9. The facts and information contained in this affidavit are based on my
personal knowledge and observations; my training and experience; my review of
evidence and reports prepared by others; and information provided to me by others,
including other state and local law enforcement officers and-witnesses. Because
this affidavit is being submitted for the limited purpose of securing a search
warrant, I have not included each and every fact known to me concerning this
investigation. I have set forth only the facts that I believe are necessary to establish

probable cause to support the requested warrant.

STAUTORY AUTHORITY

10, This affidavit is made in support of an application for a search warrant
under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Google to
disclose to the government records and other information in its possession
pertaining to the subscriber or customer associated with a suspect account,
including the contents of communications. As described in Attachments A & B, this
pertains to disclosing evidence, contraband, fruits and other items related to
violations of Title 18, United States Code, Sections 2252 and 2252A, which make it
a crime to distribute/receive/possess child pornography via interstate commerce,
including by computer. The items sought to be searched for and seized pursuant to

this search warrant are more particularly described in Attachment B.



A single Caucasian prepubescent male wearing a red and white in color shirt
js seen on video. The child is actively performing oral sex on an apparent
adult male with an exposed erect penis.

File Name: 11.wmv -{5:01)

Two Caucasian prepubescent males are sen on camera in a video chat style

setting. One child is wearing an orange in color t-shirt. The other male ohild

is shirtless. An adult male can be seen in the background at times. Both male

children expose their erect penises on video. Both male children simulate oral

sex with their hands and show their penises to the camera.
The report also noted that a word document on the computer saved with a
bookmark, was a link to a file-sharing website named “Mega”. The username
associated was “ONEMA”. This is relevant because the username “ONEMA”
appears to be the first five letters of the e-mail account associated with the
computer, “gnemantwolives@gmail.com.” The report stated that upon using this
link on a different computer to access this web site, it was found that the link had
been removed for containing objectionable material such as child exploitation
material.

16. Review of the history of files downloaded using the Google Chrome

browser revealed that on May 11, 2020, Lutz accessed a link to the “Mega” website

10



Levy County Sheriff's Office (LCSO) Criminal Investigation Division provided
security during the search of the residence and took Lutz into custody for an active
arrest warrant for the recent violation of probation.

13. During the probationary search completed by Probation Officer (PO)
Cody Mays and PO Parrish Parnell, a silver in color Hewlett Packard laptop
computer was found in a spare bedroom of the residence. The computer was
recovered by PO Cody May and was located under the mattress in a bedroom. PO
May and Parnell stated that while they knocked on the door to the residence prior to
the search, they were able to hear someone run from one side of the residence to the
other. They stated the person ran from the master bedtoom area of the residence to
the area of the spare bedroom where the computer was located. Lutz was the sole
occupant of the residence and was the person who answered the door after the PO’s
heard someone running.

14. The computer was opened by PO Parnell and turned on to determine
whether the computer was Internet capable and whether Lutz had in fact accessed
the internet, which would constitute a violation of his probation. The computer was
witnessed as having a profile of “onemantwolives@gmail.com”, The computer was
PIN locked and a code was found on a piece of paper inside Lutz’s wallet. The PIN

code 5327 was entered into the computer to check for internet access and



THE INVESTIGATION

11. On January 08, 2020; Jeffrey Edwin Lutz entered a no contest plea to
nine counts of violation of Florida Statute 827.071(5), Possession of Child
Pornography. Lutz was subsequently sentenced to a period of 180 days
confinement, followed by a period of 24 months of Sex Offender Probation, under
the supervision of the Florida Department of Corrections. The terms of Lutz’s Sex
Offender Probation included a prohibition on viewing, accessing, owning, or
possessing any obscene, pornographic, or sexually stimulating visual or auditory
material relevant to the offender’s deviant behavior pattern, including électronic
media and computer services. The Order of Probation also prohibited Lutz from.
accessing the internet or other computer services until a qualified practitioner in
Lutz’s sex offender treatment program completed arisk assessment and approved a
safety plan for Lutz to access the internet. No such risk assessment or safety plan
was ever completed. Furthermore, Lutz’s Order of Probation specifically stated that
he must submit to a wartantless search of his person, residence, or vehicle by his
probation officer.

