Bookmark
PDF
Share
CaseIQ

In re Briefly Describe the Prop. to Be Searched or Identify the Person by Name & Address

United States District Court, Northern District of California

Dec 20, 2022

Judgment

Subsequent
References

CaseIQ

HONORABLE KANDIS A. WESTMORE, UNITED STATES MAGISTRATE JUDGE.

APPLICATION FOR A WARRANT BY TELEPHONE OR OTHER RELIABLE ELECTRONIC MEANS

HONORABLE KANDIS A. WESTMORE, UNITED STATES MAGISTRATE JUDGE.

I. a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location):

See Attachment A to the Affidavit of Special Agent Meredith Stanger located in the Northern District of California, there is now concealed (identify the person or describe the property to be seized):

See Attachment B to the Affidavit of Special Agent Meredith Stanger

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more)

[√] evidence of a crime;

[√] contraband, fruits of crime, or other items illegally possessed:

[√] property designed for use. intended for use. or used in committing a crime:

[] a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section Offense Description

18 U.S.C. § 2252(a)(2) Distribution or Receipt of Child Pornography

18 U.S.C. § 2252(a)(4)(B) Possession of Child Pornography

The application is based on these facts:

SEE ATTACHED AFFIDAVIT OF FBI SPECIAL AGENT MEREDITH STANGER.

[√] Continued on the attached sheet.

[] Delayed notice of ____ days (give exact ending date if more than 30 days: _____) is requested under 18 U.S.C. § 3103a. the basis of which is set forth on the attached sheet.

Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1 by telephone(specify reliable electronic means).

AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR CRIMINAL COMPLAINT

I, Meredith Stanger, Special Agent with the Federal Bureau of Investigation (“FBI”), being duly sworn, state:

INTRODUCTION

1. I make this affidavit in support of an application under Rule 41 of the Federal Rules of Criminal Procedure for a search warrant authorizing the examination of a Samsung Galaxy S22 Ultra cellular phone (the SUBJECT DEVICE), described more fully in Attachment A. The SUBJECT DEVICE is currently in the custody of the FBI San Francisco Division, Oakland Resident Agency, located at 2101 Webster Street, Suite 400, Oakland, California 94612. There is probable cause to believe that the electronically stored information, as described in Attachment B, will be located on the SUBJECT DEVICE, and is evidence, fruits, and instrumentalities of continued violations of 18 U.S.C. §§ 2252(a)(2) and 2252(a)(4)(B). Seized electronic devices will be searched according to the protocol set forth in Attachment C. This request for a search warrant originates from an investigation into the sexual exploitation of minors by ROBERT D. TAUNTON.

2. This affidavit is submitted for the limited purpose of securing a search warrant. I have not included every fact known to me concerning this investigation. Instead, I have set forth only the facts necessary to establish probable cause that violations of the federal laws identified above have occurred, and that evidence, fruits, and instrumentalities of these violations are located at or on the SUBJECT DEVICE. I have based my statements in this affidavit on my training and experience, personal knowledge of the facts and circumstances obtained through my participation in this investigation, information provided by the victim company, information provided by other agents and law enforcement officers, and information provided by records and databases.

AFFIANT BACKGROUND

3. I am a Special Agent with the Federal Bureau of Investigation (FBI). I have been so employed since January 2015. I am currently assigned to the San Francisco Field Office, Oakland Resident Agency, to a squad that investigates crimes against children.

4. Since joining the FBI, I have investigated, among other things, federal criminal violations related to child pornography and the sexual exploitation of minors. I am currently assigned to investigate cases involving the sexual exploitation of minors, including such exploitation via the Internet and computers. I have received training in the areas of child pornography, child exploitation, and human trafficking, and have had the opportunity to observe and review numerous examples of child pornography (as defined in 18 U.S.C. § 2256) in multiple forms of media, including computer media and cellular devices. Through my training and experience, I have become familiar with the methods used by people who commit offenses involving the sexual exploitation of children. My training and experience have given me an understanding of how people who commit offenses relating to the sexual exploitation of minors including the receipt, distribution, and production of child pornography, use the Internet, computers, and cellular devices to facilitate and commit those offenses.

5. I am an investigator and law enforcement officer of the United States within the meaning of 18 U.S.C. § 2510(7). I am empowered by law to conduct investigations, to execute search warrants, and to make arrests for offenses of federal law, including offenses enumerated in 18 U.S.C. § 2252.

APPLICABLE STATUTES

6. Pursuant to 18 U.S.C. § 2252(a)(2), it is unlawful for any person to knowingly receive or distribute any visual depiction of a minor engaging in sexually explicit conduct that has been mailed, shipped or transported using any means of facility of interstate or foreign commerce or in or affecting interstate or foreign commerce by any means, including by computer, or that was produced using materials that have been mailed or shipped or transported in or affecting interstate or foreign commerce by any means, including by computer.

7. Pursuant to 18 U.S.C. § 2252(a)(4)(B), it is unlawful for any person who knowingly possesses, or knowingly accesses with intent to view, one or more books, magazines, periodicals, films, video tapes, or other matter which contain any visual depiction that has been mailed, or has been shipped or transported using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign commerce, or which was produced using materials which have been mailed or so shipped or transported, by any means including by computer, if-(i) the producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and (ii) such visual depiction is of such conduct; shall be punished as provided in subsection (b) of this section.

