COMPUTER DATA

48. As described in the foregoing paragraphs and in Attachment B, this
application seeks permission to search and seize records that might be found on the
Subject Premises, in whatever form they are found. One form in which the records
might be found is stored on a computer’s hard drive or other storage media. Some
of these electronic records might take the form of files, documents, and other data
that is user-generated. Some of these electronic records, as explained below, might
take a form that becomes meaningful only upon forensic analysis.

49. Based on my knowledge, training, and experience, and in consultation
with other agents, I know that computer files or remnants of such files can be
recovered months or even years after they have been downloaded onto a storage
medium, deleted, or viewed via the Internet. Electronic files downloaded to a storage
medium can be stored for years at little or no cost. Even when files have been
deleted, they can be recovered months or years later using forensic tools. This is so
because when a person “deletes” a file on a computer, the data contained in the file
does not actually disappear; rather, that data remains on the storage medium until it
is overwritten by new data. Therefore, deleted files, or remnants of deleted files, may
reside in free space or slack space, that is, in space on the storage medium that is not

currently being used by an active file for long periods of time before they are

20



« EMAIL: fanticshd@gmail.com
« RECOVERY EMAIL: palmercoburn@gmail.com
* RECOVERY SMS: 850-512-6760

GOOGLE SUBSCRIBER DATA (palmercoburn@gmail.com)

* NAME: Palmer Coburn

* CREATED ON: July 12,2010

* RECOVERY EMAIL: utubeedward@gmail.com
* RECOVERY SMS: 850-358-1577

34. An open source check done by the OCE linked the recovery email for
palmercoburn@gmail.com, utubeedward@gmail.com, to a Facebook account with
the name Palmer Coburn. The Facebook page states that Palmer Coburn is from Ann
Arbor, Michigan, and currently lives in Pensacola, Florida.

35. A subpoena by the OCE to T-Mobile requesting subscriber information
for phone number 850-512-6760 used to register the email account with Google. T-
Mobile then provided subscriber information as follows: NAME: Consuela Coburn;
ADDRESS: 34 Patton Dr.; Pensacola, FL 32507; LENGTH OF SERVICE: March
18, 2019 — Current

36. Asearch of the Florida Driver License and Vehicle Information
Database (DAVID) for the SUBJECT PREMISES address revealed that an
individual named Consuela Bernetta Coburn, date of birth February 25, 1971, list

the SUBJECT PREMISES address as her residence. Within the document section of

14


consistent with the warrant. In lieu of seizure, it is sometimes possible to make an
image copy of storage media. Generally speaking, forensic imaging is the taking of
acomplete electronic picture of the computer’s data, including all hidden sectors and
deleted files. Either seizure or imaging is often necessary to ensure the accuracy and
completeness of data recorded on the storage media, and to prevent the loss of the
data either from accidental or intentional destruction. This is true because of the
following:

a. The nature of evidence — As noted above, not all evidence takes
the form of documents and files that can be easily viewed on site. Analyzing
evidence of how a computer has been used, what it has been used for, and who
has used it requires considerable time, and taking that much time on premises
could be unreasonable. As explained above, because the warrant calls for
forensic electronic evidence, it is exceedingly likely that it will be necessary
to thoroughly search storage media to obtain evidence, including evidence that
is not neatly organized into files or documents. Just as a search of a premises
for physical objects requires searching the entire premises for those objects
that are described by a warrant, a search of this premises for the things
described in this warrant will likely require a search among the data stored in
storage media for the things (including electronic data) called for by this

warrant. Additionally, it is possible that files have been deleted or edited, but

24



equipped with a telephone or cable modem, the subscriber can establish
communication with an ISP over a telephone line or through a cable system and can
access the Internet by using his or her account name and password.

13. “Domain Name” refers to the common, easy to remember names
associated with an Internet Protocol address. For example, a domain name of
“www.usdoj.gov” refers to the Internet Protocol address of 149.101.1.32. Domain
names are typically strings of alphanumeric characters, with each level delimited by
a period. Each level read backwards — from right to left — further identifies parts of
an organization. Examples of first level or top-level domains are typically .com for
commercial organizations, .gov for the governmental organizations, .org for
organizations, and, .edu for educational organizations. Second level names will
further identify the organization, for example, usdoj.gov further identifies the United
States governmental agency to be the Department of Justice. Additional levels may
exist as needed until each machine is uniquely identifiable. For example,
www.usdoj.gov identifies the World Wide Web server located at the United States
Department of Justice, which is part of the United States government.

14. “Log Files” are records automatically produced by computer programs
to document electronic events that occur on computers. Computer programs can
record a wide range of events including remote access, file transfers, logon/logoff

times, and system errors. Logs are often named based on the types of information

|


overwritten. In addition, a computer’s operating system may also keep a record of
deleted data in a “swap” or “recovery” file.