42. On June 10, 2020, Florida Department of Corrections, Probation and
Parole Services conducted a probation search of Lutz’s residence, located at 14850

SH 28th St. Morriston, FL, due to a recent violation of his probation conditions. The



computer had a related e-mail address of “pnemantwolives@gmail.com.” The
account name associated with the Google Chrome browser was “Jeff Lutz.”
Subsequent review of the forensic extraction of the computer yevealed twenty-two
(22) videos and one qd) image which constitute child pornography. Below is a
description and sampling of a few of the video files:

File Name:_(Luto) Anto-1 TY. Jo In Car-Pedo Gay Pthe Boymov-

(1:29) A single Caucasian prepubescent male child is seen on video wearing
no clothing except for tennis shoes and socks. Child is located inside a red in
color vehicle shown in multiple positions. The child has an exposed erect
penis with no public hair. The child is seen actively masturbating.

File Name:

(Omegle) 12yo_ Cums 2015 04 09 ColdFire Productions.mp4- (11:12)

A single Caucasian prepubescent male wearing a grey in color "Maritime |
College" t-shirt is seen on video in a video chat type setting. The male is on
video with an erect exposed penis. The child masturbates on camera for

several minutes.

File Name: OB-OCIWXTSyuJakdvOjHemkiMkU.mp4 - (5:15)



AFFIDAVIT IN SUPPORT OF SEARCH WARRANT

JOEL RICHARDS, being first duly sworn on oath, deposes and states the
following:

1, Lama Special Agent (hereinafter “§ 4”) with the Department of
Homeland Security (hereinafter DHS”), Tnomigration and Customs Enforcement,
Homeland Security Investigations (hereinafter “HSY”) and have been so employed
since 2010. Since June 2020, I have been assigned to the HSI Gainesville Field
Office. Prior to my assignment in HS! Gainesville, I was assigned to the HSI Field
Offices in Honolulu, Hawaii and San Juan, Puerto Rico.

2.  Thave received extensive training as-part of my employment with HSI.

have participated in the Criminal Investigator Training Program and the
}mmigration and Customs Enforcement Special Agent Training Program at the
Federal Law Enforcement Training Center in Glynco, Georgia. During this time, I
received training on child exploitation and cyber-crime investigations, smuggling
investigations, drug-trafficking investigations, money jaundering investigations,
‘human smuggling and human trafficking investigations, immigration benefit fraud
investigations, and the collecting and processing of evidence, among other topics.
As part of my duties as an, SA with HSI, I investigate criminal violations relating to

child exploitation and child pornography, including violations pertaining to the



2252A may be obtained by examining the information currently on systems owned,
maintained, and/or operated within Google and onemantwolives@gmail.com.

19. Additionally, the government requests that the email provider be
directed to produce the contents of electronic communications that were placed or
stored in the email service provider’s computer system in directories or files owned
or controlled by the account described above, including opened and unopened
emails. Investigators anticipate that these files may contain information including,
but not limited to, evidence of communications with possible accomplices and/or
evidence of distributing and receiving child pornography. These stored files,
covered by Title 18, United States Code, Section 2703(b), will help ascertain the

scope and nature of the possible criminal activity.

el Richards, Special Agent
Homelarid Security Investigations

Sworn to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4,1 by
telephone and email this 21st day of July, 2020 by Special Agent Joe! Richards.
. 2020.07.21

ek
yh 14:57:56 -04'00'

Gary R. Jones
United States Magistrate Judge

12



and downloaded a file titled «521.mp4.” That video was located within the
downloads folder of the computer, and upon review, was determined to be child
pornography. Review of the history of files downloaded using Google Chrome also
revealed that on May 10, 2020, Lutz accessed another link to the “Mega” website
and downloaded a file titled 381 Video_1402935810.flv.” That, video was also
located within the downloads folder and was determined to be child pornography.
17. It was also determined during the review of the extracted information
from the computer that the user of the computer engaged in “chats” with unknown :
persons using the chat website “omegle.com.” Forensic analysis was able to retrieve
the contents of some of these web chats, which included the user of the computer
asking questions about underage children. Additionally, review of the extracted data
related to Google Maps revealed searches for various locations and addresses
outside of the state of Florida, along with the locations of schools in the areas, and

the names of unknown individuals.