8. Pursuant to 18 U.S.C. § 2252(b)(2), whoever violates, or attempts or conspires to violate, paragraph (4) of subsection (a) shall be fined under this title or imprisoned not more than 10 years, or both, but if any visual depiction involved in the offense involved a prepubescent minor or a minor who had not attained 12 years of age, such person shall be fined under this title and imprisoned for not more than 20 years, or if such person has a prior conviction under this chapter, chapter 71, chapter 109A, or chapter 117, or under section 920 of title 10 (article 120 of the Uniform Code of Military Justice), or under the laws of any State relating to aggravated sexual abuse, sexual abuse, or abusive sexual conduct involving a minor or ward, or the production, possession, receipt, mailing, sale, distribution, shipment, or transportation of child pornography, such person shall be fined under this title and imprisoned for not less than 10 years nor more than 20 years.

INFORMATION ABOUT THE EVIDENCE LIKELY TO BE FOUND ON THE SUBJECT DEVICE BASED ON MY TRAINING AND EXPERIENCE AND THE FEATURES OF THE SUBJECT DEVICE

9. I have had both training and experience in the investigation of computer-related crimes. Based on my training, experience, and knowledge, and conversations with other law enforcement personnel familiar with these types of investigations, I know the following:

a. Cellular (or mobile) phones, computers, and digital technology have dramatically changed the way in which individuals interested in exploiting children interact with each other. Computers and cell phones serve functions in connection with child exploitation: communication between persons engaging in child

exploitation to arrange and accomplish the exploitation and for the production, distribution, and storage of child pornography which is often directly associated with child exploitation. Oftentimes a person who is engaged in seeking out a child to exploit on the Internet will store images of the exploited child in electronic format.

b. A mobile phone and/or computer's ability to store images in digital form makes the phone or computer itself an ideal repository for images of child exploitation. It is extremely easy for an individual to take a photo or a video with a camera-bearing smartphone, upload that photo or video to their phone, photo gallery, cloud storage, or to a data or cloud storage application (i.e. Dropbox or MEGA), a computer, and then copy it (or any other files on the phone or computer) to any media storage devices like external hard drives, USB flashdrives, or DVDs.

c. Smartphones and/or mobile phones can be easily concealed and are also often carried on an individual's person or in an individual's vehicle. Similarly, such media storage devices like thumb drives can be concealed on an individual's person.

d. The Internet affords individuals several different venues for persons involved in the exploitation of children to meet and communicate and for obtaining, viewing, and trading child pornography, all in a relatively secure and anonymous fashion.

e. Individuals can use online resources such as email or more commonly now, third-party mobile messaging and social networking applications like Kik, WhatsApp, Snapchat, Facebook, Instagram, TikTok, Telegram, Wickr, Discord, among others; to communicate regarding child exploitation and trade child sexual abuse material. Some of these applications allow for encryption or options to mask an individual's chatting history. Data storage applications like Dropbox and MEGA allow individuals to store child pornography or other images and exchange links to files ranging from a single image or video to folders containing multiple files.

f. Individuals often carry on their person, in their vehicles, or store in their

residences, smartphones and other electronic storage devices such as thumb drives. These devices are sometimes the same devices which they use to exploit children on the Internet or may contain evidence related to the sexual exploitation of children.

FACTS SUPPORTING PROBABLE CAUSE

Initiation of Investigation and CSAM Distributed by ROBERT D. TAUNTON

10. On or about November 12, 2020, FBI Knoxville provided FBI San Francisco with information regarding Kik user “spaceprogram2199” (Kik profile name: Rob .) who was observed distributing child sexual abuse material (CSAM) via the Kik application. Throughout the week of October 19, 2020, a law enforcement officer acting in an undercover capacity (OCE1) was added to a private Kik group chat titled “Boy Shot” by an unidentified Kik user. Shortly after creation of the private group, this unknown Kik subscriber was banned by Kik resulting in the OCE1 becoming the owner of the group. On October 24, 2020, group members began exchanging CSAM with the group.

11. On or about October 25, 2020, Kik user “spaceprogram2199” distributed an image of what appeared to be an adolescent male under the age of 15 years old displaying an erect penis and his buttocks. On October 26, 2020, Kik user “spaceprogram2199” distributed a video of what appeared to be an adolescent male under the age of 13 years old ejaculating.

12. On or about February 24, 2021, FBI Tampa provided supplemental information to FBI San Francisco pertaining to Kik user “spaceprogram2199”. On January 7, 2021, FBI Tampa executed a search warrant at the residence of a predicated subject being investigated for the online sexual exploitation of children. During the search, the subject was interviewed and provided he distributed and received CSAM via the Kik application. Pursuant to a forensic search of the subject's cellular device on January 28, 2021, Kik user “spaceprogram2199” was identified as having distributed CSAM between November 17-28, 2020.

13. On November 24, 2020, Kik user “spaceprogram2199” distributed two images of what appeared to be (1) an age difficult male exposing an erect penis in his underwear; and (2) an adolescent male under the age of 15 years old exposing an erect penis and his testicles.

14. Kik user “spaceprogram2199” was observed as active in Kik groups designed to trade CSAM and/or child erotica of adolescent males under the age of 17 years old (“Boys for Play” / “Boys in Motion”). Kik user “spaceprogram2199” operated within these groups in administrator and/or owner roles. It is believed that immediately preceding, during, and after CSAM distribution, Kik user “spaceprogram2199” utilized a VPN and cellular data to access the Kik application.