50. Wholly apart from user-generated files, computer storage media, in
particular, computers’ internal hard drives contain electronic evidence of how a
computer has been used, what it has been used for, and who has used it. This
evidence can take the form of operating system configurations, artifacts from
operating system or application operations, file system data structures, and virtual
memory “swap” or paging files. Computer users typically do not erase or delete this
evidence, because special software is typically required for that task. However, it is
technically possible to delete this information.

51. Similarly, files that have been viewed via the Internet are sometimes
automatically downloaded into a temporary Internet directory or “cache.” The
browser often maintains a fixed amount of hard drive space devoted to these files,
and the files are only overwritten as they are replaced with more recently viewed
Internet pages or if a user takes steps to delete them.

52. As further described in Attachment B, this application seeks permission
to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for evidence that establishes how computers were

used, the purpose of their use, who used them, and when.

21



site imaging proves impractical, or even impossible for technical reasons, then the
agents would seize the hardware, media, and peripherals that the agents believe must
be seized to permit the agents to locate the things described in Attachment B at an
off-site location.

56. Any storage media that is determined to have been used to produce or
possess child pornography is an instrumentality of the crime and will be seized and
retained pursuant to the warrant. Further, any storage media that contains contraband
will be seized and retained pursuant to the warrant. In addition, there is probable
cause to believe that the computer and its storage devices, the monitor, keyboard,
and modem are all instrumentalities of the crime(s), within the meaning of 18 U.S.C.
§§ 2252 through 2256 and should all be seized as such.

BIOMETRIC ACCESS TO DEVICES

57. This warrant permits law enforcement to compel Palmer Edward
Coburn to unlock any DEVICES requiring biometric access subject to seizure
pursuant to this warrant. The grounds for this request are as follows:

a. I know from my training and experience, as well as from
information found in publicly available materials published by device
manufacturers, that many electronic devices, particularly newer mobile
devices and laptops, offer their users the ability to unlock the device through
biometric features in lieu of a numeric or alphanumeric passcode or password.

27


b. Forensic evidence on a computer or storage medium can also

indicate who has used or controlled the computer or storage medium. This

“user attribution” evidence is analogous to the search for “indicia of :
occupancy” while executing a search warrant at a residence. For example,

registry information, configuration files, user profiles, email, email address

books, “chat,” instant messaging logs, photographs, and correspondence (and

the data associated with the foregoing, such as file creation and last accessed

dates) may be evidence of who used or controlled the computer or storage

medium at a relevant time.

c Further, in finding evidence of how a computer was used, the
purpose of its use, who used it, and when, sometimes it is necessary to
establish that a particular thing is not present on a storage medium. For
example, the presence or absence of counter-forensic programs (and
associated data) that are designed to eliminate data may be relevant to
establishing the user’s knowledge or intent.

SPECIFICS OF SEARCH AND SEIZURE OF COMPUTER SYSTEMS

54, Searching storage media for the evidence described in Attachment B

may require a range of data analysis techniques. In most cases, a thorough search for

information stored in storage media often requires agents to seize most or all }

electronic storage media (and related peripherals) and later review the media

23 |


elsewhere, in conversations, sometimes sexually explicit conversations, to fuel and
fortify the fantasy; interacting, both directly and indirectly, with other like-minded
adults through membership in organizations catering to their sexual preference for
children thereby providing a sense of acceptance and validation within a community;
gravitating to employment, activities and/or relationships which provide access or
proximity to children; and frequently persisting in the criminal conduct even when
they have reason to believe the conduct has come to the attention of law enforcement.
These are need driven behaviors to which the offender is willing to devote
considerable time, money and energy in spite of risks and contrary to self-interest.
45. Child pornography collectors almost always maintain and possess their
material in the privacy and security of their homes or some other secure location
such as their vehicle(s) where it is readily available. The collection may include
sexually explicit or suggestive materials involving children, such as photographs,
magazines, narratives, motion pictures, video tapes, books, slides, drawings,
computer images or other visual media. This is most easily accomplished in the
privacy of his own home, and it may involve password/encryption protected devices
that require biometrics or entry codes. This is particularly true in cases involving
cellular telephones as devices of choice ~ which is believed to be relevant herein as
the crimes were committed via LiveMe, which is a social media application often

utilized on a mobile device. Thus, it may be necessary to press the users finger, scan

18

'
|


temporary files or ISP client software, among others). In addition to electronic
communications, a computer user's Intemet activities gencrally leave traces or
"footprints" and history files of the browser used. A forensic examiner often can
recover evidence suggesting whether a computer contains wireless software, was
using an online messenger, and when certain files under investigation were uploaded
or downloaded. Such information is often maintained indefinitely until overwritten
by other data.

