United States District Court

DISTRICT OF CONNECTICUT

UNITED STATES OF AMERICA

CRIMINAL COMPLAINT
V.
CASE NUMBER:
ALAN HESKETH

I, the undersigned complainant being duly sworn state the following is true and correct to the best of my
knowledge and belief. On or about June 20, 2006 through May 8, 2007 in New London county, in the District
of Connecticut, the defendant did, (Track Statutory Language of Offense)

did knowingly possess and/or receive and/or distribute material containing images of child pornography as that term
is defined in Title 18, United States Code, Section 2256(8)(A), each image containing visual depictions of a minor
engaged in sexually explicit conduct, which had each been mailed, shipped or transported in interstate or foreign
commerce by any means, including by computer, and were produced with materials that had been mailed, shipped
or transported in interstate and foreign commerce by any means, including by computer

in violation of Title 18, United States Code, Sections 2252 and 2252A.

I further state that I am a(n) Special Agent of the Department of Homeland Security, ICE and that this complaint
is based on the following facts:

See Attached Affidavit

Continued on the attached sheet and made a part hereof. T Yes No

Signature of Complainant
Jason P. Dragon, Special Agent
Dept. of Homeland Security, ICE

March 26, 2008 at Hartford, Connecticut

Date City and State
Sworn to before me, and subscribed in my presence
Hon. Donna F. Martinez
U.S. Magistrate Judge
Signature of Judicial Officer
Name and Title of Judicial Officer
STATE OF CONNECTICUT :
:
: ss: Hartford, Connecticut
:
COUNTY OF Hartford : March 26, 2008

AFFIDAVIT

I, Jason P. Dragon, being duly sworn, depose and state the

following:

1. I am a Special Agent with the United States Immigration

& Customs Enforcement (ICE) under the Department of Homeland

Security and have been so employed since September 2005. I am

currently assigned to the Hartford, Connecticut resident agency

(RAC Hartford), where I am responsible for investigating, among

other things, child pornography cases. I am a graduate of the

Federal Law Enforcement Training Center’s Criminal Investigator

Training Program and the ICE Special Agent Training Academy,

where I received training with regard to conducting

investigations involving violations of federal law. Prior to my

current position, from December 2000 to September 2005, I was

employed by the Connecticut State Police as a Connecticut State

Trooper. From January 1999 till November 2000, I served as a

United States Border Patrol Agent in Laredo, Texas. As part of

my duties as an ICE agent, I investigate criminal violations

relating to child exploitation and child pornography, including

violations pertaining to the production, distribution, receipt

and possession of child pornography, in violation of 18 U.S.C. §§

2252(a) and 2252A. I have received training in the area of child

pornography and child exploitation at the Federal Law Enforcement

Training Center in Glynco, Georgia, and have had the opportunity

to observe and review numerous examples of child pornography (as

defined in 18 U.S.C. § 2256) in all forms of media including

computer media. As part of my experience, I have drafted and

participated in the execution of numerous child pornography

search warrants.

2. I am an investigative or law enforcement officer of the

United States within the meaning of 18 U.S.C. § 3061, and am

empowered by law to conduct investigations and to make arrests

for offenses enumerated in 18 U.S.C. §§ 2252, 2252A, and other

federal offenses.

3. I am presently investigating the activities of ALAN

HESKETH, d/o/b December 20, 1946, a citizen and national of the

United Kingdom, who is a lawful permanent resident of the United

States. HESKETH currently resides at [*** Redacted ***] Avenue,

Stonington, CT 06387. I submit this affidavit in support of a

request for a criminal complaint and warrant to arrest ALAN

HESKETH for violations of Title 18 U.S.C. §§ 2252(a)(4)(B) and

2252A(a)(5)(B), which make it a crime to possess child

pornography, and violations of 18 U.S.C. §§ 2252(a)(2) and

2252A(a)(2), which make it a crime to receive and distribute

child pornography in interstate commerce by computer.

4. This Affidavit is additionally made in support of an

2
application for a warrant to search HESKETH’S home located at [**

Redacted **] Avenue, Stonington, CT 06387 (the “Subject Premises”).

The Subject Premises to be searched is further described as a

one-family house set back approximately one hundred yards from

the roadway. The Subject Premises faces in a westerly direction.

The front of the Subject Premises consists of tan, wood siding,

with a small out-cove on the south end of the residence that has

a gray, field stone exterior. There is a large, white porch

located on the front of the Subject Premises. On a white post

attached to the front of the porch, facing the roadway, are the

numbers [Redacted] To the left of the Subject Premises is the lone

driveway for the residence. At the beginning of the driveway, and

all along the front of the residence, is a field stone wall. A

picture of the Subject Premises is attached to this affidavit as

Attachment A-1. The purpose of the application for a search and

seizure warrant for the subject premises is to search for and

seize fruits, instrumentalities, evidence and contraband

regarding violations of 18 U.S.C. §§ 2252(a)(4)(B) and

2252A(a)(5)(B) of 18 U.S.C. §§ 2252(a)(2) and 2252A(a)(2).

5. I am familiar with the information contained in this

Affidavit based upon the investigation I have conducted and based

on my conversations with other law enforcement officers who have

engaged in numerous investigations involving child pornography.

Because this Affidavit is being submitted for the limited purpose

3
of securing a criminal complaint, arrest warrant and search

warrant, I have not included each and every fact known to me

concerning this investigation. I have set forth only those facts

that I believe are necessary to establish probable cause to

support the request for criminal complaint, arrest warrant and

search warrant. As a result of this investigation, which is

described more fully below, there is probable cause to believe,

and I do believe, that evidence, fruits, contraband and

instrumentalities of violations of the federal laws set forth

above are present at the Subject Premises.

THE INTERNET AND TECHNICAL TERMS PERTAINING TO COMPUTERS

6. This investigation has revealed that an individual

employing the Google “Hello” screen name “Suzybibaby”,

subsequently identified as ALAN HESKETH has distributed images of

child pornography via the internet.