15. On or about March 12, 2021, FBI San Francisco received media files from FBI Knoxville containing screen captures and recordings of Kik group chat and the distributed CSAM by Kik user “spaceprogram2199” and other Kik users. Your affiant reviewed these materials in their entirety. The media files are described as follows:

a. File 1 - IMG 3484: Image which depicts a screen capture of the Kik chat within the Kik group “Boy Shot” and includes posts from Kik user “spaceprogram2199”. Kik user “spaceprogram2199” was observed posting “Very hot.” and then “Hi” followed by a photo (IMG3508) of what appears to be a naked adolescent male exposing his buttocks while facing away from the camera.

b. File 2 - IMG 3485: Image which depicts the aforementioned photo of what appears to be a naked adolescent male exposing his buttocks while facing away from the camera (IMG3508); and another photo displaying what appears to be a naked adolescent male exposing an erect penis while taking a ‘selfie' (IMG3509).

c. Files 3-4 - IMG 3486 & IMG 3510: Images of the Kik profile for “spaceprogram2199” with the display name of “Rob .” The profile photo depicts the naked torso of a white male with a mini smiley face emoji wearing sunglasses. The Kik profile reports that “spaceprogram2199” had spent 492 Days on Kik as of October 2020.

d. File 5 - IMG 3489: Image which depicts a post from Kik user “spaceprogram2199” that appears to be a video still of a male's penis.

e. File 6 - IMG 3508: Full image which was posted by Kik user “spaceprogram2199” within the Kik group “Boy Shot” chat (per IMG3484 and IMG3485) depicting what appears to be a naked adolescent male exposing his buttocks while facing away from the camera.

f. File 7 - IMG 3509: Full image which was posted by Kik user “spaceprogram2199” within the Kik group “Boy Shot” chat (per IMG3485) depicting what appears to be a naked adolescent male exposing an erect penis while taking a ‘selfie'.

g. Files 8-9 - IMG 3490 & IMG 3524: Video posted within the Kik group “Boy Shot” by Kik user “spaceprogram2199” (per IMG3489) which depicts what appears to be an adolescent male ejaculating while laying down on pillows. Video is 8 seconds in durations and appears to be on a loop.

h. File 10 - JTAQ1337 : Screen recording of Kik group chat for Kik group “Boy Shot” to include the posting activity by Kik user “spaceprogram2199” and the aforementioned explicit images on approximately October 26, 2020. The video is 1 minute and 16 seconds in duration. Kik user “spaceprogram2199” is observed continuing to chat after posting the images as follows:

spaceprogram2199: IMG_3508

IMG_3509

Kik user Jace: So hot

Kik user jacobelidrew: Mmmmm. He so sexy spaceprogram2199: My favorite:) [laughing emoji with tears]

Kik user jacobelidrew: I know. I'd get him for you if I could!

spaceprogram2199: I would love that

Kik user Jace: He's gorgeous spaceprogram2199: Mhmm

i. File 11 - QBJY1879 : Screen recording of Kik group chat for Kik group “Boy Shot” to include the profile page of the group and postings which include CSAM. The profile photo of the group appeared to be two adolescent anime males engaged in anal sex. There were 46 (of 50) members in the group. Kik user “spaceprogram2199” was listed as an Administrator of the group. Another Administrator of the group was Kik user “jacobelidrew” (display name: Jacob Drew) who posted multiple images of what appeared to be naked prepubescent boys. Kik user with display name “Jace” was listed as a member. The video is 2 minutes and 15 seconds in duration.

j. File 12 - QZUW1915 : Screen recording of Kik group chat for Kik group “Boy Shot” to include a posting by Kik user “spaceprogram2199” of a video (IMG3490 & IMG3524) which depicts what appears to be an adolescent male ejaculating while laying down on pillows. Throughout the group chat, there was numerous CSAM files shared. The video is 1 minute, 36 seconds in duration.

16. On or about April 19, 2021, FBI San Francisco received media files from FBI Tampa containing a Cellebrite extraction report and the distributed CSAM by Kik user “spaceprogram2199” through a private chat with another Kik user. Your affiant reviewed these materials in their entirety. The media files are described as follows:

a. File 1 - 3d91d9fd-3d33-4fa2-8fd5-5cfed9f5b72c: Image depicting what appears to be an age-difficult male pulling his orange underwear away from his body to expose his penis. The image appears to be an overhead photo.

b. File 2 - a0661d47-d36e-4179-a994-719a6cc8e5c1: Image depicting what appears to be an adolescent male pulling his pants down to expose his erect penis and testicles. Minor male is not wearing a shirt.

17. From November 17-28, 2020, Kik user “spaceprogram2199” (TAUNTON) was observed posting the following within a private chat with another Kik user who was the subject of FBI Tampa's investigation:

Kik Messenger: Rob . has left the chat

spaceprogram2199: Good thing he had his mask on (Image Omitted)

spaceprogram2199: Damn nice pics

spaceprogram2199: 3d91d9fd-3d33-4fa2-8fd5-5cfed9f5b72c.jpg

spaceprogram2199: Oh ya

spaceprogram2199: I don't have any more of him

spaceprogram2199: a0661d47-d36e-4179-a994-719a6cc8e5c1.jpg

spaceprogram2199: Hey

spaceprogram2199: Hru?

spaceprogram2199: A bit sleepy just woke up

18. Both of the aforementioned images (with the extensions .jpg) were sent on November 24, 2020, at approximately 6:38 PM and 7:21 PM, respectively.

19. Based on my training and experience, I believe that the images and videos described in paragraphs 15(a)-(b), (d)-(j) and paragraph 16(b) depict minors engaged in sexually explicit conduct as described under 18 U.S.C. § 2256.

