 of 14 PageID 1
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 2 of 14 PageID 2




  STATE OF FLORIDA                                      CASE NO. 6:23-mj-

  COUNTY OF ORANGE

                                    AFFIDAVIT

        I, Kevin Kaufman, being duly sworn, do hereby depose and state as

  follows:

        This affidavit is submitted in support of a criminal complaint against Brian

  D. Hamilton (Hamilton) for a violation of 18 U.S.C. § 2252A(a)(2). As set forth

  in more detail below, I believe there is probable cause that on or about July 22,

  2023, in the Middle District of Florida, Hamilton knowingly received child

  pornography using any means or facility of interstate or foreign commerce, in

  violation of 18 U.S.C. § 2252A(a)(2).

        1.     I am a Special Agent with the Federal Bureau of Investigation

  (FBI) and have been since 2004. I am currently assigned to the FBI Crimes

  Against Children/Innocent Images Unit in Orlando, Florida. While assigned

  to the FBI Innocent Images Task Force, my responsibilities include

  investigating possible criminal violations of Title 18 of the United States Code.

        2.     I have received specialized training in the investigations of sex

  crimes, child exploitation, child pornography, and computer crimes. I have

  participated in investigations of persons suspected of violating federal child

  pornography laws, including 18 U.S.C. §§ 2251 and 2252A. I have also
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 3 of 14 PageID 3




  participated in investigations of persons suspected of enticing minors, in

  violation of 18 U.S.C. § 2422(b).

        3.       I have participated in various training courses for the investigation

  and enforcement of federal child pornography laws in which computers are used

  as the means for producing, receiving, transmitting, and storing child

  pornography.      Additionally, I have been involved in authoring and have

  participated in the execution of search warrants involving searches and seizures

  of computers, computer equipment, software, and electronically stored

  information.

        4.       I make this affidavit based on my experience and background as a

  law enforcement officer, including my experience with the FBI, my personal

  participation in the investigation, and information provided by other law

  enforcement officers and agency personnel. As set forth in more detail below, I

  have probable cause to believe that a crime has taken place, that is, the receipt

  of child pornography, in violation of 18 U.S.C. § 2252A(a)(2).

                            STATUTORY AUTHORITY

        6.       It is a violation of 18 U.S.C. § 2252A(a)(2) to knowingly receive

  child pornography, as defined in 18 U.S.C. § 2256(8), using any means or

  facility of interstate commerce, or in or affecting interstate commerce.




                                            2
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 4 of 14 PageID 4




                               PROBABLE CAUSE

        7.       On October 3, 2023, I received a lead from the FBI Headquarters

  (HQ) Child Exploitation Operational Unit (CEOU); this unit is responsible for

  Operation Rescue Me (ORM). ORM is a strategic partnership between FBIHQ

  and the National Center for Missing and Exploited Children (NCMEC). ORM

  focuses strictly on determining the identity of child victims who are depicted in

  child exploitation material. Various techniques are used to exploit clues and or

  information that can be observed in the background of child exploitation images

  or videos, with the hope of first identifying and rescuing the child victim(s), and

  second, developing information that leads to the capture the suspected

  perpetrator.

        8.       The CEOU, which is part of the FBI Criminal Investigative

  Division's (CID) Violent Crime Section (VCS), currently maintains

  responsibility for the ORM initiative. The CEOU's ORM team works with field

  offices once specific information is developed that is actionable.

        9.       On August 31, 2023, a reliable foreign partner contacted ORM and

  referred a series of child sexual abuse material (CSAM) that was first seen in

  Cybertip -120736412. This Cybertip was submitted by an electronic service

  provider based on a user on their platform distributing multiple images and

  videos on or about March 22, 2023. Within these CSAM videos was one eleven




                                           3
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 5 of 14 PageID 5




  (11) second video of an adult male tongue-kissing a prepubescent male. A still

  image (redacted to protect the child’s identification) from that video is depicted

  below.




         10.    The video was distributed with the following caption “Love when

  boys and daddy kiss          you think they will let me join??? #gayincest”. The

  adult male’s face is clearly visible in the video as he is sitting on a gray colored,

  textured fabric couch. The FBI utilized an open-source image repository to

  analyze the images closely and compare them to all images in the repository.

  This resulted in the identification of a male on Instagram, with the following

  account name, instagram.com/harzakthebear. It also identified Facebook




                                            4
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 6 of 14 PageID 6




  pages from the account, facebook.com/harzak.metallum81. Both these

  accounts belong to Brian D. Hamilton of Orlando, Florida.

