Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 5 of 9

FILE NAME: (Pthc) My 3Yo Daughter Getting Anal Enhanced

FILE TYPE: .MP4

DESCRJPTION: Video depicting nude female child approximate age of 3 to
6 lying on her back with her vagina exposed and an adult male anally
penetrating her.

FILE NAME: (Pthc) 4Yo Pae (Great New Cbaby) !!New Dark Studio 10 Cdl
(Dad And Babyj) 3Yo In Pink Gives Bj

FILE TYPE: .AVI

DESCRJPTION: Video depicting female child approximate age of 3 to 6. The
child is on her knees performing oral sex on an adult male.

Items 8 (the USB drive found hidden in Aring’s sock drawer) and 14 (an
HP Pavilion desktop computer) were forensically examined and found to contain
many images and videos constituting child pornography. Item 9 (a Cooler Master
desktop computer) was also determined to contain child pornography.

Item 8 was found to contain child pornography from the known child
pornography series, “Tara” and “Vicky.” According to SA Knight’s analysis of the
USB drive, there were a total of 40,365 (7.9 GB) digital files (GIF/JPG/AVI/MPG)
that depicted various types of child pornography, from bestiality with animals to
bondage of children under the age of 12 (most notably infants and toddlers), stored
on Item 8. This USB drive was later determined to have been last inserted into the

desktop computer on the same day that the eMule software was last used on Aring’s

desktop computer (December 2, 2019).

Ow


Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 8 of 9

SA Knight was also able to determine that there were a total of 7,126 files
(totaling 90.538 GB) shared (“up” or “uploaded”) by the eMule program on Aring’s
computer since May 6, 2018, and since that date, Aring’s eMule program had
downloaded a total of 17,856 files (totaling 219.346 GB). There were 3,045 (2.5
GB) digital files (GIF/JPG) that depicted various types of child pornography, from
bestiality with animals to bondage of children under the age of 12 (most notably
infant and toddler), found to be stored on Item 14. Additionally, SA Knight located
1,060 files stored in the recycle bin of user “David.” A large portion of the files
found in the recycle bin were child pornography files which dated back to as early
as 2017.

ELEMENTS OF THE OFFENSE

i. Count One - Certain activities relating to material constituting or
containing child pornography — Receive — 18 U.S.C. § 2252A(a)(2)

Elements to be proven beyond a reasonable doubt:

(1) the Defendant knowingly received or attempted to receive an item or
items of child pornography;

(2) the item or items of child pornography had been transported or
shipped in interstate or foreign commerce including by computer; and

(3) when the Defendant received the item or items, the Defendant
believed the item or items were or contained child pornography.

CWE


Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 4 of 9

FILE NAME: (Children-Sf-1Man) Pthe - Kylie Freeman Vicky (11 Yo)
FILE TYPE: MP4

DESCRIPTION: This video file depicts a female child approximate age of 9
to 11 taking off her clothes and performing sexual acts with an adult male.
This video file is part of a series of files with an identified child victim.

FILE NAME: (Children-sf-1man) Pthc — Tara (O8Yo) — Tara Gets Molested
By A Clown - [New][UK][00.12.56]

FILE TYPE: .AVI

DESCRIPTION: Video file depicting a nude female child approximate age of
9 to 11 wearing a mardi gras mask and lying on a bed. The child then performs
sexual acts with an adult male wearing a clown mask. This video file is part
of a series of files with an identified child victim.

FILE NAME: (Hussyfan) (Pthc) (R@Ygold) Preteen Asian Alica, 11Yo
Philippine (Filipina) Child Prostitute XxxHc Pedo Ptscl I(Pthc) (Huss

FILE TYPE: .MPG

DESCRIPTION: Video file depicting a female child approximate age of 7 to
11 wearing a white jumpsuit. The child takes off her clothing and engages in
sexual activity with an adult male.

