Court filing — No. 6:23-mj-02112 (Dkt. 1, M.D. Fla.)

Summary

The criminal complaint and supporting affidavit of FBI Special Agent Kevin Kaufman against Brian D. Hamilton, filed October 11, 2023 as Document 1 in magistrate Case 6:23-mj-02112-DCI in the U.S. District Court for the Middle District of Florida. The affidavit charges a violation of 18 U.S.C. § 2252A(a)(2) and states the agent's belief that there is probable cause that on or about July 22, 2023 Hamilton received child pornography. It sets out the agent's background since 2004 and his assignment to the FBI Crimes Against Children/Innocent Images Unit in Orlando. The filing is 14 pages.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 1 of 14 PageID 1
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 2 of 14 PageID 2




STATE OF FLORIDA                                      CASE NO. 6:23-mj-

COUNTY OF ORANGE

                                  AFFIDAVIT

      I, Kevin Kaufman, being duly sworn, do hereby depose and state as

follows:

      This affidavit is submitted in support of a criminal complaint against Brian

D. Hamilton (Hamilton) for a violation of 18 U.S.C. § 2252A(a)(2). As set forth

in more detail below, I believe there is probable cause that on or about July 22,

2023, in the Middle District of Florida, Hamilton knowingly received child

pornography using any means or facility of interstate or foreign commerce, in

violation of 18 U.S.C. § 2252A(a)(2).

      1.     I am a Special Agent with the Federal Bureau of Investigation

(FBI) and have been since 2004. I am currently assigned to the FBI Crimes

Against Children/Innocent Images Unit in Orlando, Florida. While assigned

to the FBI Innocent Images Task Force, my responsibilities include

investigating possible criminal violations of Title 18 of the United States Code.

      2.     I have received specialized training in the investigations of sex

crimes, child exploitation, child pornography, and computer crimes. I have

participated in investigations of persons suspected of violating federal child

pornography laws, including 18 U.S.C. §§ 2251 and 2252A. I have also
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 3 of 14 PageID 3




participated in investigations of persons suspected of enticing minors, in

violation of 18 U.S.C. § 2422(b).

      3.       I have participated in various training courses for the investigation

and enforcement of federal child pornography laws in which computers are used

as the means for producing, receiving, transmitting, and storing child

pornography.      Additionally, I have been involved in authoring and have

participated in the execution of search warrants involving searches and seizures

of computers, computer equipment, software, and electronically stored

information.

      4.       I make this affidavit based on my experience and background as a

law enforcement officer, including my experience with the FBI, my personal

participation in the investigation, and information provided by other law

enforcement officers and agency personnel. As set forth in more detail below, I

have probable cause to believe that a crime has taken place, that is, the receipt

of child pornography, in violation of 18 U.S.C. § 2252A(a)(2).

                          STATUTORY AUTHORITY

      6.       It is a violation of 18 U.S.C. § 2252A(a)(2) to knowingly receive

child pornography, as defined in 18 U.S.C. § 2256(8), using any means or

facility of interstate commerce, or in or affecting interstate commerce.




                                          2
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 4 of 14 PageID 4




                             PROBABLE CAUSE

      7.       On October 3, 2023, I received a lead from the FBI Headquarters

(HQ) Child Exploitation Operational Unit (CEOU); this unit is responsible for

Operation Rescue Me (ORM). ORM is a strategic partnership between FBIHQ

and the National Center for Missing and Exploited Children (NCMEC). ORM

focuses strictly on determining the identity of child victims who are depicted in

child exploitation material. Various techniques are used to exploit clues and or

information that can be observed in the background of child exploitation images

or videos, with the hope of first identifying and rescuing the child victim(s), and

second, developing information that leads to the capture the suspected

perpetrator.

      8.       The CEOU, which is part of the FBI Criminal Investigative

Division's (CID) Violent Crime Section (VCS), currently maintains

responsibility for the ORM initiative. The CEOU's ORM team works with field

offices once specific information is developed that is actionable.

      9.       On August 31, 2023, a reliable foreign partner contacted ORM and

referred a series of child sexual abuse material (CSAM) that was first seen in

Cybertip -120736412. This Cybertip was submitted by an electronic service

provider based on a user on their platform distributing multiple images and

videos on or about March 22, 2023. Within these CSAM videos was one eleven




                                         3
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 5 of 14 PageID 5




(11) second video of an adult male tongue-kissing a prepubescent male. A still

image (redacted to protect the child’s identification) from that video is depicted

below.