7. As part of my training, I have become familiar with the

Internet (also commonly known as the World Wide Web), which is a

global network of computers and other electronic devices that

communicate with each other using various means, including

standard telephone lines, high-speed telecommunications links

(e.g., copper and fiber optic cable), and wireless transmissions

including satellite. Due to the structure of the Internet,

connections between computers on the Internet routinely cross

state and international borders, even when the computers

4
communicating with each other are in the same state.

Individuals and entities use the Internet to gain access to a

wide variety of information; to send information to, and receive

information from, other individuals; to conduct commercial

transactions; and to communicate via electronic mail (“e-mail”).

An individual who wants to use Internet e-mail must first obtain

an account with a computer that is linked to the Internet – for

example, through a commercial service, such as America On Line

(“AOL”) – which is called an “Internet Service Provider” (“ISP”).

Once the individual has accessed the Internet, that individual

can use Internet mail services, including sending and receiving

e-mail. In addition, the individual can visit websites and make

purchases from them.

8. Set forth below are some definitions of technical

terms, some of which may be used throughout this Affidavit, and

in Attachments A and B hereto, pertaining to the Internet and

computers in general.

a. Client/Server Computing: Computers on the Internet are

identified by the type of function they perform. A computer that

provides resources for other computers on the Internet is known

as a server. Servers are known by the types of service they

provide - that is - how they are configured. For example, a web

server is a computer that is configured to provide web pages to

other computers requesting them. An e-mail server is a computer

5
that is configured to send and receive electronic mail from other

computers on the Internet. A client computer is a computer on

the Internet that is configured to request information from a

server. If a client computer is configured to browse web pages

and has web page browsing software installed, it is considered a

web client.

b. Computer system and related peripherals, and computer

media: The terms “computer system and related peripherals, and

computer media” refer to tapes, cassettes, cartridges, streaming

tape, commercial software and hardware, computer disks, disk

drives, thumb drives, other electronic storage media, monitors,

computer printers, modems, tape drives, disk application

programs, data disks, system disk operating systems, magnetic

media floppy disks, hardware and software operating manuals, tape

systems and hard drives and other computer-related operation

equipment, digital cameras, scanners, in addition to computer

photographs, Graphic Interchange formats and/or photographs, and

other visual depictions of such Graphic Interchange formats,

including, but not limited to, JPG, GIF, TIF, AVI, and MPEG.

c. Domain Name: Domain names are common, easy to remember

names associated with an Internet Protocol address. For example,

a domain name of “www.usdoj.gov” refers to the Internet Protocol

address of 149.101.1.32. Domain names are typically strings of

alphanumeric characters, with each level delimited by a period.

6
Each level, read backwards – from right to left – further

identifies parts of an organization. Examples of first level, or

top-level domains are typically “.com” for commercial

organizations, “.gov” for the United States government, “.org”

for organizations, and, “.edu” for educational organizations.

Second level names will further identify the organization, for

example “usdoj.gov” further identifies the United States

governmental agency to be the Department of Justice. Additional

levels may exist as needed until each machine is uniquely

identifiable. For example, “www.usdoj.gov” identifies the world

wide web server located at the U.S. Department of Justice, which

is part of the United States government.

d. Internet Service Providers (ISPs) and the Storage of

ISP Records: Internet Service Providers are commercial

organizations, such as AOL, that are in business to provide

individuals and businesses access to the Internet. ISPs provide

a range of services for their customers, including access to the

Internet, web hosting, e-mail, remote storage, and co-location of

computers (defined below) and other communications equipment.

ISPs can offer a range of options in providing access to the

Internet, including telephone based dial-up, broadband based

access via digital subscriber line (DSL) or cable modems,

dedicated circuits, or satellite based subscription. ISPs

typically charge a fee based upon the type of connection and

volume of data, called bandwidth, that the connection supports.

7
Many ISPs assign each subscriber an account name, that is, a user

name or screen name, as well as an “e-mail address,” an e-mail

mailbox, and a personal password selected by the subscriber. By

using a computer equipped with a telephone or cable modem, the

subscriber can establish communication with an ISP over a

telephone line or through a cable system, and can access the

Internet by using his or her account name and personal password.

ISPs maintain records (“ISP records”) pertaining to their

subscribers (regardless of whether those subscribers are

individuals or entities). These records may include account

application information, subscriber and billing information,

account access information (often times in the form of log

files), e-mail communications, information concerning content

uploaded and/or stored on or via the ISP’s servers, and other

information, which may be stored both in computer data format and

in written or printed record format. ISPs reserve and/or

maintain computer disk storage space on their computer system for

their subscribers’ use. This service by ISPs allows for both

temporary and long-term storage of electronic communications and

many other types of electronic data and files. Typically, e-mail

that has not been opened by an ISP customer is stored temporarily

by an ISP incident to the transmission of that e-mail to the

intended recipient, usually within an area known as the home

directory or mailbox. Such temporary, incidental storage is

defined by statute as “electronic storage,” see 18 U.S.C. §

8
2510(17), and the provider of such a service is an “electronic

communications service.” An “electronic communications service”

is defined by statute as “any service which provides to users

thereof the ability to send or receive wire or electronic

communications.” See 18 U.S.C. § 2510(15). An ISP that is

available to the public and provides storage facilities after an

electronic communication has been transmitted and opened by the

recipient, or provides other long term storage services to the

public for electronic data and files, is defined by statute as

providing a “remote computing service.” 18 U.S.C. § 2711(2).

e. Internet Protocol Address (IP Address): Every computer

or device on the Internet is referenced by a unique Internet

Protocol address, much the same way every telephone has a unique

telephone number or a home has a unique street address. An IP

address is a series of four numbers separated by a period, and

each number is a whole number between 0 and 254. An example of

an IP address is 192.168.10.102. Each time an individual

accesses the Internet, the computer from which that individual

initiates access is assigned an IP address. A central authority

provides each ISP a limited block of IP addresses for use by that

ISP’s customers or subscribers. Some ISPs, primarily those with

dial-up or digital subscriber lines, employ dynamic IP addressing

- that is - they allocate any unused IP address at the time of

initiation of an Internet session each time a customer or

subscriber accesses the Internet. A dynamic IP address is

9
reserved by an ISP to be shared among a group of computers over a

period of time. The ISP logs the date, time, and duration of the

Internet session for each IP address and can identify the user of

that IP address for such a session from these records.