        11.    After receiving Hamilton’s name and personal identifiers, I

  reviewed his information on the state of Florida Drivers and Vehicle

  Information Database (DAVID). I compared the male depicted in the video

  with the DAVID photograph, and based on my training and experience, I

  believe the two individuals to be the same. The images are set out below. I base

  my conclusion on the relative size of both individuals, the shape of the face,

  particularly the mouth, the eyebrows, the shaping of the facial hair-beard and

  its coloration, as well as the visible forehead based on the receding hairline.




        12.    DAVID records identify Hamilton’s residence as 4856 Spring Run

  Avenue, Orlando, Florida. I conducted an open-source check on that address

  and located several images of the inside the residence, online. These images

  were part of the residence listing for the Subject Residence on the property site




                                           5
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 7 of 14 PageID 7




  Zillow. I then compared the background in the video to the detailed images that

  are contained in the property listing. Based on my training and experience, and

  my observation, one of the rooms in the Zillow listing was very similar to the

  visible part of the room in the CSAM video in which the individual believed to

  be Hamilton is tongue-kissing the child victim. The two images are depicted

  below. Based on my training and experience, the room color, the color and

  visible texture of the fabric on the couch, the location of the window and the

  crown-molding that is visible, it is my belief that the CSAM was recorded in this

  room of the subject property.




        13.    Open-source checks identified that Hamilton utilized a Facebook

  page under the name of “Balfre Green”. I reviewed all the posted images on this

  account. I identified one image of Hamilton sitting on a gray couch. That image




                                          6
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 8 of 14 PageID 8




  is depicted below. Scrutinizing this image very closely, and based on my

  training and experience, the couch that Hamilton is sitting on is very similar to

  the couch observed in the video of the adult male believed to be Hamilton

  kissing the unknown child victim. This conclusion is based on the fabric and

  color visible in the moving images; I do note that the screen capture does alter

  the color slightly, making the color of the couch appear darker than on the

  moving image. Both images are depicted side by side below.




        14.    CEOU also located another Cybertip-162713839 in which several

  CSAM images and videos were distributed. Within the CSAM distributed was

  another video of a person that is believed to be Hamilton kissing the same child

  victim in a very distinct yellow colored room. I went back Zillow to review the

  residential images and found an image of a yellow room in the Subject




                                          7
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 9 of 14 PageID 9




  Residence. Based on my training and experience, and my observation, the room

  color is very similar if not identical, to include the location of a celling air vent.

         15.    I then did another screen capture from this second video to get

  another image of the man believed to be Hamilton’s face to compare to the

  DAVID image. These images are depicted below. Based on my training and

  experience, and my comparison of the two images, it is my belief that they

  depict the same individual. I base my conclusion on the following factors: the

  shape of the face; the visible skin color; the size and shape of the ears; the shape

  and color of the eyebrows; the shape and color of the facial hair, which includes

  a gap in the middle of the chin, and with skin under the lower lip visible.




         16.    Based on the information gathered above, the FBI conducted

  further searches on Hamilton’s social media user account identifiers. During

  the search, the FBI located three separate Cybertip reports. These Cybertip




                                             8
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 10 of 14 PageID 10




   reports are identified by their respective numbers and are as follows, numbers

   124025570, 53442587, and 50759333.

         17.    I reviewed Cybertip -124025570 and discovered this report was

   made anonymously to NCMEC on May 5, 2022. The person who made the

   report stated that Hamilton sent explicit images of children over a Telegram

   chat and admitted to molesting multiple children. Hamilton was alleged to have

   utilized the Telegram account name @HarzakTheBear. I can confirm that this

   is Hamilton’s listed Telegram account.

         18.    I reviewed Cybertip- 53442587 and discovered that a user in a

   Facebook group distributed several images and videos of CSAM.                More

   specifically, on August 4, 2019, Hamilton was allegedly in a group in which a

   Facebook user distributed multiple images and videos of CSAM. Hamilton’s

   Facebook account in this tip was identified as harzak.metallum81, with a date

   of   birth   of   XX/XX/1981      and         a   verified   confirmed   email   of

   harzak.metallum@gmail.com. I can also confirm that harzak.metallum81 is

   Hamilton’s Facebook account/address. In addition, Hamilton’s driver’s license

   lists XX/XX/1981, as his date of birth.