25. As part of undercover investigations, law enforcement agents have
devised a number of pro-active investigative techniques aimed at identifying and
investigating individuals involved in the sexual exploitation of minors through the
production, distribution, receipt and possession of child pornography and the

attempts thereto.

BACKGROUND OF THE INVESTIGATION AND PROBABLE CAUSE

26. On February 24, 2020, Online Covert Employee (OCE), who is a
member of the FBI Child Exploitation Human Trafficking Task Force in Salt Lake
City, Utah, was connected to the Internet in an online undercover capacity. A
software program was used to record the online activity, chats, and images identified
within LiveMe, and to identify individuals who were involved with the sexual

exploitation of children.



60. Your Affiant further submits that early disclosure of the contents of this
affidavit may compromise an ongoing investigation of this matter. Further, given the
sensitive nature of the information contained herein, your Affiant request that the
affidavit in support of this search warrant remain sealed until further order of the

Court.

Further sayeth your Affiant naught.

SA Sp SL

Stephen Tr6y Ward

Special Agent

Federal Bureau of Investigation

Subscribed and sworn to before me
This 27th day of July, 2020.

/s/ Michael J. Frank
MICHAEL J. FRANK
United States Magistrate Judge

33

i
|
|
|
|
|


activities and thus have a heightened concern about securing the contents of a

device.

f. As discussed in this Affidavit, your Affiant has reason to believe
that one or more digital devices will be found during the search. The passcode
or password that would unlock the DEVICES subject to search under this
warrant currently is not known to law enforcement. Thus, law enforcement
personnel may not otherwise be able to access the data contained within the
DEVICES, making the use of biometric features necessary to the execution of

the search authorized by this warrant.

g. I also know from my training and experience, as well as from
information found in publicly available materials including those published
by device manufacturers, that biometric features will not unlock a device in
some circumstances even if such features are enabled. This can occur when a
device has been restarted, inactive, or has not been unlocked for a certain
period of time. For example, Apple devices cannot be unlocked using Touch
ID when: (1) more than 48 hours has elapsed since the device was last
unlocked; or, (2) when the device has not been unlocked using a fingerprint
for 8 hours and the passcode or password has not been entered in the last 6
days. Similarly, certain Android devices cannot be unlocked with Trusted

Face if the device has remained inactive for four hours. Biometric features
30

|
i
|
|
i
i
4
|



18. The terms “records,” “documents,” and “materials,” as used herein,
include all information recorded in any form, visual or aural, and by any means,
whether in handmade form (including, but not limited to, writings, drawings,
painting), photographic form (including, but not limited to, microfilm, microfiche,
prints, slides, negatives, videotapes, motion pictures, photocopies), mechanical form
(including, but not limited to, phonograph records, printing, typing) or electrical,
electronic or magnetic form (including, but not limited to, tape recordings, cassettes,
compact discs, electronic or magnetic storage devices such as floppy diskettes, hard
disks, CD-ROMs, digital video disks (DVDs), mobile telephone devices, video
gaming devices, portable music players, Personal Digital Assistants (PDAs), Multi
Media Cards (MMCs), memory sticks, optical disks, printer buffers, smart cards,
memory calculators, electronic dialers, or electronic notebooks, as well as digital
data files and printouts or readouts from any magnetic, electrical or electronic
storage device).

BACKGROUND REGARDING THE INTERNET/COMPUTERS AND

CHILD PORNOGRAPHY

19. Based upon my training and experience in child exploitation and child
pornography investigations, and the experience and training of other law
enforcement officers with whom I have had discussions, I know that computers and

computer technology have revolutionized the way in which individuals interested in



‘they contain. For example, web logs contain specific information about when a
website was accessed by remote computers; access logs list specific information
about when a computer was accessed from a remote location; and file transfer logs
list detailed information concerning files that are remotely transferred.

15. “Hyperlink” refers to an item on a web page which, when selected,
transfers the user directly to another location in a hypertext document or to some
other web page.

16. “Website” consists of textual pages of information and associated
graphic images. The textual information is stored in a specific format known as
Hyper-Text Mark-up Language (HTML) and is transmitted from web servers to
various web clients via Hyper-Text Transport Protocol (HTTP).