Typically, users who sporadically access the Internet via a

dial-up modem will be assigned an IP address from a pool of IP

addresses for the duration of each dial-up session. Once the

session ends, the IP address is available for the next dial-up

customer. On the other hand, some ISP’s, primarily some cable

providers, employ static IP addressing - that is, a customer or

subscriber’s computer is assigned one IP address that is used to

identify each and every Internet session initiated through that

computer. In other words, a static IP address is an IP address

that does not change over a period of time and is typically

assigned to a specific computer.

f. Log File: Log files are records automatically produced

by computer programs to document electronic events that occur on

computers. Computer programs can record a wide range of events

including remote access, file transfers, logon/logoff times, and

system errors. Logs are often named based on the types of

information they contain. For example, “web logs” contain

specific information about what websites were accessed by remote

computers and when the website was accessed; “access logs” list

specific information about when a computer was accessed from a

remote location; and “file transfer logs” list detailed

10
information concerning files that are remotely transferred.

g. Modem: A modem is an electronic device that allows one

computer to communicate with another.

h. Trace Route: A trace route is an Internet debugging

tool used to document the list of inter-connected computers

between two computers on the Internet. A trace route will list

the names and IP addresses of computers that provide the physical

link between two computers on the Internet. Trace routes are

useful tools to help geographically identify where a computer on

the Internet is physically located, and usually includes

information about the registered owner of computers on the

Internet.

i. Universal Resource Locator (URL): A URL is the unique

address for a file that is accessible on the Internet. For

example, a common way to get to a website is to enter the URL of

the website’s home page file in the Web’s browser address line.

Additionally, any file within that website can be specified with

a URL. The URL contains the name of the protocol to be used to

access the file resource, a domain name that identifies the

specific computer on the Internet, and a pathname, a hierarchical

description that specifies the location of a file in that

computer.

j. Website: A website consists of textual pages of

information and associated graphic images. The textual

11
information is stored in a specific format known as Hyper-Text

Mark-up Language (HTML) and is transmitted from the web servers

to various web clients via Hyper-Text Transport Protocol (HTTP).

k. Website Hosting: Website hosting provides the

equipment and services required to host and maintain files for

one or more websites and to provide rapid Internet connections to

those websites. Most hosting is “shared,” which means that

multiple websites of unrelated companies are on the same server

in order to reduce associated costs. When a client, meaning a

person or company, develops a website, the client needs a server

and perhaps a web hosting company to host it. “Dedicated

hosting” means that the web hosting company provides all of the

equipment and assumes all of the responsibility for technical

support and maintenance of a website. “Co-location” means a

server is located at a dedicated hosting facility designed with

special resources, such as a secure cage, regulated power,

climate control, a dedicated Internet connection, online security

and online technical support. Co-location facilities offer

customers a secure place to physically house their hardware and

equipment as opposed to keeping it in their offices or warehouse,

where the potential for fire, theft, or vandalism is greater.

l. THE GOOGLE “HELLO” PROGRAM: Google’s “Hello” software

program allows individuals on the Internet to share digital

pictures. The Hello program lets traders connect directly (peer-

to-peer) to each other’s computers specifically for the purpose

12
of sharing pictures. Movie files may also be shared but in a

limited fashion. Since the connection is peer-to-peer, there is

no limit to the number and size of pictures that may be shared.

Once a connection is created, the individuals simply select the

pictures they wish to share. This may be an individual picture

or a folder containing thousands of pictures. While connected,

the individuals may also engage in chat conversations. All

pictures and chats are encrypted during the transmission by the

software. This overcomes the traditional limitation of peer-to-

peer software by facilitating both live chat and exchange of

large volumes of files simultaneously. The encription also makes

it highly difficult, if not impossible, for persons who are not

party to the peer-to-peer connection to discovering which

information and materials are being shared.

Information contained within the “How it works” section of

the Hello website describes the Hello computer program in part as

follows: (As of May 15, 2007)

Hello is a new program that lets you connect

directly with your friends to share your digital
pictures. If you’ve used an instant messenger program
before, you’ve already got the idea. Hello is special
because it lets you share pictures along with your
messages.

Hello is designed to let you send high-quality pictures

instantly and securely over any speed connection, even
dial-up. With Hello, you can send hundreds of high
quality pictures to your friends in just seconds - you
can’t do that with e-mail.

When you share pictures with Hello, you get feedback

from your friends right away. Also, Hello
13
 automatically encrypts all your pictures and chat
before sending, so it’s safer and more secure than e-
mail.

When you use Hello to share pictures they arrive on

your friend’s screen immediately, without the hassle of
uploading them to public websites. Your friends can
download print quality copies of their favorite
pictures to print right at home, which most “picture
sharing” websites won’t let you do.

Information contained within the “Security Information”

section of the Hello website, under the header “How this program

protects your information,” further describes the Hello computer

program in part as follows:

Hello is a peer-to-peer program (p2p). This means that

your computer is directly connected with other
computers (similar to how popular file trading programs
work). However, you will only be connected with the
people you approve: you grant authorization to only the
users you choose. No one can get your pictures without
your permission.

Like e-mail, any pictures that you have shared in Hello

can be saved and forwarded by the people you share them
with.

You connect with our servers during login and during

chat sessions. After you’ve successfully shared an
image with someone, you are directly connected to that
person for the rest of your session together.

Hello protects you from viruses by automatically

confirming that all JPG files are valid pictures before
allowing them to be traded.

In order to use the Hello program, each user must have

access to a computer, which communicates on the Internet through

a modem connected to a telephone line or other high-speed

telecommunications. Each user must then download and install the

14
Hello program. During the download and installation process, the

user must set up their account via the “Hello” website. The user

is asked to create the following information: User name or

“handle,” e-mail address, and password. The user is then given

access to download the installation file. Google sends a

verification e-mail to the e-mail address provided during the

registration. The user is instructed to open the e-mail and click

on an embedded link to verify the e-mail address. Google stores

this information on its servers in Mountain View, California.

Each account will also have a unique User Identification number

(UID) assigned by the Hello software.