NCMEC CyberTips Associated with ROBERT D. TAUNTON

20. On April 7, 2021, the National Center for Missing and Exploited Children (NCMEC) received a cybertip from Facebook, Inc. involving Instagram user: r_biguy (User ID: 31923524198), display name: Rob, email: spaceprogram2199@gmail.com, who uploaded a file of apparent child pornography. On March 18, 2021, Instagram user “r_biguy” posted a video via Instagram Direct to another user. Instagram categorized this uploaded video as involving a pubescent minor engaged in a sex act or sexually explicit conduct (actual or simulated sexual intercourse including genital-genital, oral-genital, anal-genital, or oral-anal whether between person of the same or opposite sex), bestiality, masturbation, sadistic or masochistic abuse, or degradation. IP address 24.130.86.154 was reported with this activity and associated with a Comcast subscriber in El Sobrante, California.

21. On April 12, 2021, NCMEC received a cybertip from Facebook, Inc. involving Instagram user: r__biguy (User ID: 31923524198), display name: Rob, email: spaceprogram2199@gmail.com, who received at least one file of apparent child pornography. On April 10, 2021, Instagram reported that user “r_biguy” was a recipient of an image categorized as involving a prepubescent minor engaged in lascivious exhibition or depicting nudity and one or more of: restraint, sexually suggestive poses, focuses on genitals, inappropriate touching, adult arousal, and spreading of limbs or genitals.

22. On April 15, 2021, NCMEC received a cybertip from Facebook, Inc. involving Instagram user: r_biguy (User ID: 31923524198), display name: Rob, email: spaceprogram2199@gmail.com, who received at least one file of apparent child pornography. On April 10, 2021, Instagram reported that user “r_biguy” was a recipient of an image categorized as involving a prepubescent minor engaged in lascivious exhibition or depicting nudity and one or more of: restraint, sexually suggestive poses, focuses on genitals, inappropriate touching, adult arousal, and spreading of limbs or genitals.

23. On May 12, 2021, NCMEC received a cybertip from Facebook, Inc. involving Instagram user “r.bi.guy” (User ID: 47770962887), display name: Rob, email: rdtaunton@gmail.com, telephone: +15107784646. Instagram reported that Instagram user “r.bi.guy” received an image depicting what appeared to be apparent child pornography on May 10, 2021. This image was identified as a match to a previously reported child exploitation image on NCMEC's NGO hash list. The file was categorized by NCMEC as depicting a prepubescent minor engaged in a sex act. NCMEC did not view the uploaded file.

24. On June 14, 2021, an additional NCMEC cybertip from Facebook, Inc. was received by the Contra Costa County District Attorney's Office. A database check on the phone number reported in the cybertip yielded TAUNTON as the possible subscriber. Instagram reported that an image file depicting what appeared to be apparent child pornography, was identified as a “Hash Match” of one or more uploaded files to visually similar files that were previously viewed and categorized by NCMEC at the time this report was generated. On or about May 10, 2021, this media was distributed via the Instagram Direct platform by Instagram user “r.bi.guy” (User ID: 47770962887), display name: Rob, email: rdtaunton@gmail.com, telephone: +15107784646. Instagram provided this user's login IP address on May 13, 2021 as IP 24.130.86.154.

FBI Online Undercover Chats with Kik user “spaceprogram2199”

25. From March 24, 2021 through April 7, 2021, an FBI Agent acting in an online undercover capacity (OCE2) engaged Kik user “spaceprogram2199” in private messaging via the Kik Messenger application.

26. On March 24, 2021, OCE2 began a private chat with Kik user “spaceprogram2199", later identified as ROBERT TAUNTON. OCE2 commented on TAUNTON'S photo collection from the Kik group “Boy Shot”. TAUNTON posted photos of minor boys consistent with child sexual abuse material (CSAM) within this group. On April 7, 2021, TAUNTON chatted with OCE2. When OCE2 asked if spaceprogram2199 was partial to little boys or little girls, TAUNTON said, “I like both. But I like boys more.” OCE2 asked, “what ages” and spaceprogram2199 replied, “10+.”

27. OCE2 asked TAUNTON if he had any access to “yungs” to which TAUNTON said, “No I wish I had someone.” TAUNTON said he did not have any experience since he was 12 to 15. When TAUNTON was 12 years old, he messed around with his brother and a neighbor boy.

28. OCE2 told TAUNTON that OCE2 was a babysitter for boy/girl twins, age 9 to 10. TAUNTON said, “Nice... twins are hot.” TAUNTON then told OCE2 that he was a fraternal twin. OCE2 asked TAUNTON if his brother was into boys as well, but TAUNTON said “Not that I know of.” TAUNTON is not as close with his twin brother as they used to be, but TAUNTON provided they live about five minutes from each other and see each other fairly often. TAUNTON said his name was “Robby.”

29. OCE2 asked TAUNTON what he would want to do if he babysat. The following conversation ensued:

spaceprogram2199: I'd wanna bathe them and make sure they get extra clean

OCE2: clean for later?!

spaceprogram2199: Maybe

OCE2: why little tikes over girls?

spaceprogram2199: Idk. I like their little dicks

OCE2: ever suck one?

spaceprogram2199: Not since I was younger OCE2: would you if you had the chance?

spaceprogram2199: Idk. I think I would. But only if they wanted it

30. TAUNTON did not know of any other groups like “Boy Shot” or any groups that trade photos of little girls. TAUNTON said, “I'm not even in boy shot anymore unfortunately.”

FBI Search Warrant Execution at Residence of ROBERT D. TAUNTON

31. Through the use of administrative subpoenas to Kik, Google, Comcast, AT&T, and Facebook, I was able to determine the above listed online social media accounts were associated with email addresses and a cellular phone number connected to ROBERT D. TAUNTON. Subpoena returns and physical surveillance confirmed that the residence that TAUNTON shared with two roommates was consistently connected to IP addresses used for the aforementioned Kik and Instagram online activity. Based on this information, I obtained a federal search warrant for that residence.