         19.    I reviewed Cybertip- 50759333 and discovered another user

   reported several Twitter accounts for trading CSAM. The person who reported

   the tip wrote the following: “The following 150 Twitter accounts were all




                                             9
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 11 of 14 PageID 11




   reported on 06-19-19 for having Adult, Graphic, and Hateful content by MANY

   concerned Twitter users. These accounts were selected because they ALL

   Retweeted and/or Liked one of the following child porn pics. These are all

   OBVIOUS CHILD PORN!!!” I reviewed the usernames of the Twitter accounts

   that were reported and identified Hamilton’s Twitter account as being part of

   the group that was alleged to be trading CSAM.

         20.    Based on the above investigation, a search and seizure warrant

   was sought for Hamilton’s residence, 4856 Spring Run Avenue, Orlando,

   Florida 32819. On October 10, 2023, the Honorable Magistrate Judge Irick

   signed the search and seizure warrant, 6:23-mj-2106, which was executed o

   October 11, 2023.

         21.    Hamilton was present and after FBI agents secured the residence

   a non-custodial, recorded interview was conducted of Hamilton. The interview

   took place outside his residence and inside an FBI vehicle. Hamilton told agents

   that he had utilized “harzakthebear” and “harzakmettalum81” on several social

   media platforms to include Telegram, Facebook, Twitter, and Instagram.

   During the interview, Hamilton was shown many images taken from various

   social media platforms. Hamilton identified himself in the images and also

   identified the specific platform they were taken from.




                                           10
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 12 of 14 PageID 12




          22.    Hamilton was shown an image that was clipped from the kissing

   video described previously. Initially, Hamilton stated the adult male in the

   image was his brother. However, when asked follow up questions, Hamilton

   admitted that the image was of him; he was then shown an image of him kissing

   the young male child. Hamilton identified the child as A.T. and stated that the

   child was his grandnephew. Hamilton stated A.T. was approximately 5 years

   old when the video was taken.

          23.    Hamilton was asked if he touched A.T. during the production of

   the kissing videos. Hamilton stated that he masturbated A.T.’s penis to arousal

   on three separate occasions and A.T. touched his (Hamilton’s) penis on one

   occasion.    Hamilton stated the incidents occurred in his living room and

   bathroom of his current residence, as well as in the restroom of a local

   restaurant. Hamilton stated he utilized an iPhone to record all the encounters

   at is residence.

          24.    Hamilton was asked if he viewed CSAM. Hamilton admitted he

   viewed CSAM and masturbated to CSAM. Hamilton has been viewing CSAM

   since he was a teenager. Hamilton has tried to stop viewing CSAM but could

   not. Hamilton stated he last viewed CSAM in March of 2023.

          25.    Hamilton stated he distributed A.T.’s videos which he produced,

   to establish bona fides that he is a “hands on with offender” to receive CSAM




                                          11
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 13 of 14 PageID 13




   in exchange. Hamilton stated that he obtained the CSAM from the platform

   Telegram. Hamilton told agents that he moved the CSAM he received onto a

   hard drive stored in a desk drawer in his bedroom on the same day that he

   received it. Hamilton stated he distributed A.T.’s videos multiple times in order

   to get CSAM in return.

            26.   Hamilton stated that he is a pedophile and that he liked children.

   He also explained that he abused A.T. because he liked children and he was

   trying to “get even” with his niece because of how she had treated him in the

   past. Hamilton identified multiple users to whom he sent the videos of A.T.’s

   abuse.     Hamilton last sent the videos of A.T. out in March 2022.

            27.   During the search of Hamilton’s room investigators found boys

   underwear under the bed. Hamilton recorded himself utilizing the underwear

   to masturbate and fantasize about sexually interacting with children. Hamilton

   sent these videos to other people interested in molesting children.

            FORENSIC PREVIEW OF BRIAN HAMILTON

            28.   During the search of the residence, the FBI located multiple

   devices that were in Hamilton’s bedroom and belonged to Hamilton.             In

   particular, the FBI located a Western Digital external hard drive. Agents

   conducted an initial forensic preview of the device and located numerous videos

   of CSAM. The CSAM videos were located in a folder titled “Dark Desires”




                                            12
Case 6:23-cr-00209-WWB-LHP Document 1 Filed 10/11/23 Page 14 of 14 PageID 14


File and source

File

1.pdf

Size

761,012 bytes

SHA-256

e3d576021846bdc55becbe8fad458fdf3d80ffc12110a5bc0423928a469e3efa

Our copy

1.pdf

Original

No public link identified.