Once the software is installed, each user may access the

“Options and Preferences” section of the software and review or

change any preferences that were selected during installation.

Some of these options include: remember my password,

automatically log in, launch Hello when Windows starts, save chat

to history, automatically save all received pictures and the

location of the full file path where Hello automatically saves

all received pictures. All the above preferences are

automatically selected during install unless the user manually

unselects an individual preference.

After a computer user downloads and installs the Hello

application on their computer, the Hello program creates a series

of directories. These directories and their structure on the

computer are used for organizing, recording and maintaining chat

15
records, shared images, “friends lists” and “thumbnails” or

reduced versions of the images that were transmitted or received.

Each time the user joins a chat with another Hello user, the

directory structure grows to accommodate the records of the chats

with each new user. On newer computers that utilize the Microsoft

Windows 2000 or Windows XP operating systems, these directories,

by default, are found within the computer user’s Documents and

Settings directory.

COMPUTERS AND CHILD PORNOGRAPHY

9. Based upon my knowledge, training, and experience in

child exploitation and child pornography investigations, and the

experience and training of other law enforcement officers with

whom I have worked and had discussions, computers and computer

technology have revolutionized the way in which child pornography

is produced, distributed, and utilized. Prior to the advent of

computers and the Internet, child pornography was produced using

cameras and film, resulting in either still photographs or

movies. The photographs required darkroom facilities and a

significant amount of skill in order to develop and reproduce the

images. As a result, there were definable costs involved with

the production of images. To distribute these images on any

scale also required significant resources. The photographs

themselves were somewhat bulky and required secure storage to

prevent their exposure to the public. The distribution of child

pornography was accomplished through a combination of personal

16
contacts, mailings, and telephone calls, and compensation for

these wares would follow the same paths. More recently, through

the use of computers and the Internet, distributors of child

pornography use membership and subscription-based websites to

conduct business, allowing them to remain relatively anonymous.

10. In addition, based upon my own knowledge, training, and

experience in child exploitation and child pornography

investigations, and the experience and training of other law

enforcement officers with whom I have worked and had discussions,

the development of computers has also revolutionized the way in

which those who seek out child pornography are able to obtain

this material. Computers serve four basic functions in

connection with child pornography: production, communication,

distribution, and storage. More specifically, the development of

computers has changed the methods used by those who seek to

obtain access to child pornography in these ways:

a. Producers of child pornography can now produce both still

and moving images directly from a common video or digital camera.

The camera is attached, using a device such as a cable, or

digital images are often uploaded from the camera’s memory card

directly to the computer. Images can then be stored,

manipulated, transferred, or printed directly from the computer.

Images can be edited in ways similar to how a photograph may be

altered. Images can be lightened, darkened, cropped, or

otherwise manipulated. The producers of child pornography can

17
also use a device known as a scanner to transfer photographs into

a computer-readable format. As a result of this technology, it

is relatively inexpensive and technically easy to produce, store,

and distribute child pornography. In addition, there is an added

benefit to the pornographer in that this method of production

does not leave as large a trail for law enforcement to follow.

b. As described above, the Internet allows virtually any

computer to connect to any other computer. By connecting to a

host computer, electronic contact can be made to literally

millions of computers around the world. As noted above, a host

computer is one that is attached to a network and serves many

users. Host computers are sometimes operated by commercial ISPs,

such as America Online ("AOL") and Microsoft, which allow

subscribers to dial a local number or otherwise directly connect

to a network through a cable modem which is, in turn, connected

to the host systems. Host computers, including ISPs, allow

e-mail service between subscribers and between their own

subscribers and those of other networks. In addition, these

service providers act as a gateway for their subscribers access

the Internet.

c. The Internet allows users, while still maintaining

virtual anonymity, to easily locate (i) other individuals with

similar interests in child pornography; and (ii) websites that

offer images of child pornography. Those who seek to obtain

images or videos of child pornography can use standard Internet

18
connections, such as those provided by businesses, universities,

and government agencies, to communicate with each other and to

distribute or receive child pornography. These communication

links allow contacts around the world as easily as calling next

door. Additionally, these communications can be quick,

relatively secure, and as anonymous as desired. All of these

advantages, which promote anonymity for both the distributor and

recipient, are well known and are the foundation of transactions

involving those who wish to gain access to child pornography over

the Internet. Sometimes the only way to identify both parties

and verify the transportation of child pornography over the

Internet is to examine the recipient’s computer, including the

Internet history and cache to look for “footprints” of the

websites and images accessed by the recipient.

d. The computer’s capability to store images in digital

form also makes it an ideal repository for child pornography. A

single floppy or compact disk can store dozens of images and

hundreds of pages of text. The size of the electronic storage

media (commonly referred to as a hard drive) used in home

computers has grown tremendously within the last several years.

Hard drives with the capacity of hundreds of gigabytes are

common. These drives can store thousands of images at very high

resolution. Magnetic storage located in host computers adds

another dimension to the equation. It is possible to use a video

camera to capture an image, process that image in a computer with

19
a video capture device, and save that image to storage in another

country. Once this is done, there is no readily apparent

evidence at the “scene of the crime.” Only with careful

laboratory examination of electronic storage devices is it

possible to recreate the evidence trail.

11. Computer files or remnants of such files can be

recovered months or even years after they have been downloaded

onto a hard drive, deleted, or simply viewed via the Internet.

Electronic files downloaded to a hard drive or other media can be

stored for years at little to no cost. Even when such files have

been deleted, they can be recovered months or years later using

readily-available forensic tools. When a person “deletes” a file

on a home computer, the data contained in the file does not

actually disappear; rather, that data remains on the hard drive

until it is overwritten by new data. Therefore, deleted files,

or remnants of deleted files, may reside in free space or slack

space – that is, in space on the hard drive that is not allocated

to an active file or that is unused after a file has been

allocated to a set block of storage space – for long periods of

time before they are overwritten. In addition, a computer’s

operating system may also keep a record of deleted data in a

“swap” or “recovery” file. Similarly, files that have been

viewed via the Internet are automatically downloaded into a

temporary Internet directory or cache. The browser typically

maintains a fixed amount of hard drive space devoted to these

20
files, and the files are only overwritten as they are replaced

with more recently viewed Internet pages. Thus, the ability to

retrieve residue of an electronic file from a hard drive depends

less on when the file was downloaded or viewed than on a

particular user’s operating system, storage capacity, and

computer habits. As noted, it is not at all uncommon to recover

files deleted months or years before.