17. “Uniform Resource Locator” or “Universal Resource Locator” or
“URL” is the unique address for a file that is accessible on the Internet. For example,
a common way to ‘get to a website is to enter the URL of the website’s home page
file in the Web browser’s address line. Additionally, any file within that website can
be specified with a URL. The URL contains the name of the protocol to be used to
access the file resource, a domain name that identifies a specific computer on the
Internet, and a pathname, a hierarchical description that specifies the location of a

file in that computer.



the users face for facial recognition, or scan the irises for iris recognition of the user
of the device found during the search to a device’s sensor in an attempt to unlock the
device for the purpose of executing the search authorized by this warrant.
Attempting to unlock the relevant device(s) via biometrics of the user may be
necessary because the government may not otherwise be able to access the data
contained on those devices for the purpose of executing the search authorized by this

warrant.

46. Because the collection reveals the otherwise private sexual desires and
intent of the collector and represents his most cherished sexual fantasies, the
collector rarely, if ever, disposes of the collection. Individuals who use a collection
in the seduction of children or to document that seduction treat the materials as
prized possessions and are especially unlikely to part with them. And even if a child
pornography collector does delete files from his hard drive or other electronic media,

a computer expert can still retrieve those files using forensic tools.

47, Based on the information obtained in the investigation, as detailed in
this Affidavit, including the images and videos recovered by the undercover online
agent, it is Your Affiant’s opinion that Palmer Edward Coburm has child
pornography collector characteristics. As such, images, videos, and indicia of child
pornography are expected to be found on or within devices seized within the

SUBJECT PREMISES.



grown tremendously within the last several years. These drives can store thousands
of images at very high resolution.

22, The Internet and its World Wide Web afford collectors of child
pornography several different venues for obtaining, viewing and trading child
pornography in a relatively secure and anonymous fashion.

23. Collectors and distributors of child pornography also use online
resources to retrieve and store child pornography, including services offered by
Internet Portals such as Yahoo! and Hotmail, among others. The online services
allow a user to set up an account with a remote computing service that provides e-
mail services as well as electronic storage of computer files in any variety of formats.
A user can set up an online storage account from any computer with access to the
Internet. Evidence of such online storage of child pornography is often found on the
user’s computer. Even in cases where online storage is used, evidence of child
pornography can be found on the user's computer in most cases.

24, As is the case with most digital technology, communications by way of
computer can be saved or stored on the computer used for these purposes. Storing
this information can be intentional, i.e., by saving an e mail as a file on the computer
or saving the location of one's favorite websites in, for example, "bookmarked" files.
Digital information can also be retained unintentionally, e.g., traces of the path of an

electronic communication may be automatically stored in many places (e.g.,



that remnants of older versions are in unallocated space or slack space. This,
too, makes it exceedingly likely that, in this case, it will be necessary to use
more thorough techniques.

b. The volume of evidence — Storage media can store the equivalent
of millions of pages of information. Additionally, a suspect may try to conceal
criminal evidence. For example, he or she might store it in random order with
deceptive file names. This may require analysts to peruse all the stored data
to determine which particular files are evidence or instrumentalities of crime.
This sorting process can take weeks or months, depending on the volume of
data stored, and it would be impractical and invasive to attempt this kind of
data search on-site.

c. Technical requirements — Computers can be configured in
several different ways, featuring a variety of different operating systems,
application software, and configurations. Therefore, searching them
sometimes requires tools or knowledge that might not be present on the search
site. The vast array of computer hardware and software available makes it
difficult to know before a search what tools or knowledge will be required to
analyze the system and its data on-site. However, taking the storage media
off-site and reviewing it in a controlled environment will allow its

examination with the proper tools and knowledge.

25



UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF FLORIDA.
PANAMA CITY DIVISION

IN THE MATTER OF THE SEARCH OF Case No. 5:20-mj-54-MJF
122 Kelly Street, Panama City Beach,
Florida, 32413 Filed Under Seal

AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR
SEARCH WARRANT

I, Stephen Troy Ward, a Special Agent with the Federal Bureau of

Investigation (“FBI”) being duly sworn, depose and state as follows:

1. Thave been employed as a Special Agent of the FBI since October 27,
2019, and I am currently assigned to the Jacksonville Division, Panama City
Resident Agency. During this time, I have conducted and assisted with two local
investigations related to the possession, receipt and distribution of child
pornography. I have gained experience through training provided by the FBI and
everyday work relating to conducting these types of investigations.

2, As a Federal Agent, your Affiant is authorized to investigate violations
of laws of the United States and is a law enforcement officer with the authority to
execute warrants issued. under the authority of the United States. I have participated
in the execution of a consent search on a residence wherein child pornography was
recovered followed by a later arrest of the possessor of the child pornography by

local authorities. I have had numerous conversations with experienced agents



child rape, described as nude prepubescent age children, including infants and
toddlers, engaged in sexual acts with adults and other children.