32. On September 16, 2021, I along with other FBI agents executed Federal Search Warrant, authorized by the Honorable Nathanael Cousins, U.S. Magistrate Judge of the United States District Court, on a residence located in El Sobrante, California, within the Northern District of California. Agents subsequently identified three inhabitants of the residence, one of whom was ROBERT TAUNTON. Agents seized three Western Digital external hard drives, an Apple laptop, an Antec Design computer tower, Apple Watch and Apple iPhone 12 Pro Max, all belonging to and utilized by TAUNTON.

33. During the execution of the warrant, TAUNTON consented to be interviewed. TAUNTON confirmed that he currently lived at the residence and had lived there for the past five to six years. TAUNTON confirmed he had had his iPhone 12 since October 2020. TAUNTON told Agents that he had Instagram, Facebook, and Snapchat accounts. TAUNTON said he used emails rdtaunton@gmail.com and rdtaunton@me.com. TAUNTON's email rdtaunton@gmail.com was tied to TAUNTON's “r.bi.guy” Instagram account.

34. TAUNTON eventually said he had Kik and used it to chat with “bi-guys” in groups. TAUNTON said he may have used Kik username “spaceprogram2199” in the past. TAUNTON confirmed that the profile picture for Kik user “spaceprogram2199” was him.

35. TAUNTON eventually said he was a member of the Kik group “Boy Shot”, but denied posting any sexually explicit material depicting minors to this group. TAUNTON said that nude photos of boys were posted within this group. When asked the age of these boys, TAUNTON provided they were maybe “13 or so.”

36. TAUNTON denied producing any child sexual abuse material and denied asking anyone to produce such content. TAUNTON denied using Instagram username “r_biguy” and “r.bi.guy” multiple times to Agents.

37. During the interview, TAUNTON provided the passcode to unlock his cellular phone. TAUNTON was questioned about videos of young boys masturbating that were found on his phone during the search. TAUNTON said he may have saved them to his phone at some point, but could not remember. TAUNTON may have accessed them a month or two ago.

38. TAUNTON was asked about having the MEGA application on his phone. TAUNTON originally denied using MEGA. Eventually, TAUNTON said he was sent MEGA links through Kik which contained media depicting minors and child pornography.

FBI Forensic Review of TAUNTON's Digital Devices

39. On or about November 3, 2021, I conducted a review of TAUNTON's cellular phone, an Apple iPhone 12 Pro Max, and identified approximately 578 images and 62 videos consistent with child sexual abuse material stored on TAUNTON's cellular phone. An example of the image and video content is described as follows:

a. File Name: 0c5d3ba6-625e-4f40-9ec8-5d70c5da6d36 - An image depicting what appears to be an adult male having anal sex with a minor male. The adult male is restraining the minor male's arms behind his back and penetrating the minor male's anus with his penis.

b. File Name: 84cadf9b-684e-4f1e-aaa9-28dbcb75b746 - An image depicting what appears to be a minor male orally copulating the penis of another minor male.

c. File Name: 89d36ffa-d15d-45ab-9297-d634c87c5a30 embedded 1 - An image depicting what appears to be a minor male orally copulating the penis of an adult male.

d. File Name: a36d-7d4c-452a-b344-e7acc41db449.mp4 - A video (18 seconds in duration) depicting what appears to be the anus of a prepubescent male child after an adult male used his penis to penetrate it.

e. File Name: 06efd659-1f51-4ce6-8c68-c5e4780f7b79.mp4 - A video (24 seconds in duration) depicting what appears to be an adolescent male simultaneously orally copulating an adult male's penis while massaging the adult male's testicles.

f. File Name: 31ffe6ec-3910-4f74-b441-37e44a0391f8.mp4 - A video (9 seconds in duration) depicting what appears to be an adolescent male orally copulating an adult male's penis. The adult male is observed pushing the boy's head down on his penis.

g. File Name: 13yo boy fucked by man.mp4 - A video (9 minutes, 49 seconds in duration) depicting what appears to be an adolescent male in a bathtub exposing his penis and anus. The video then depicts the young male on a bed massaging his penis and digitally penetrating his anus. At approximately 6:55, an adult male begins to penetrate the minor child's anus with his penis while the boy masturbates.

40. TAUNTON's iPhone had the phone number 510-778-4646 which was also tied to TAUNTON's “r.bi.guy” Instagram account. TAUNTON's Apple ID was tied to email rdtaunton@gmail.com.

41. On or about November 5, 2021, your affiant completed a review of the remaining digital evidence items seized from TAUNTON's residence and identified approximately 82 additional files (62 images and 20 videos) consistent with child sexual abuse material and child exploitative material on one Western Digital external hard drive.

42. The review of TAUNTON's digital devices yielded TAUNTON's cellular phone as being the predominant device that TAUNTON utilized to distribute, receive, and possess child sexual abuse material. TAUNTON's phone had the following social media applications downloaded on his phone: Discord, Kik, Instagram, Snapchat, Telegram, TikTok, WhatsApp, VLC, MEGA, and Reddit. TAUNTON's Kik account was logged in with username: spaceprogram2199. TAUNTON also used this username for TikTok and a variation of this username with “sprogram2199” on Snapchat. In my experience, the applications Kik, Discord, Instagram, Snapchat, Telegram, and MEGA have been observed as being used to share child sexual abuse material.