CHARACTERISTICS OF CHILD PORNOGRAPHY COLLECTORS

12. Based upon my knowledge, experience and training, and

in particular my training and experience in child exploitation

and child pornography investigations, and the training and

experience of other law enforcement officers with whom I have

worked and had discussions, there are certain commonalties

between individuals involved in the receipt and collection of

child pornography:

A. Child pornography collectors may receive sexual

gratification, stimulation and satisfaction from contact with

children; or from fantasies they may have viewing children

engaged in sexual activity or in sexually suggestive poses, such

as in person, in photographs, or other visual media; or from

literature describing such activity.

B. Collectors of child pornography collect sexually

explicit or suggestive materials, such as hard- and soft-core

pornography, whether of adults or of children, in a variety of

media, including photographs, magazines, motion pictures, video

21
tapes, books, slides and/or drawings or other visual media.

Child pornography collectors then use these materials for their

own sexual arousal and gratification. Further, they commonly use

these materials to lower the inhibitions of children they are

attempting to seduce, to arouse the selected child partner, or to

demonstrate the desired sexual acts.

C. Collectors of child pornography almost always

possess and maintain their “hard copy” child pornographic

material, that is, their pictures, films, video tapes, magazines,

negatives, photographs, correspondence, mailing lists, books,

tape recordings, child erotica, etc., in the privacy and security

of their home and/or some other secure location. Child

pornography distributors and collectors typically retain

pictures, films, photographs, negatives, magazines,

correspondence, books, tape recordings, mailing lists, child

erotica, and video tapes for many years.

D. Child pornography collectors maintain their

computer collections in a safe, secure environment, such as a

computer and surrounding area, because this material is illegal,

difficult to obtain and obtained at great risk, and difficult to

replace. These collections are maintained for years and are kept

close by, usually at the collector’s residence, to enable the

collector to view the collection, which is valued highly.

E. Child pornography collectors often correspond with

and/or meet others to share information and materials.

22
Collectors of child pornography frequently save correspondence

from other child pornography distributors/collectors. These

collectors will conceal such correspondence as they do their

sexually explicit material. Often, collectors will also maintain

lists of names, addresses, and telephone numbers of individuals

with who they have been in contact and who share the same

interests in child pornography.

F. Collectors of child pornography prefer not to be

without their child pornography and/or child erotica for any

prolonged time period. This behavior has been documented by law

enforcement officers involved in the investigation of child

pornography throughout the world.

OVERVIEW OF THE SAC BUFFALO INVESTIGATION

13. In June 2007, the Immigration and Customs Enforcement,

Office of the Special Agent-In-Charge, Buffalo, NY (SAC Buffalo)

began an investigation into the suspected sharing and receiving

of images of child pornography, via the Google “Hello” file

sharing program, by Gregory Nadolski. On June 11, 2007, SAC

Buffalo Special Agents executed a federal search warrant at

Nadolski’s residence, located at [***Redacted***], Buffalo, New

York 14206. Pursuant to the search warrant, SAC Buffalo Special

Agents seized two computers that belonged to Nadolski. In

addition, during the search warrant, SAC Buffalo Special Agents

conducted a consensual interview with Nadolski. Based on the

initial interview, Nadolski admitted to the possession of images

23
of child pornography on his personal computer, and he admitted to

trading images of child pornography via the Internet, more

specifically using the Google “Hello” program with the screen

name “mrko9850.”

14. A forensic analysis of Nadolski’s computer, completed by

an ICE Computer Forensics Special Agent in Buffalo, confirmed

that Nadolski used the Google “Hello” file-sharing program to

transmit and receive images of child pornography. Among other

chats recovered from the search, there were approximately twenty-

seven (27)“Hello” chat logs between the screen names “mrko9850”

and “Suzybibaby” between the time period of June 20, 2006 and May

12, 2007. The recovered chat logs revealed sexually explicit

conversations, wherein “mrko9850” (Nadolski) and “Suzybibaby”

discussed, among other things, the sexual molestation of children

involving the use of human defacation. In addition, “mrko9850”

and “Suzybibaby” shared over one thousand images, many of which

were believed by the Buffalo agents to be images of child

pornography.

15. The screen name “Suzybibaby” corresponds to the Google

User Identification (UID) Number 1170751, which was depicted on

each recovered chat log. A Customs administrative summons to

Google for information related to UID #1170751 revealed the

following:

USERID: 1170751
Username: Suzybibaby
24
 Email: suzybibaby@yahoo.com
Affiliate: Hello
Track: <default>
Registered: Thursday, March 3, 2005
Last Login: Monday, October 8, 2007 @ 7:57:53PM

16. Google also provided the Internet Protocol (IP)

addresses used to access the account for the time period April

16, 2007 to October 8, 2007. During this time period, the records

indicate that the account was accessed numerous times from

approximately thirteen (13) different IP addresses. However, out

of the thirteen (13)identified IP addresses, the account was

accessed approximately thirty-four (34) times from an IP address

identified as 71.235.8.170. According to an American Registry for

Internet Numbers (ARIN WHOIS) database query, the aforementioned

IP address was registered to Comcast Cable Communications, Inc.

17. On December 10, 2007 a Customs administrative summons

was sent to Comcast Cable Communications for the records that

relate to the IP address 71.235.8.170. On December 12, 2007,

Comcast complied with the summons and the results indicated the

following:

Subscriber Name: ALLAN HESKETH

Address: [**Redacted**] Avenue
Stonington, CT 06378
(This address is the
subscriber’s service address)
Telephone #: 860-[**Redacted**]
Type of Service: Residential High Speed
Internet Service
Account Status: Active
Account Created: 02/16/2004
Account Number: [**Redacted**]
E-mail User Ids: ahesketh1
25
 (all Comcast User ID’s end in
@Comcast.net)
IP Assignment: Dynamically Assigned
Current IP Address: 71.235.8.170 on December 12,
2007
Method of Payment: Statement sent to above
address
(No credit card numbers or
bank account numbers on file)

18. Upon determining that the subscriber to the Google

Hello screen name “Suzybibaby” may reside in the ICE, Resident

Agent In Charge, Hartford, CT (RAC Hartford) area of

responsibility, SAC Buffalo compiled the information gained

through their investigative efforts and forwarded that to RAC

Hartford. The compiled information was forwarded in the form of a

compact disk containing the recovered chat logs and the

corresponding images of child pornography, as well as copies of

the subpoena results and open source database queries.