FILE NAME: (Pthe Opva 2014) Paradisebirds Casey - For Graham Greene
9m39s 12yo

FILE TYPE: .MP4

DESCRIPTION: Video file depicting a nude female child approximate age of
9 to 12 lying on her back with her legs above her head. An unknown subject
proceeds to "whip" the nude child with a leather strap,

FILE NAME: (Pthc) 3Yo Toddler Girl Suck Dad And Swallow Cum

FILE TYPE:.mpg

DESCRIPTION: Video depicting female child approximate age of 3 to 5. The
child is performing oral sex on an adult male. This video is part of a series
containing an identified child victim.

FILE NAME: (Pthc) 2011 7Yo Elly Cum In Face

FILE TYPE: .AVI

DESCRIPTION: Video depicting nude female child approximate age of 7 to
10 kneeling on her knees and performing oral sex on an adult male. The adult
male ejaculates on the child's face.

a


Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 6 of 9

Item 14 (desktop computer) was forensically examined by SA Knight. He
was able to determine that the last logon by user “David” (which was the 564th time
that user logged onto that computer) was on November 26, 2019. SA Knight’s
analysis also revealed that eMule software was last used on December 2, 2019,
which was the same day that Aring last used the VLC video player software on that
computer. The Known.met file of eMule saved all files from the eMule program,
including shared eMule files, files currently in the eMule download list, or files that
were downloaded using eMule in the past. The Known.met file examined by SA
Knight was found to contain 1,492 files that were shared by the eMule software
through Aring’s user account. There were 11 files last shared on the date of

December 2, 2019, as follows:


Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 9 of 9

\veee

Randblph Murrell
Attorney for Defendant

itlralre

Date

EE

David Wayne Aring
Defendant

We 20

Date

Unitéd States Attor

Justin M. Keen |) ~ \\

Florida Bar No. 021034

Assistant United States Attorney
Northern District of Florida

111 North Adams Street, 4" Floor
Tallahassee, FL 32301
850-942-8430

Justin. Keen@usdoj.gov

\W2-3 [220

Date


Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 1of9

IN THE UNITED STATES DISTRICT COURT FOR THE
NORTHERN DISTRICT OF FLORIDA
TALLAHASSEE DIVISION

UNITED STATES OF AMERICA
CASE No: 4:20cr45/AW

ve.

DAVID WAYNE ARING
/

STATEMENT OF FACTS

The parties agree with the truthfulness of the following factual basis for
the defendant’s guilty plea. The undersigned parties further agree that not all of the
facts known from this investigation are contained in this brief summary. Defendant
admits that, if this case were to proceed to trial, the Government could prove the
following facts beyond a reasonable doubt:

The eDonkey Network (also known as the eDonkey2000 network, or
eD2k) was a decentralized, mostly server-based, peer-to-peer file sharing network.
eMule was one program that can be used to connect to the eDonkey Network. On
December 9, 2019, Special Agent Travis Knight with the Florida Department of Law
Enforcement (FDLE) reviewed previous IP addresses that had been identified on the
eDonkey peer-to-peer network as being in possession of or sharing files indicative
of child sexual abuse material (CSAM). SA Knight discovered an investigation that

had originally been initiated in August 2018, for IP address 73.118.25.154 with the

FILED IN OPEN COURT THIS

CW l\J93/ 3030
CLERK, U.S. DISTRICT

COURT, NORTH. DIST. FLA.


Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 7 of 9

HEHOMG!!!!!. mp4

SHARED FILENAME LAST SHARED
(PHANT 2018) Syo Latina cheap prostitute underage whore
04:56 PM +00:00
sucking cock SWALLOW entire load don her throat for 5 michelin
PVA PTHC 20: i i ...OMG
fe) 19 Periscope 12yo cutie bathing ae “ za 12/2/2019 10:17:21 PM +00:00
Tropical Cuties - Anny pussy anal 012 pthc 2019 PLS share
13:17 PM +00:00
more vids of her or other hot tropical cuties.mp4 nibs
pthc_new-2019-preteen_cum-shot-medley.mp4 12/2/2019 9:40:15 PM +00:00
Beautiful Little Angels (Pedo f 1019 pthc) NEW Ki
eautiful Little Angels (Pedo fantasy 2019 pthc) ids got 12/2/2019 8:20:27 PM +00:00
Talent.mp4
daddypedo fryturama tropical cuties pthc new 2019 lollipop -
» 2019 11:14:06 PM +00:00
niAta caliente enseAta todo,mp4 12/2
Kids Got Talent.mp4 12/2/2019 8:11:12 PM +00:00
{pthc}{otstoi}2019-3.mp4 12/2/2019 8:41:01 PM +00:00
(Pthc} Blindfold Challenge (50 Tastes Of Cock) (Kids Got
2019 7:48:56 PM +00:00
Talent] Digitally Restored Pedo laa
pthc_new_2019-cumshots(medley).mp4 12/2/2019 7:56:12 PM +00:00
the 2019 L0yo girl lay, dirty talk, spitti
Lhe DOE ATG NERS 12/2/2019 8:01:12 PM +00:00