Analysis of TAUNTON's Kik Account

43. On or about December 9, 2021, I reviewed the groups that TAUNTON was associated with via Kik while utilizing username “spaceprogram2199”. Kik provided that TAUNTON was a part of approximately 60 groups. Several of these group names were observed as follows: Boy Shot, Gay/Bi All Ages Chat, Boys and Boys, Gay 13-21 Unclean, and All Ages Chat Unclean.

In my training and experience, I understand “unclean” to refer to sexually explicit material being shared.

44. Within the Kik group “Boy Shot”, rules were posted when new individuals joined the group. The final rule stated “Have fun - this chat is unclean so don't be shy, boy shota[sic] and under 18 posts required.” In my training and experience, this rule was understood to mean that a user was required to post a sexually explicit image of a minor male in order to participate in the group.

Analysis of TAUNTON's Instagram Accounts

45. On or about October 7, 2021, I completed a review of the media files received as part of search warrant returns obtained pursuant to a Federal Warrant executed on September 10, 2021 for Instagram accounts “r_biguy” and “r.bi.guy”, found as associated with ROBERT TAUNTON, based on NCMEC Cyber Tipline Reports. A review of the account information provided that TAUNTON utilized Instagram account “r_biguy” from March 13, 2021 through April 24, 2021. TAUNTON was in receipt and distributed child sexual abuse and child exploitative material during this time (approximately 191 files). A further review yielded that TAUNTON then utilized Instagram account “r.bi.guy” from April 26, 2021 through May 13, 2021. TAUNTON continued to receive and distribute child sexual abuse and child exploitative material during this time (approximately 8 files).

46. On or about February 7, 2022, a review of the communications for TAUNTON's Instagram account “r_biguy” was completed. Communications from March 2020 through September 2021 were analyzed for the purpose of identifying minors. During this time, TAUNTON sought communications with male boys between the ages of 11 to 15 years old. TAUNTON transferred obscene material to minors and requested material from minors. The following patterns were observed:

a. TAUNTON repeatedly spoke of showering and lying in bed naked in order to initiate sexual conversations with minors. TAUNTON frequently asked minors what they were wearing or how large their penis was as a means to elicit conversations about nudity and masturbation as the first steps towards the production of child sexual abuse material. On multiple occasions, TAUNTON coached pre-pubescent minors on how and why to masturbate, and encouraged them to do so, as a means of encouraging the production of child sexual abuse material.

b. TAUNTON engaged in conversations with pedophiles who claimed to be actively exploiting children, and TAUNTON expressed interest in receiving CSAM

derived from these activities. TAUNTON expressed interest in incest and rape involving children in several conversations made through Instagram accounts “r_biguy” and “r.bi.guy”.

c. In conversations on these Instagram accounts, TAUNTON would indicate that he was 18 or 19 years old, when in reality he is 34 years old. TAUNTON joined multiple groups created by minor boys for the purposes of trading sexually explicit materials, and was allowed entry because he falsely reported that he was a teenager.

Additional NCMEC CyberTips Associated with ROBERT D. TAUNTON

47. On October 19, 2022, Contra Costa County District Attorney's Office contacted the FBI with additional cybertips believed to be associated with ROBERT D. TAUNTON. Four NCMEC cybertips were reported pertaining to activity on or about August 19, 2022 via the Quora application.

48. Quora reported that multiple image files, depicting what NCMEC categorized as “apparent child pornography” and “child unclothed” were identified as Hash Match(es) of one or more uploaded files to visually similar files that were previously viewed and categorized by NCMEC at the time the reports were generated. The images were consistent with CSAM depicting what appeared to be naked minor males with their genitalia exposed.

49. Quora reported the user profile uploading these images on or about August 19, 2022 as: Name - Rob, Email Address - rdtaunton@gmail.com, Screen/User Name - Rob, Profile URL - www.quora.com/profile/Rob-3875, and IP Address - 154.3.250.150 (Login) 08-19-2022 06:33:36 UTC. The email address tied to these cybertips is one of the active emails that TAUNTON provided to the FBI that he used when he was interviewed in September 2021.

50. The ISP for the aforementioned IP address 154.3.250.150 resolved to Cogent Communications and the Dallas-Fort Worth area. Further investigation into this information yielded the IP Address to be a Private Internet Access (PIA) VPN. In my training and experience, users will utilize a VPN in order to mask their location when conducting online activity.

FBI Arrest of ROBERT D. TAUNTON

51. On December 9, 2022, FBI Special Agents executed an arrest of ROBERT D. TAUNTON in the vicinity of his residence located in El Sobrante, California. TAUNTON was apprehended without incident. Upon searching TAUNTON incident to arrest, TAUNTON's cell phone, a Samsung Galaxy S22 Ultra (SUBJECT DEVICE), was found and seized for evidentiary purposes. TAUNTON was advised of his rights, but declined to speak with the FBI Special Agents. TAUNTON did not provide the passcode to his cell phone.

52. In my training and experience, a user can gain access to any social media accounts and/or their Apple or Google cloud storage from a computer or remote device even if the user's phone is seized. Due to the danger of a user “wiping” his/her phone remotely, in order to preserve the data stored on a cellular device after seizure, I attempted to put TAUNTON's phone in “airplane” mode to disrupt any Internet access. By putting a phone in airplane mode and thereby preventing Internet access, the phone and any data stored thereon are prevented from being remotely wiped.

53. I was initially unable to place the cellular device in airplane mode to prevent any remote destruction of potential evidence without inputting the passcode. When airplane mode was initiated, the phone prompted the requirement of a passcode. TAUNTON had previously provided his prior phone's passcode as “4019” during his interview with the FBI in September 2021. I input this prior passcode in an effort to place the current cellular phone into airplane mode and was successful in gaining access to TAUNTON's current phone.