26
 The Hartford, CT Investigation

20. On February 22, 2008, RAC Hartford SA Jason P. Dragon

received the information collected by SAC Buffalo. Upon receipt

of the information SA Dragon conducted a review of the CD

containing the chat logs and images. There were twenty-seven

(27) chat logs found on the CD, wherein “mrko9850” and

“Suzybibaby” traded approximately 1067 images, most of which, in

my opinion, based on my experience and training, depicted

prepubescent minors naked, lasciviously displaying their

genitalia, or engaged in sexual contact with an adult. A review

of the content of the chat logs revealed that “Suzybibaby” posed

as a single, twenty-eight (28) year old female with an interest

in images of child pornography, more specifically human

defecation on “babies” and the desire to pose as “a 5 yr old

slut that you can rape, piss and shit on and drown.” At various

times within the twenty-seven chat logs, “mrko9850” and

“Suzybibaby” discussed the sexual molestation and abuse of

“babies.” An example of this conversation occurred on September

4, 2006, when “mrko9850” asked “Suzybibaby” if she had a

daughter “would she fuck her constantly?” Wherein “Suzybibaby”

replied, “I would just use her and abuse her... pull her legs

apart... cut her cunt bigger.”

21. Copies of a computer disc containing the images and

video files specifically described in Paragraph 20, above, was

made available for review as an attachment to this affidavit.

27
The disc will remain in a sealed envelope further identified as

Exhibit C to this affidavit and will remain in the custody of

ICE until further order of this Court.

22. The following is the text portion of a chat log dated

April 24, 2007 between 12:57:36am(pst) and 02:35:10am(pst):

Hello with Friend Suzybibaby (UID: 1170751)

4/24/2007 12:57:36 AM - 4/24/2007 2:35:10 AM

4/24/2007 12:57:36 AM mrko9850: hey

4/24/2007 12:58:15 AM Suzybibaby: Hi there
4/24/2007 12:58:18 AM mrko9850 is sending 8 pictures.
4/24/2007 12:58:28 AM mrko9850: here's some pics you like to
start you out ;(
4/24/2007 12:58:29 AM mrko9850: ;)
4/24/2007 1:00:05 AM Suzybibaby: mmmmmmmmmmmmmm
4/24/2007 1:00:09 AM Suzybibaby: lovely
4/24/2007 1:00:46 AM Suzybibaby is sending 21 pictures.
4/24/2007 1:03:00 AM mrko9850: mmmmmm
4/24/2007 1:03:19 AM mrko9850: so you ate baby shit right?
4/24/2007 1:03:25 AM Suzybibaby: yup
4/24/2007 1:04:14 AM Suzybibaby: I would love to bury my face
in baby shit
4/24/2007 1:04:15 AM mrko9850: fucking hot
4/24/2007 1:05:12 AM Suzybibaby: and let you piss on me while
I did it
4/24/2007 1:05:18 AM mrko9850 is sending 8 pictures.
4/24/2007 1:05:22 AM mrko9850: mmmm
4/24/2007 1:05:48 AM mrko9850: here's me
4/24/2007 1:06:47 AM Suzybibaby: nice
4/24/2007 1:07:22 AM Suzybibaby is sending 11 pictures.
4/24/2007 1:07:41 AM mrko9850: mmmmm babys are hot
4/24/2007 1:08:13 AM Suzybibaby: I think so too
4/24/2007 1:08:23 AM mrko9850: you licked the pussy right?
4/24/2007 1:08:26 AM mrko9850: on a baby girl?
4/24/2007 1:08:33 AM Suzybibaby is sending 12 pictures.
4/24/2007 1:16:08 AM mrko9850: you on?
4/24/2007 1:16:22 AM Suzybibaby: yes, back
4/24/2007 1:16:38 AM mrko9850 is sending 11 pictures.
4/24/2007 1:24:44 AM mrko9850: how did the baby shit taste?
4/24/2007 1:25:52 AM Suzybibaby: so dirty and sexy
4/24/2007 1:26:16 AM Suzybibaby is sending 10 pictures.
4/24/2007 1:26:53 AM mrko9850: mmmm
28
4/24/2007 1:27:14 AM mrko9850: it tasted so good you couldn't
live without it?
4/24/2007 1:27:28 AM mrko9850: or I shoudl say it stunk so bad
you loved it?
4/24/2007 1:27:35 AM mrko9850: and couldnt livewithout it?
4/24/2007 1:27:58 AM Suzybibaby: thats about it
4/24/2007 1:28:27 AM mrko9850: does it ever make you gag?
4/24/2007 1:28:42 AM Suzybibaby: often
4/24/2007 1:28:46 AM Suzybibaby: and puke
4/24/2007 1:28:50 AM Suzybibaby: but thats ok
4/24/2007 1:29:01 AM mrko9850: did the baby shit stink really
bad?
4/24/2007 1:30:19 AM mrko9850: did it stink?
4/24/2007 1:30:39 AM Suzybibaby: some does....some is sweet
4/24/2007 1:30:56 AM mrko9850: did you rub it all over you?
4/24/2007 1:31:32 AM Suzybibaby: yes....mainly on my face and
pussy
4/24/2007 1:35:20 AM mrko9850: did you kiss her on th e lips
with shit in your mouth?
4/24/2007 1:35:48 AM Suzybibaby: ytessssssssss
4/24/2007 1:36:55 AM mrko9850: how old was the baby?
4/24/2007 1:37:23 AM Suzybibaby: 6 months
4/24/2007 1:37:52 AM mrko9850: did you rub shit all ove the
baby too?
4/24/2007 1:40:17 AM Suzybibaby: yes
4/24/2007 1:43:44 AM mrko9850: then lick it all off?
4/24/2007 1:47:41 AM mrko9850: did you?
4/24/2007 1:49:56 AM mrko9850: you there babe?
4/24/2007 1:53:21 AM mrko9850 is sending 2 pictures.
4/24/2007 1:54:33 AM mrko9850: would you like seeing it?
4/24/2007 1:54:56 AM Suzybibaby: Hello...sorry...back now
4/24/2007 1:54:58 AM mrko9850: ok
4/24/2007 1:55:03 AM mrko9850: so did you lick all the shit
off?
4/24/2007 1:55:03 AM Suzybibaby: I have been chatting
4/24/2007 1:55:07 AM Suzybibaby: oh yes
4/24/2007 1:55:09 AM mrko9850: its ok
4/24/2007 1:55:46 AM mrko9850: did you give her some of your
shit?'
4/24/2007 1:56:09 AM Suzybibaby: no, but I'd love to
4/24/2007 1:57:29 AM mrko9850: did you puke on her?
4/24/2007 1:57:40 AM Suzybibaby: yes...I love doing that
4/24/2007 1:58:02 AM mrko9850: did the baby cry?
4/24/2007 1:58:12 AM Suzybibaby: whimpered
4/24/2007 1:58:58 AM mrko9850: did you eat the puk off of her?
4/24/2007 2:00:18 AM Suzybibaby: yesssssssss