Further, search terms pertaining to child pornography were extracted from the eMule
program that was installed on Aring’s desktop computer (Item 14). The extracted
search terms included “PTHC” (a common abbreviation for “Preteen Hardcore”),

“Pedo” (another known term that refers to child pornography), and “Siberian

Mouse” (which as discussed above, is a known child pornography series).

7

Cr



Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 2 of 9

unique eDonkey GUID of 9021E504FAQE9ESCS9DDO3E8A7AD6FOA. The
initiation of that original investigation took place while SA Knight was a detective
at the Leon County Sheriff’s Office; he had since transferred to FDLE and continued
to investigate Cyber and High Tech Computer Crimes.

During the initial 2018 investigation, Det. Knight determined the IP
address was last observed on July 21, 2018, in possession of ten (10) digital files
with filenames indicative of CSAM. In August 2018, Det. Knight served legal
process on Comcast, Inc., to which to IP 73.118.25.154 was assigned on July 21,
2018. Comcast provided the subscriber information for IP Address 73.118.25.154,
indicating that its assigned subscriber was David Aring, and the service address was
1405 Southwood Plantation Rd, Apt 6301, Tallahassee, Florida 32311.

In 2019, SA Knight entered IP 73.118.25.154 in a specialized law
enforcement system to determine if the IP address was still actively downloading
and sharing digital files indicative of CSAM. The system identified the same digital
CSAM files as well as the same eDonkey GUID
(9021ES04FA0E9ESCS59DDO3E8A7AD6FO0A) from the 2018 investigation. The
system also provided an associated IP address of 68.63.41.10. SA Knight reviewed
IP 68.63.41.10 and noticed it had the same corresponding eDonkey GUID as IP
address 73.118.25.154, thereby linking the two IP’s to similar child pornography

activity. SA Knight reviewed the one file associated with IP 68.63.41.10 with a file

(We


Case 4:20-cr-00045-AW-MAF Document 20 Filed 11/23/20 Page 3 of 9

name of “Ist Studio New Siberian Mouse -Hot- Especial Masha And Veronika
Sucking Big Cock (2012).avi.” SA Knight knew this file to be a child pornography
movie from a known child pornography series (“Siberian Mouse”) from his training
and experience as a law enforcement officer, and as a member of the North Florida
Internet Crimes Against Children (ICAC) task force. The same file series (Siberian
Mouse) was also observed associated with IP 73.118.25.154 as part of eDonkey.
Given the similarities between the two IP addresses, SA Knight obtained a subpoena
to Comcast regarding IP address 68.63.41.10. Comcast provided subscriber
information for its IP address 68.63.41.10, which indicated that its assigned
subscriber was David Aring, and the service address was 1405 Southwood Plantation
Rd, Apt 6301, Tallahassee, Florida 32311.

On January 6, 2020, a state search warrant for 1405 Southwood Plantation
Rd Apt 6301, Tallahassee, FL 32311 was obtained and was executed on January 7,
2020. During the execution of the search warrant, contact was made with Aring who
was the only resident at the address, and was determined to be the only resident of
that apartment. During a search of the residence, a 128 GB SanDisk USB device
(Item 8) was located in Aring's bedroom, hidden in the back of a sock drawer. This
USB device was examined on scene by digital forensic examiners at which time
multiple CSAM were found stored on the device. The following files are a small

sample of the CSAM files located & stored on the device:

Owe