       10.    The video was distributed with the following caption “Love when

boys and daddy kiss          you think they will let me join??? #gayincest”. The

adult male’s face is clearly visible in the video as he is sitting on a gray colored,

textured fabric couch. The FBI utilized an open-source image repository to

analyze the images closely and compare them to all images in the repository.

This resulted in the identification of a male on Instagram, with the following

account name, instagram.com/harzakthebear. It also identified Facebook




                                          4
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 6 of 14 PageID 6




pages from the account, facebook.com/harzak.metallum81. Both these

accounts belong to Brian D. Hamilton of Orlando, Florida.

      11.    After receiving Hamilton’s name and personal identifiers, I

reviewed his information on the state of Florida Drivers and Vehicle

Information Database (DAVID). I compared the male depicted in the video

with the DAVID photograph, and based on my training and experience, I

believe the two individuals to be the same. The images are set out below. I base

my conclusion on the relative size of both individuals, the shape of the face,

particularly the mouth, the eyebrows, the shaping of the facial hair-beard and

its coloration, as well as the visible forehead based on the receding hairline.




      12.    DAVID records identify Hamilton’s residence as 4856 Spring Run

Avenue, Orlando, Florida. I conducted an open-source check on that address

and located several images of the inside the residence, online. These images

were part of the residence listing for the Subject Residence on the property site




                                         5
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 7 of 14 PageID 7




Zillow. I then compared the background in the video to the detailed images that

are contained in the property listing. Based on my training and experience, and

my observation, one of the rooms in the Zillow listing was very similar to the

visible part of the room in the CSAM video in which the individual believed to

be Hamilton is tongue-kissing the child victim. The two images are depicted

below. Based on my training and experience, the room color, the color and

visible texture of the fabric on the couch, the location of the window and the

crown-molding that is visible, it is my belief that the CSAM was recorded in this

room of the subject property.




      13.    Open-source checks identified that Hamilton utilized a Facebook

page under the name of “Balfre Green”. I reviewed all the posted images on this

account. I identified one image of Hamilton sitting on a gray couch. That image




                                        6
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 8 of 14 PageID 8




is depicted below. Scrutinizing this image very closely, and based on my

training and experience, the couch that Hamilton is sitting on is very similar to

the couch observed in the video of the adult male believed to be Hamilton

kissing the unknown child victim. This conclusion is based on the fabric and

color visible in the moving images; I do note that the screen capture does alter

the color slightly, making the color of the couch appear darker than on the

moving image. Both images are depicted side by side below.




      14.    CEOU also located another Cybertip-162713839 in which several

CSAM images and videos were distributed. Within the CSAM distributed was

another video of a person that is believed to be Hamilton kissing the same child

victim in a very distinct yellow colored room. I went back Zillow to review the

residential images and found an image of a yellow room in the Subject




                                        7
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 9 of 14 PageID 9




Residence. Based on my training and experience, and my observation, the room

color is very similar if not identical, to include the location of a celling air vent.

       15.    I then did another screen capture from this second video to get

another image of the man believed to be Hamilton’s face to compare to the

DAVID image. These images are depicted below. Based on my training and

experience, and my comparison of the two images, it is my belief that they

depict the same individual. I base my conclusion on the following factors: the

shape of the face; the visible skin color; the size and shape of the ears; the shape

and color of the eyebrows; the shape and color of the facial hair, which includes

a gap in the middle of the chin, and with skin under the lower lip visible.




       16.    Based on the information gathered above, the FBI conducted

further searches on Hamilton’s social media user account identifiers. During

the search, the FBI located three separate Cybertip reports. These Cybertip




                                           8
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 10 of 14 PageID 10




reports are identified by their respective numbers and are as follows, numbers

124025570, 53442587, and 50759333.

      17.    I reviewed Cybertip -124025570 and discovered this report was

made anonymously to NCMEC on May 5, 2022. The person who made the

report stated that Hamilton sent explicit images of children over a Telegram

chat and admitted to molesting multiple children. Hamilton was alleged to have

utilized the Telegram account name @HarzakTheBear. I can confirm that this

is Hamilton’s listed Telegram account.

      18.    I reviewed Cybertip- 53442587 and discovered that a user in a

Facebook group distributed several images and videos of CSAM.                More

specifically, on August 4, 2019, Hamilton was allegedly in a group in which a

Facebook user distributed multiple images and videos of CSAM. Hamilton’s

Facebook account in this tip was identified as harzak.metallum81, with a date

of   birth   of   XX/XX/1981      and         a   verified   confirmed   email   of

harzak.metallum@gmail.com. I can also confirm that harzak.metallum81 is

Hamilton’s Facebook account/address. In addition, Hamilton’s driver’s license

lists XX/XX/1981, as his date of birth.