29
4/24/2007 2:00:22 AM Suzybibaby: lick lick
4/24/2007 2:00:32 AM Suzybibaby: I want baby puke on me
4/24/2007 2:00:37 AM mrko9850: mmmm
4/24/2007 2:01:27 AM Suzybibaby: baby puke and shit in my
mouth
4/24/2007 2:01:54 AM mrko9850: do you have a pic of you?
4/24/2007 2:03:37 AM Suzybibaby: yes a few
4/24/2007 2:03:47 AM mrko9850: could I see?
4/24/2007 2:04:00 AM Suzybibaby is sending 1 picture.
4/24/2007 2:04:56 AM mrko9850: yoru hot
4/24/2007 2:04:56 AM mrko9850: mmmm
4/24/2007 2:05:04 AM Suzybibaby: tks
4/24/2007 2:05:04 AM mrko9850: I would love to see shit on
your mouth
4/24/2007 2:05:16 AM Suzybibaby: oh yessssss...shit on me
4/24/2007 2:05:23 AM mrko9850: will you eat it?
4/24/2007 2:05:23 AM mrko9850: mmmm
4/24/2007 2:06:15 AM Suzybibaby: yesssss
4/24/2007 2:06:22 AM Suzybibaby: shit into my ,mouth
4/24/2007 2:06:27 AM Suzybibaby: let me eat your turds
4/24/2007 2:06:37 AM mrko9850: could I see a face shot of you?
4/24/2007 2:06:58 AM Suzybibaby is sending 1 picture.
4/24/2007 2:07:05 AM mrko9850: mmmmm
4/24/2007 2:07:23 AM mrko9850: I can picutre you making love
to that baby
4/24/2007 2:07:24 AM mrko9850: mmmmm
4/24/2007 2:07:29 AM mrko9850: eatig her shit
4/24/2007 2:07:54 AM Suzybibaby: eating all her shit
4/24/2007 2:08:13 AM mrko9850: did youhold your nose when you
ate it?
4/24/2007 2:09:07 AM Suzybibaby: no.....I want it all over my
nose
4/24/2007 2:09:32 AM mrko9850: when she first shit her diaper,
was it your intention to eat it?
4/24/2007 2:09:35 AM mrko9850: like you plan on it?
4/24/2007 2:09:50 AM mrko9850: when youknew you were
babysitting?
4/24/2007 2:12:37 AM Suzybibaby: yes....plannng it for ages
4/24/2007 2:12:56 AM mrko9850: I bet you inhaled the aroma of
her shitty diaper
4/24/2007 2:12:57 AM mrko9850: mmmmm
4/24/2007 2:13:00 AM mrko9850: at first
4/24/2007 2:13:08 AM Suzybibaby: yes
4/24/2007 2:13:15 AM mrko9850: then what did you do?
4/24/2007 2:15:08 AM mrko9850: could yo ugive me details?
4/24/2007 2:16:37 AM Suzybibaby: back later...just chatting to
a girl
30
4/24/2007 2:16:43 AM mrko9850: ok
4/24/2007 2:17:25 AM mrko9850: is it about shit?
4/24/2007 2:17:26 AM mrko9850: ;)
4/24/2007 2:17:29 AM mrko9850: with her?
4/24/2007 2:17:36 AM Suzybibaby: no
4/24/2007 2:17:42 AM mrko9850: ok
4/24/2007 2:22:43 AM mrko9850: just let me konw when your done
4/24/2007 2:35:10 AM mrko9850: still chatting?

23. There were 85 pictures sent during the chat

conversation. Analysis of the chat log showed that “mrko9850”

sent 29 of the pictures to “Suzybibaby,” and “Suzybibaby” sent 56

pictures to “mrko9850”. The picture that “Suzybibaby” sends of

“herself” is that of a female appearing to be approximately 25-30

years old. Some of the 85 pictures also appear in line with the

text of the chat communication. Each of these thumbnail images

indicated what images the text sender was viewing at the time the

text message was sent. This permits the other participant to

know what image was being viewed at the time that text message

was sent.

24. Another conversation between “mrko09850” and

“Suzybibaby” that took place on April 12, 2007 between 7:30:39am

and 7:52:00am (pst) involved “mrko9850” inquiring of “Suzybibaby”

as to whether she has “fucked a lot of babies in the past/.”

Wherein “Suzybibaby”replies, “a few...not many...oh I did once

play with a 6 yr old I was babysitting, but thats more risky...”

“mrko9850” then responds, “cuz they can tell their

parents...always better to do babies.” “Suzibibaby” replies,

31
“yup.”