29. On February 24, 2020, LiveMe profile identifier "8998729," using the
screen name Best Links posted a Mega.nz link to the FAM chatroom "join." The
profile picture for the group depicted a prepubescent or pubescent (teenager or age
difficult) girl posing nude in front of a mirror. The Mega.nz link posted by profile
ID “8998729” contained videos of pubescent (teenager or age difficult) girls dancing
nude, masturbating, engaging in sexual intercourse, being sexually abused, or having
sexual acts with dogs. There is a video of a prepubescent girl being sexually abused
in the Mega.nz link by an adult. Mega.nz is a cloud storage and file hosting service
offered by Mega Limited, which is based in New Zealand. The service is offered

primarily through web-based apps.

30. A subpoena to LiveMe submitted by the OCE on February 23, 2020
requesting subscriber data for this account was issued. The response from LiveMe
identified the most recent and consistent IP addresses logging into this account at
the time of the subpoena request belonging to Wide Open West (WOW) internet.
LiveMe subscriber data revealed the following: USERNAME: Best Links; SID:
8998729; REGISTRATION DEVICE: iPhone; EMAIL: fanticshd@gmail.com; IP

ADDRESSES: 24.96.246.251(WOW).



27. LiveMe isa free mobile application that can be downloaded on Android
or iOS devices that permits users to stream live video of themselves to an anonymous
audience of fellow LiveMe users. The LiveMe audience can post comments and
interact with people in the video, including give instructions or
commands to the user. This application also allows users to create groups
where like-minded individuals can chat/text other users and post videos/images.
These groups of like-minded individuals set up FAM chatrooms. For users to access
a FAM chatroom, the creator or a group member must send an invitation to the
LiveMe user. A FAM chatroom, according to LiveMe’s website “is a new space
exclusively belonging to you and your friends. In a FAM, you can chat, post pictures,
and watch broadcast together! And Surely, More...” | LiveMe creates a unique
identifier, typically a string of numbers, for each user. Each user has the ability to
create a screen name which can be changed at any time.

28. On February 24, 2020, an individual with the LiveMe profile identifier
"8998729," using the screen name Best Links was found to have a sexual interest in
children. During the course of this online undercover session, it was identified that
this LiveMe user was a member of known child pornography groups titled "Trade
and share nttid," "NoLimit!!!," "join," and multiple other known child pornography

groups. Members within these groups distributed thousands of videos/images of

* LiveMe https://www.liveme.com/activity/2017/fam/index.html link describing FAM Chatrooms.

11

q
}


biometric characteristics (including the unique finger(s) or other physical

features) that may be used to unlock or access the DEVICES.

58. Furthermore, law enforcement personnel will compel the use of Palmer
Coburn’s biometric features only if (a) the procedure is carried out with dispatch and
in the immediate vicinity of the premises to be searched, and if, at time of the
compulsion, law enforcement personnel has (b) reasonable suspicion that Palmer
Coburn has committed a criminal act that is the subject matter of the requested search
warrant, and (c) reasonable suspicion that Palmer Coburn’s biometric features will
unlock the respective device.

CONCLUSION

59. Your Affiant respectfully submits there is probable cause to believe that
contraband, evidence, fruits and instrumentalities of violations of Title 18, United
States Code, §§2252A(a)(2) and (a)(5)(B) will be found at the premises located at
122 Kelly Street, Panama City Beach, Florida 32413, or within any structure, vehicle
or container on this property.

59. Therefore, Your Affiant respectfully request that the attached warrant
be issued authorizing the search of the SUBJECT PREMISES, which are more
particularly described in Attachment A and grant permission to seize the items

described in Attachment B.

32


from other brands carry similar restrictions. Thus, in the event law
enforcement personnel encounter a locked device equipped with biometric
features, the opportunity to'unlock the device through a biometric feature may

exist for only a short time.

h, Due to the foregoing, if law enforcement personnel encounter
any DEVICES that are subject to seizure pursuant to this warrant and may be
unlocked using one of the aforementioned biometric features, this warrant
permits law enforcement personnel to: (1) press or swipe the fingers
(including thumbs) Palmer Edward Coburn to the fingerprint scanner of the
DEVICES found at the premises; (2) hold the DEVICES found at the premises
in front of the face of Palmer Edward Coburn and activate the facial
recognition feature; and/or (3) hold the DEVICES found at the premises in
front of the face of Palmer Edward Coburn and activate the iris recognition
feature, for the purpose of attempting to unlock the DEVICES in order to
search the contents as authorized by this warrant. The proposed warrant does
not authorize law enforcement to compel that Palmer Edward Coburn state or
otherwise provide the password or any other means that may be used to unlock
or access the DEVICES. Moreover, the proposed warrant does not authorize

law enforcement to compel Palmer Edward Coburn to identify the specific

31



child pornography interact with each other. Child pornography formerly was
produced using cameras and film (either still photography or movies). The
photographs required darkroom facilities and a significant amount of skill in order
to develop and reproduce the images. There were definable costs involved with the
production of pornographic images. To distribute these on any scale required
significant resources. The photographs themselves were somewhat bulky and
required secure storage to prevent their exposure to the public. The distribution of
these wares was accomplished through a combination of personal contacts, mailings
and telephone calls. The development of computers has changed this. Computers
basically serve four functions in connection with child pornography: production,
communication, distribution, and storage.