54. While I was navigating to the Settings application to activate airplane mode, I observed the following applications on TAUNTON's phone home pages: Quora, Kik, Instagram, Telegram, Snapchat, Twitter, and WickrMe. Based on the below-signed affiant's experience with this case, and knowledge that several of these were social media platforms used by TAUNTON to distribute, receive, and possess child pornography, there is probable cause to believe that the SUBJECT DEVICE may presently contain evidence of child exploitation crimes. Specifically, the initial information received from FBI Tampa and FBI Knoxville provided that TAUNTON used the Kik application to distribute CSAM. Multiple NCMEC cybertips-including activity as recent as August 2022-were then obtained which reported TAUNTON's use of Instagram and Quora to conduct similar activity. As most of TAUNTON's prior activity involving the sexual exploitation of minors was found to be conducted via his former Apple iPhone device, which remains in the FBI's custody during the ongoing investigation, the presence of these applications (Kik, Instagram, Quora, among others) on TAUNTON's Samsung Galaxy S22 device (SUBJECT DEVICE), along with recent cybertips leading back to TAUNTON, there is probable cause to search for potential new evidence that TAUNTON is continuing to exploit children online through enticement and distribution of child pornography; and using more sophisticated applications which provide encryption and masking of one's communication history and activity.

ELECTRONIC STORAGE AND FORENSIC ANALYSIS

55. Based on my knowledge, training, and experience, I know that electronic devices can store information for long periods of time. Similarly, things that have been viewed via the Internet are typically stored for some period of time on the device. This information can sometimes be recovered with forensics tools.

56. Forensic evidence. As further described in Attachment B, this application seeks permission to locate not only electronically stored information that might serve as direct evidence of the crimes described on the warrant, but also forensic evidence that establishes how the SUBJECT DEVICE was used, the purpose of its use, who used it, and when. There is probable cause to believe that this forensic electronic evidence might be on the SUBJECT DEVICE because:

a. Data on the storage medium can provide evidence of a file that was once on the storage medium but has since been deleted or edited, or of a deleted portion of a file (such as a paragraph that has been deleted from a word processing file).

b. Forensic evidence on a device can also indicate who has used or controlled the device. This “user attribution” evidence is analogous to the search for “indicia of occupancy” while executing a search warrant at a residence.

c. A person with appropriate familiarity with how an electronic device works may, after examining this forensic evidence in its proper context, be able to draw conclusions about how electronic devices were used, the purpose of their use, who used them, and when.

d. The process of identifying the exact electronically stored information on a storage medium that are necessary to draw an accurate conclusion is a dynamic process. Electronic evidence is not always data that can be merely reviewed by a review team and passed along to investigators. Whether data stored on a cellular device is evidence may depend on other information stored on the cellular device and the application of knowledge about how a cellular device behaves. Therefore, contextual information necessary to understand other evidence also falls within the scope of the warrant.

e. Further, in finding evidence of how a device was used, the purpose of its use, who used it, and when, sometimes it is necessary to establish that a particular thing is not present on a storage medium.

57. I know that when an individual uses an electronic device to sexually exploit children online, communicate about child exploitation, and/or trade, distribute, receive, download and/or view child pornography, the individual's electronic device will generally serve both as an instrumentality for committing the crime, and also as a storage medium for evidence of the crime. The electronic device is an instrumentality of the crime because it is used as a means of committing the criminal offense. The electronic device is also likely to be a storage medium for evidence of crime. From my training and experience, I believe that an electronic device used to commit a crime of this type may contain: data that is evidence of how the electronic device was used; data that was sent or received; and other records that indicate the nature of the offense.

a. Nature of examination. Based on the foregoing, and consistent with Federal Rule of Criminal Procedure 41(e)(2)(B), the warrant I am applying for would permit the examination of the device consistent with the warrant. The examination may require authorities to employ techniques, including but not limited to computer-assisted scans of the entire medium, that might expose many parts of the device to human inspection in order to determine whether it is evidence described by the warrant.

b. Manner of execution. Because this warrant seeks only permission to examine a device already in law enforcement's possession, the execution of this warrant does not involve the physical intrusion onto a premises. Consequently, I submit there is reasonable cause for the Court to authorize execution of the warrant at any time in the day or night.

CONCLUSION

58. On the basis of my participation in this investigation and the information summarized above, I have probable cause to believe that the SUBJECT DEVICE maintains evidence, fruits, and instrumentalities of continued violations of 18 U.S.C. §§ 2252(a)(2) and 2252(a)(4)(B). The items listed in Attachment B are evidence of these crimes, contraband, or fruits of these crimes, or property that is or has been used as instrumentalities to commit the foregoing offenses. Therefore, I respectfully request that a warrant be issued that authorizes the search of the SUBJECT DEVICE described in Attachment A and the seizure of the electronically stored items listed in Attachment B. Any electronic devices will be searched pursuant to the protocol and procedures described in Attachment C.

MEREDITH STANGER Special Agent Federal Brueau of Investigation

Sworn to before me over the telephone and signed by me pursuant to Fed.R.Crim.P. 4.1 and 4(d) on this 20th day of December 2022. This application and warrant are to be filed under seal.

ATTACHMENT A

DEVICE TO BE SEARCHED

The SUBJECT DEVICE to be searched is:

Samsung Galaxy S22 Ultra cellular phone

Serial Number: R5CT32150BA

IMEI: 350962370698620

The SUBJECT DEVICE is currently in the custody of the FBI San Francisco Division, Oakland Resident Agency, located at 2101 Webster Street, Suite 400, Oakland, California 94612.