      19.    I reviewed Cybertip- 50759333 and discovered another user

reported several Twitter accounts for trading CSAM. The person who reported

the tip wrote the following: “The following 150 Twitter accounts were all




                                          9
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 11 of 14 PageID 11




reported on 06-19-19 for having Adult, Graphic, and Hateful content by MANY

concerned Twitter users. These accounts were selected because they ALL

Retweeted and/or Liked one of the following child porn pics. These are all

OBVIOUS CHILD PORN!!!” I reviewed the usernames of the Twitter accounts

that were reported and identified Hamilton’s Twitter account as being part of

the group that was alleged to be trading CSAM.

      20.    Based on the above investigation, a search and seizure warrant

was sought for Hamilton’s residence, 4856 Spring Run Avenue, Orlando,

Florida 32819. On October 10, 2023, the Honorable Magistrate Judge Irick

signed the search and seizure warrant, 6:23-mj-2106, which was executed o

October 11, 2023.

      21.    Hamilton was present and after FBI agents secured the residence

a non-custodial, recorded interview was conducted of Hamilton. The interview

took place outside his residence and inside an FBI vehicle. Hamilton told agents

that he had utilized “harzakthebear” and “harzakmettalum81” on several social

media platforms to include Telegram, Facebook, Twitter, and Instagram.

During the interview, Hamilton was shown many images taken from various

social media platforms. Hamilton identified himself in the images and also

identified the specific platform they were taken from.




                                        10
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 12 of 14 PageID 12




       22.    Hamilton was shown an image that was clipped from the kissing

video described previously. Initially, Hamilton stated the adult male in the

image was his brother. However, when asked follow up questions, Hamilton

admitted that the image was of him; he was then shown an image of him kissing

the young male child. Hamilton identified the child as A.T. and stated that the

child was his grandnephew. Hamilton stated A.T. was approximately 5 years

old when the video was taken.

       23.    Hamilton was asked if he touched A.T. during the production of

the kissing videos. Hamilton stated that he masturbated A.T.’s penis to arousal

on three separate occasions and A.T. touched his (Hamilton’s) penis on one

occasion.    Hamilton stated the incidents occurred in his living room and

bathroom of his current residence, as well as in the restroom of a local

restaurant. Hamilton stated he utilized an iPhone to record all the encounters

at is residence.

       24.    Hamilton was asked if he viewed CSAM. Hamilton admitted he

viewed CSAM and masturbated to CSAM. Hamilton has been viewing CSAM

since he was a teenager. Hamilton has tried to stop viewing CSAM but could

not. Hamilton stated he last viewed CSAM in March of 2023.

       25.    Hamilton stated he distributed A.T.’s videos which he produced,

to establish bona fides that he is a “hands on with offender” to receive CSAM




                                       11
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 13 of 14 PageID 13




in exchange. Hamilton stated that he obtained the CSAM from the platform

Telegram. Hamilton told agents that he moved the CSAM he received onto a

hard drive stored in a desk drawer in his bedroom on the same day that he

received it. Hamilton stated he distributed A.T.’s videos multiple times in order

to get CSAM in return.

         26.   Hamilton stated that he is a pedophile and that he liked children.

He also explained that he abused A.T. because he liked children and he was

trying to “get even” with his niece because of how she had treated him in the

past. Hamilton identified multiple users to whom he sent the videos of A.T.’s

abuse.     Hamilton last sent the videos of A.T. out in March 2022.

         27.   During the search of Hamilton’s room investigators found boys

underwear under the bed. Hamilton recorded himself utilizing the underwear

to masturbate and fantasize about sexually interacting with children. Hamilton

sent these videos to other people interested in molesting children.

         FORENSIC PREVIEW OF BRIAN HAMILTON

         28.   During the search of the residence, the FBI located multiple

devices that were in Hamilton’s bedroom and belonged to Hamilton.             In

particular, the FBI located a Western Digital external hard drive. Agents

conducted an initial forensic preview of the device and located numerous videos

of CSAM. The CSAM videos were located in a folder titled “Dark Desires”




                                         12
Case 6:23-mj-02112-DCI Document 1 Filed 10/11/23 Page 14 of 14 PageID 14


File and source

File

1.pdf

Size

759,766 bytes

SHA-256

6aa9f5458565d1d933148e2127ac3d447d98f8159496be1a5ffb60893d2ecf51

Our copy

1.pdf

Original

No public link identified.