20. Child pornographers can now transfer photographs from a camera onto
a computer readable format with a device known as a scanner. With the advent of
digital cameras, the images can now be transferred directly onto a computer. A
device known as a modem allows any computer to connect to another computer
through the use of telephone, cable, or wireless connection. Electronic contact can
be made to literally millions of computers around the world.

21. The computer’s ability to store images in digital form makes the
computer itself an ideal repository for child pornography. The size of the electronic

storage media (commonly referred to as the hard drive) used in home computers has

j
H


53. Although some of the records called for by this warrant might be found

in the form of user-generated documents (such as word processor, picture, and movie

files), computer storage media can contain other forms of electronic evidence, such
as the following:

a. Forensic evidence of how computers were used, the purpose of
their use, who used them, and when they were used, as described further in
Attachment B, called for by this warrant. Data on the storage medium not
currently associated with any file can provide evidence of a file that was once
on the storage medium but has since been deleted or edited, or of a deleted
portion of a file (such as a paragraph that has been deleted from a word
processing file). Virtual memory paging systems can leave traces of
information on the storage medium that show what tasks and processes were
recently active. Web browsers, email programs, and chat programs store
configuration information on the storage medium that can reveal information
such as online nicknames and passwords. Operating systems can record
additional information, such as the attachment of peripherals, the attachment
of USB flash storage devices or other external storage media, and the times
the computer was in use. Computer file systems can record information about '

the dates files were created and the sequence in which they were created. \

22



These biometric features include fingerprint scanners, facial recognition
features and iris recognition features. Some devices offer a combination of
these biometric features, and the user of such devices can select which features

they would like to utilize.

b. If a device is equipped with a fingerprint scanner, a user may
enable the ability to unlock the device through his or her fingerprints. For
example, Apple offers a feature called “Touch ID,” which allows a user to
register up to five fingerprints that can unlock a device. Once a fingerprint is
registered, a user can unlock the device by pressing the relevant finger to the
device’s Touch ID sensor, which is found in the round button (often referred
to as the “home” button) located at the bottom center of the front of the device.
The fingerprint sensors found on devices produced by other manufacturers

have different names but operate similarly to Touch ID.

c. If a device is equipped with a facial-recognition feature, a user
may enable the ability to unlock the device through his or her face. For
example, this feature is available on certain Android devices ‘and is called
“Trusted Face.” During the Trusted Face registration process, the user holds
the device in front of his or her face. The device’s front-facing camera then
analyzes and records data based on the user’s facial characteristics. The

device can then be unlocked if the front-facing camera detects a face with

28



obscene or that do not necessarily depict minors in sexually explicit poses or
positions.

10. “Minor” means any person under the age of eighteen years. See 18
US.C. § 2256(1).

11. “Sexually explicit conduct” means actual or simulated (a) sexual
intercourse, including genital-genital, oral-genital, or oral-anal, whether between
persons of the same or opposite sex; (b) bestiality; (c) masturbation; (d) sadistic or
masochistic abuse; or (e) lascivious exhibition of the genitals or pubic area of any
person. See 18 U.S.C. § 2256(2).

12. “Internet Service Providers” or “ISPs” are commercial organizations
which provide individuals and businesses access to the Internet. ISPs provide a range
of functions for their customers, including access to the Internet, web hosting, e-
mail, remote storage, and co-location of computers and other communications
equipment. ISPs can offer various means by which to access the Internet including
telephone-based dial-up, broadband based access via a digital subscriber line (DSL)
or cable television, dedicated circuits, or satellite-based subscription. ISPs typically
charge a fee based upon the type of connection and volume of data, called bandwidth
that the connection supports. Many ISPs assign each subscriber an account name
such as a user name or screen name, an e-mail address, and an e-mail mailbox, and

the subscriber typically creates a password for the account. By using a computer



DAVID for Consuela Bernetta Coburn, it shows her lease agreement for 106 Casa
PL starting in November 2019 with David Cruz, the lessor. Within the documents
section of DAVID for Palmer Edward Coburn shows a birth certificate showing
Consuela Bernetta Coburn as his mother.