ATTACHMENT B

ITEMS TO BE SEIZED

1. All records on the SUBJECT DEVICE described in Attachment A that relate to violations of 18 U.S.C. §§ 2252(a)(2) and 2252(a)(4)(B) and involve ROBERT D. TAUNTON since September 16, 2021, whether or not contained within third-party applications so long as such items are stored on and accessible on the SUBJECT DEVICE, including:

a. Items, files, records, or information relating to visual depictions of minors engaged in sexually explicit conduct, including erotic fan fiction involving minors;

b. Items, files, records, or information relating to the receipt, distribution, possession, transportation, or production of visual depictions of minors engaged in sexually explicit conduct;

c. Items, files, records, or information concerning communications about the receipt, distribution, possession, transportation, or production of visual depictions of minors engaged in sexually explicit conduct;

d. Items, files, records, or information concerning communications about the sexual abuse or exploitation of minors;

e. Items, files, records, or information concerning communications about the payment or receipt of cash, fund transfers, gifts, remuneration or other items of value related to the above violations;

f. Items, files, records, or information related to communications with or about minors related to the above violations;

g. Items, files, records, or information concerning the identities and contact information (including mailing addresses) of any individuals involved in the receipt, distribution, possession, transportation, or production of visual depictions of minors engaged in sexually explicit conduct, saved in any form;

2. Evidence of user attribution showing who used or owned the SUBJECT DEVICE at the time the things described in this warrant were created, edited, or deleted, such as logs, phonebooks, saved usernames and passwords, documents, and browsing history;

3. Records evidencing the use of third-party applications in order to communicate with minors, transfer obscene material to minors, and/or entice minors to send sexually explicit material;

4. Records evidencing the use of a VPN to mask Internet Protocol (IP) activity in order to communicate via the Internet and/or third-party mobile messaging and social networking applications; and

5. Records evidencing the records of Internet Protocol addresses used and the records of Internet activity, including firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” web pages, search terms that the user entered into any Internet search engine, and records of user-typed web addresses.

As used above, the terms “records” and “information” include all of the foregoing items of evidence in whatever form and by whatever means they may have been created or stored, including any form of cloud storage, computer, or electronic storage (such as flash memory or other media that can store data) and any photographic form.

ATTACHMENT C

PROTOCOL FOR SEARCHING DEVICES OR MEDIA THAT STORE DATA ELECTRONICALLY

1. In executing this warrant, the government will begin by ascertaining whether all or part of a search of a device or media that stores data electronically (“the device”) reasonably can be completed at the location listed in the warrant (“the site”) within a reasonable time. If the search reasonably can be completed on site, the government will remove the device from the site only if removal is necessary to preserve evidence, or if the item is contraband, a forfeitable instrumentality of the crime, or the fruit of a crime.

2. If the government determines that a search reasonably cannot be completed on site within a reasonable time period, the government must determine whether all or part of the authorized search can be completed by making a mirror image of, or in some other manner duplicating, the contents of the device and then conducting the forensic review of the mirror image or duplication off site. The government will complete a forensic review of that mirror image within 120 days of the execution of the search warrant.

3. In a circumstance where the government determines that a mirror image of the contents of a device cannot be created on site in a reasonable time, the government may seize and retain that device for 60 days in order to make a mirror image of the contents of the device.

4. When the government removes a device from the searched premises it may also remove any equipment or documents (“related equipment or documents”) that reasonably appear to be necessary to create a mirror image of the contents of the device or conduct an off-site forensic review of a device.

5. When the government removes a device or related equipment or documents from the site in order to create a mirror image of the device's contents or to conduct an off-site forensic review of the device, the government must file a return with a magistrate judge that identifies with particularity the removed device or related equipment or documents within 14 calendar days of the execution of the search warrant.

6. Within a reasonable period of time, but not to exceed 60 calendar days after completing the forensic review of the device or image, the government must use reasonable efforts to return, delete, or destroy any data outside the scope of the warrant unless the government is otherwise permitted by law to retain such data.

7. The time periods set forth in this protocol may be extended by court order for good cause.

8. In the forensic review of any device or image under this warrant the government must make reasonable efforts to use methods and procedures that will locate and expose those categories of files, documents, or other electronically-stored information that are identified with particularity in the warrant, while minimizing exposure or examination of irrelevant, privileged, or confidential files to the extent reasonably practicable.

9. For the purposes of this search protocol, the phrase “to preserve evidence” is meant to encompass reasonable measures to ensure the integrity of information responsive to the warrant and the methods used to locate same.

WARRANT BY TELEPHONE OR OTHER RELIABLE ELECTRONIC MEANS

To: Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search and seizure of the following person or property located in the Northern District of California (identify the person or describe the property to be searched and give its location)'.

See Attachment A to the Affidavit of Special Agent Meredith Stanger

I find that the affidavit(s). or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (identify the person or describe the property to be seized):

See Attachment B to the Affidavit of Special Agent Meredith Stanger

YOU ARE COMMANDED to execute this warrant on or before 1/3/2023(not to exceed 14 days)

[] in the daytime 6:00 a.m. to 10:00 p.m. [√] at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken.

The officer executing this wan ant. or an officer present during the execution of the warrant. must prepare an inventory as required by law and promptly return this warrant and inventory to Hon. Kandis A. Westmore. (United States Magistrate Judge)

[] Pursuant to 18 U.S.C. § 3103a(b). I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay of trial), and authorize the officer executing this wan ant to delay notice to the person who. or whose property, will be searched or seized (check the appropriate box)

[] for ___ days (not to exceed 30) [] until, the facts justifying, the later specific date of ___.