CONCLUSION

18. Based upon the information above, your affiant respectfully submits
there is probable cause to believe that evidence, fruits and. instrumentalities

concerning offenses enumerated in Title 18, United States Code, Sections 2252 and

ll



availability. PO Parnell entered file explorer on the computer to locate a Wi-Fi
connection; in plain view “recent files” were able to be viewed. Noted in the file
preview were thumbnail images. These preview “recent files” showed a file by the
narne of vx(3) that appeared to be a small-framed individual performing a sex act. A
video file by the name of vx(1) also appeared to be a small-framed individual
possibly in a nude sexual manner. There was also another preview for a video file
that was labeled “(Luto) Anto- 1 7Yo Jo in Cat- Pedo Gay Pthe Boy”, also with a
depiction of a small-framed person in 4 sexual manner. At that tithe, PO Parnell
stopped the search. for internet connectivity on the computer, and alerted LCSO
personnel on scene. The computer was seized by LCSO personnel at that time, and
a search warrant was applied for. The search warrant was granted in the Circuit
Court of the Highth Judicial Circuit, Levy County Florida on June 10, 2020 and
signed by the Honorable Judge William E. Davis.

15. The computer was placed into a temporary evidence locker until the
following day when it was transported to the Citrus County Sheriff's Office to be
forensically examined for the presence of child pornography. Det. Christopher
Cornell from Citrus County Sheriff’s Office completed the forensic examination of
the computer recovered from Jeffrey Lutz’s residence and completed a report along

with a thumb drive containing all the data recovered. Analysis revealed that the



7. Bmail providers typically retain certain transactional information about
the creation and use of each account on their systems. This information can include
the date on which the account was created, the length of service, records of login
times and durations, the types of service(s) utilized, the status of the account
(including whether the account is inactive or closed), the methods ysed to connect
to the account (such as logging into the account via Google website), and other log
files that reflect usage of the account. In addition, email providers often have
records of the Internet Protocol address (“IP address”) used to register the account
and the IP address associated with particular logins to the account. Because every
device that connects to the Internet must use an IP address, IP address information.
can help to identify which computers ot other devices were used to access the email
account.

8. In some cases, email account users will communicate directly with an
email service provider about issues relating to the account, such as technical
problems, billing inquiries, or complaints from other users. Email providers
typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well records of any actions

taken by the provider or user as @ result of the connections.



(including retrieved and un-retrieved email for subscribers) and information
concerning subscribers and their use of Google services.

5. A Google subscriber can also store files, including emails, address
books, contact or buddy lists, pictures, and other files, on servers maintained and/or
owned by Google. Subscribers to Google might not store on their home computers
copies of the files stored in their Google account. In my training and experience, I
have learned that collectors and distributors of child pornography use online
resources to retrieve and store child pornography, including services offered by
Internet Portals such as Google and Microsoft, among others. ‘The online services
allow a user to set up an account with a remote computing service that provides
email services as well as electronic storage of computer files in any variety of
formats. A user can set up an online storage account from any contputer with
access to the Internet.

6.  Ingeneral, email providers like Google ask each of their subscribers to
provide certain personal identifying information when registering for an email
account. This information can include the subscriber’s full name, physical address,
telephone number and other identifiers, alternative email addresses, and, for paying
subscribers, means and source of payment (including any credit or bank account

number).



enticement of minors and the illegal production, distribution, receipt and possession
of child pornography, in violation of Title 18, United States Code, Sections
2422(b), 2252 and 2252A. During my tenure as an SA, I have received training in
the area of child pornography and child exploitation, and have had the opportunity
to observe and review examples of child pornography (as defined in Title 18,
United States Code, Section 225 6) in multiple forms of ‘media, including computer
media. I have participated in the execution of numerous federal search warrants,
some of which involved child exploitation and/or child pornography offenses.

3. Imake this affidavit in support of an application for a search warrant
for information associated with a certain account stored at premises owned,
maintained, controlled or operated by Google, Inc., an email provider headquartered _
at 1600 Amphitheater Parkway, Mountain View, CA 94043. The
account/information to be seatched is described in the following paragraphs and in

Attachment A.

4. In my training and experience, { have learned that Google, Inc.
provides a variety of online services, including electronic mail access and cloud
storage, to the general public. Subscribers obtain an account by registering with
Google. During the registration process, Google asks subscribers to provide basic

personal information. The servers of Google contain electronic communications