37. During your Affiant’s verification of residency, the Affiant identified
that the Subject moved from 106 Casa Pl, Panama City Beach, FL to 122 Kelly
Street, Panama City Beach FL. On May 27, 2020, your Affiant drove by 106 Casa
Pl, Panama City Beach and identified an out of state license plate not associated with
Consuela Coburn or Palmer Coburn parked in 106 Casa Pl’s parking spot. It is
common for vacation homes near the beach to rent their vacation homes for longer
duration during the off-peak winter season.

38. On May 28, 2020, your Affiant subpoenaed LiveMe requesting recent
subscriber data for account “8998729.” The response from LiveMe identified the
most recent and consistent IP addresses logging into this account belonging to Wide
Open West internet. LiveMe subscriber data revealed the following: USERNAME:
AyyBenjii; SID: 8998729; REGISTRATION DEVICE: iPhone; EMAIL:
fanticshd@gmail.com; IP ADDRESSES: 69.73.52.248 (WOW).

39. On June 1, 2020, a subpoena by your Affiant to WOW requesting

subscriber information for the IP address, 69.73.52.24, logging into this LiveMe

15


visual depictions of children or from literature describing sexual contact with
children. The overriding motivation for the collection of child pornography may be
to define fuel and validate the collectors most cherished sexual fantasies involving
children,

43. Visual depictions may range from fully clothed depictions of children
engaged in non-sexual activity to nude or partially nude depictions of children
engaged in explicit sexual activity. In addition to child pornography, these
individuals are also likely to collect other paraphernalia related to their sexual
interest in children. This other material is sometimes referred to as "child erotica"
which is defined as any material, relating to children, that serves a sexual purpose
for a given individual. It is broader and more encompassing than child pornography,
but at the same time the possession of such corroborative material, depending on the
context in which it is found, may be behaviorally consistent with the offender's
orientation toward children and indicative of his/her intent. It includes things such
as fantasy writings, letters, diaries, books, sexual aids, souvenirs, toys, costumes,
drawings, cartoons and non-sexually explicit visual images.

44, Child pornography collectors may reinforce their fantasies, often by
taking progressive, overt steps aimed at turning the fantasy into reality in some or
all of the following ways: collecting and organizing their child-related material;

masturbating while viewing the child pornography; engaging children, online and

i


5. The information contained within this Affidavit is based on my training
and experience, as well as information I have developed, and information related to
me by other law enforcement officers. Because this Affidavit is being submitted for
the limited purpose of securing a search warrant, I have not included each and every

fact known to me concerning this investigation.

DEFINITIONS

6. The following definitions apply to this Affidavit and Attachment B to
this Affidavit:

7. “Child Pornography” includes the definition in 18 U.S.C. § 2256(8)
(any visual depiction of sexually explicit conduct where (a) the production of the
visual depiction involved the use of a minor engaged in sexually explicit conduct,
(b) the visual depiction is a digital image, computer image, or computer-generated
image that is, or is indistinguishable from, that of a minor engaged in sexually
explicit conduct, or (c) the visual depiction has been created, adapted, or modified
to appear that an identifiable minor is engaged in sexually explicit conduct).

8. “Visual depictions” include undeveloped film and videotape, and data
stored on computer disk or by electronic means, which is capable of conversion into
a visual image. See 18 U.S.C. § 2256(5).

9. “Child Erotica” means materials or items that are sexually arousing to
persons having a sexual interest in minors but that are not, in and of themselves,

3



d. Variety of forms of electronic media — Records sought under this
warrant could be stored in a variety of storage media formats that may require
off-site reviewing with specialized forensic tools.

e. The seizure of peripherals is necessary because the peripheral
devices that allow users to enter or retrieve data from the storage devices vary
widely in their compatibility with other hardware and software. Many system
storage devices require particular input/output (I/O) devices to read the data
on the system. It is important that analysts be able to properly re-configure the
system as it now operates in order to accurately retrieve the evidence
contained therein. In addition, analysts need the relevant system software
(operating systems, interfaces, and hardware drivers) and any applications
software that may have been used to create the data (whether stored on hard
drives or on external media), as well as all related instruction manuals or other
documentation and data security devices.

55. Based on the foregoing, and consistent with Fed. R. Crim. P.

41(e)(2)(B), if officers executing the warrant conclude that it would be impractical
to review the hardware, media, or peripherals on-site (as I anticipate will be the case),
any warrant that issues as a result of this application would permit officers to create
an electronic “image” of the computer and then to conduct an off-site search for the

things described in the warrant from the “mirror image” copy at a later date. If on-

26

i
i


regarding child pornography investigations and the many different enforcement
methods used to combat child pornography and the internet exploitation of children.
The FBI online covert employee, (“OCE”), who provided information to your
Affiant on this case, is a member of the FBI’s Child Exploitation Human Trafficking
‘Task Force and is an experienced agent in matters relating to child pornography.

3. I present this Affidavit in support of an application for a warrant to
search and to seize relevant evidence found within the following residence, located
within the Northern District of Florida (more fully described in Attachment A): the
garage house located at 122 Kelly Street, Panama City Beach, Florida 32413
(hereinafter “SUBJECT PREMISES”).

4. Pursuant to Rule 41 of the Federal Rules of Criminal Procedure, I seek
authority to search the above-identified property for evidence, fruits, and instruments
related to the unlawful activities described in this Affidavit. The activities are
believed to be in violation of federal law, which includes, but is not limited to,
violations of 18 U.S.C. §§ 2252A(a)(2) and 2252A(a)(5)(B), which make it a crime
to receive and distribute child pornography and to possess child pornography and
access with intent to view child pornography, respectively. The violations and the
basis for the search are more fully described below, and the specific items to be

searched for and seized at each location are more fully described in Attachment B.


characteristics that match those of the registered face. Facial recognition
features found on devices produced by other manufacturers have different

names but operate similarly to Trusted Face.

d. If a device is equipped with an iris-recognition feature, a user
may enable the ability to unlock the device with his or her irises. For example,
on certain Microsoft devices, this feature is called “Windows Hello.” During
the Windows Hello registration, a user registers his or her irises by holding
the device in front of his or her face. The device then directs an infrared light
toward the user’s face and activates an infrared-sensitive camera to record
data based on patterns within the user’s irises. The device can then be
unlocked if the infrared-sensitive camera detects the registered irises. Iris-
recognition features found on devices produced by other manufacturers have

different names but operate similarly to Windows Hello.

e. In my training and experience, users of electronic devices often
enable the aforementioned biometric features because they are considered to
be a more convenient way to unlock a device than by entering a numeric or
alphanumeric passcode or password. Moreover, in some instances, biometric
features are considered to be a more secure way to protect a device’s contents.

This is particularly true when the users of a device are engaged in criminal

29



31. Asubpoena by the OCE to WOW requesting subscriber information for
the IP address, 24.96.246.251, logging into this LiveMe account. Wide Open West
then provided subscriber information as follows: David Cruz, 106 Casa Pl, Panama
City Beach, FL 32413, 931-981-3481.

32. A software program used by the OCE recorded the online activity,
chats, and images identified within LiveMe, and a DVD recording was sent to your
Affiant via FedEx. The DVD recording shows the OCE viewing the profile of Best
Links on LiveMe, then going into Best Links FAM chatrooms. The OCE went into
Best Links FAM chatroom “join” and copied a Mega.nz link posted in the chatroom
by Best Links. The OCE then uploaded the copied Mega.nz link on a separate
webpage and multiple videos described in the paragraph above appeared. Best Links
shared his Mega.nz link with the other 93 members in the FAM chatroom “join.”
Members of the group can access the child pornography via clicking on the Mega.nz
link and downloading the child pornography videos.

33. A subpoena by the OCE to Google requesting subscriber information
for email addresses fanticshd@gmail.com_used to register the Best Links LiveMe
account and palmercoburn@gmail.com recovery email to "fanticshd@gmail.com"

provided subscriber information as follows:

GOOGLE SUBSCRIBER DATA (fanticshd@gmail.com)

« NAME: Hype Central


account. WOW then provided subscriber information as follows: Coburn Palmer,
120 Kelly St, Panama City Beach, FL 32413, 850-358-0733.

40. A search of the Florida Driver License and Vehicle Information
Database (DAVID) shows a change in the mailing address for Consuela Bernetta
Coburn to 122 Kelly Street, Panama City Beach, FL 32413. 122 Kelly Street is the
street facing residence and 120 Kelly Street is a detached garage house located on
122 Kelly St, Panama City Beach, FL 32413. On June 23, 2020, your Affiant
identified a black Jeep, license plate LAIL62, parked in front of the detached garage
house. Per DAVID, license plate LAIL62 is registered to Consuela Bernetta Coburn.
On July 22, 2020 and July 23, 2020, agents observed a red Nissan Sentra with Illinois
license plate FP70604 parked at the garage house. Agents determined the vehicle is
a rental and verified it is rented to Consuela Bernetta Coburn.

CHILD PORNOGRAPHY COLLECTOR CHARACTERISTICS

41. Many individuals who possess child pornography are sexually attracted
to children, Their sexual arousal patterns and erotic imagery focus, in part or in
whole, on children. Any collection may be exclusively dedicated to children of a
particular age/gender or it may be more diverse, representing a variety of sexual
preferences, including children.

42, These individuals may derive sexual gratification from actual physical

contact with children as well as from fantasy involving the use of pictures or other

16