25. I have reviewed all of the images sent and received by

“Suzybibaby” during the aforementioned chat conversation and,

based on my experience and training, I believe that the majority

of the images depicted prepubescent and pubescent minors engaged

in sexually explicit conduct with adults and other minors. More

specifically the images depicted oral to genital contact, genital

to genital contact, genital to anal contact, digital to anal

contact and minors exposing their genitals in a lascivious

manner. One of the images sent by “Suzybibaby” during the chat

conversation depicts an adult male’s penis penetrating an infant

girl’s vagina.

26. On February 22, 2008, in an attempt to further identify

the individual using the screen name “Suzybibaby”, SA Dragon

issued a Customs administrative summons to Google for Hello UID

number 1170751 with a handle of “Suzybibaby”. On March 7, 2008,

Google responded to the summons and provided the following

information:

USERID: 1170751
Username: Suzybibaby
Email: suzybibaby@yahoo.com
Affiliate: Hello
Track: <default>
Registered: Thursday, March 3, 2005
Last Login: Sunday, February 24, 2008 @
11:37:47am

This information is consistent with the initial results

obtained during the SAC Buffalo investigation.

32
 27. Google also provided logs documenting access to account

UID 1170751. These logs documented date, time and IP address for

each time the account was accessed between December 03, 2007, and

February 24, 2008. There were approximately eight different IP

addresses listed in the results. Of the eight IP addresses, an IP

address of 71.235.8.170 was accessed on January 5, 6, 7, 2008;

and, again on February 2, 3, 19, 20, 21, 22, 23, and 24, 2008,

the same IP address was accessed. This is the same IP address

discovered during the SAC Buffalo investigation, and an ARIN

WHOIS database query revealed that the aforementioned IP address

is still maintained by Comcast Communications.

28. The results of a Customs administrative Summons issued

to Comcast Communications, revealed that the IP address of

71.235.8.170 is still maintained by Alan Hesketh, 202 Montauk

Avenue, Stonington, CT 06378, with a phone number of 860-535-

1446.

29. On February 22, 2008, a Custom administrative Summons

was issued to Southern New England Telephone/AT&T for subscriber

information related to telephone number (860) [*Redacted*]. AT&T

responded and provided the subscriber information as Alan

Hesketh, with a service and billing address of 202 Montauk

Avenue, Stonington, CT 06378, start of service June 19, 2003.

30. On February 22, 2008, a Customs Summons was issued to

Northeast Utilities for subscriber information for utilities at

the Subject Premises. Northeast Utilities responded and provided

33
the subscriber as Dr. Alan Hesketh, with an address of 202

Montauk Avenue, Stonington, CT 06378, start of service as March

June 20, 2003, home phone number of 860-[*Redacted*] and an account

number of [*Redacted*].

31. On February 22, 2008, a Connecticut Department of Motor

Vehicles (CT DMV) database inquiry revealed that HESKETH, date of

birth December 20, 1946, maintains a valid CT Operator’s License

([*Redacted*]) with an address of [*** Redacted ***] Avenue, Stonington,

CT. In addition, HESKETH has one vehicle, described as a 2004

Jeep Grand Cherokee (color Gray) with CT Registration 205 TGN,

registered to him at his address.

32. On February 22, 2008, an ACCURINT database inquiry

revealed that HESKETH currently resides at [*** Redacted ***] Avenue,

Stonington, CT 06378, with a phone number of (860) [*** Redacted ***].

ACCURINT records indicate that Jan HESKETH also resides at the

residence. It appears that ALAN HESKETH has resided at the

Subject Premises since June 2003.

33. On February 27, 2008, representatives from the United

States Postal Service confirmed that Alan and Janet Hesketh are

receiving mail at [*** Redacted ***] Avenue, Stonington, CT.

34. A Connecticut Department of Labor database inquiry for

HESKETH’S social security number revealed that he is presently

employed by the Pfizer Corporation.

35. A U.S Department of State database inquiry revealed that

HESKETH was issued an H1B visa on August 16, 2004, with

34
annotations listed for Pfizer Inc. Within the visa application,

HESKETH listed an address of [*** Redacted ***] Ave, Stonington, CT

06378, an email address of alan.hesketh@pfizer.com, and three

phone numbers (860-[*Redacted*]/home, 860-732-9519/work, 860-[**

Redacted**]/other).

36. A review of the immigration file for Alan Hesketh, A97

649 073, disclosed that he is employed as the Global Patent

Director at Pfizer, Inc. in New London, CT., having arrived in

the United States in January, 2002.

37. In addition to the Comcast IP address that is assigned

to the Subject Premises, a second IP address, which was accessed

numerous times by “Suzybibaby,” was located within the Google

Summons results. This IP address is 148.168.127.10 and it was

accessed by “Suzybibaby” on October 4 and 5, 2007, as well as,

January 13, 2008. An ARIN WHOIS database inquiry revealed that

this IP address is registered to Pfizer Incorporation, 235 E.

42nd St., New York, NY 10017.

38. A further review of the Google “Hello” logs, obtained

pursuant to the February 22, 2008 Customs administrative summons,

revealed an IP address that was accessed approximately ten

(10)times by “Suzybibaby” during the time period of December 3,

2007 at 20:17:58hrs(PST) and December 5, 2007 at

04:50:48hrs(PST). This IP address is 63.139.154.24, and an ARIN

WHOIS database inquiry revealed that the owner is PaeTec

Communications, with the IP address assigned to Crown Plaza

35
Tudor, more particularly identified as the Tudor Hotel at the

United Nations.

39. On February 29, 2008, I contacted the Tudor Hotel at the

United Nations and requested information related to ALAN HESKETH,

date of birth December 20, 1946. Tudor Hotel security personnel

complied with the request and indicated that ALAN HESKETH, with

an address of [** Redacted **] Avenue, Stonington, CT 06378, checked

into the hotel on December 3, 2007 and remained there until

December 6, 2007. HESKETH occupied room 311 and during his stay

he paid $44.85 for wired Internet access.

40. On March 20, 2008, a Customs administrative summons was

issued to Yahoo in Sunnyvale, CA, for subscriber information

related to Suzybibaby@Yahoo.com, the email address provided to

Google by the Google subscriber. Yahoo complied with the

subpoena on March 25, 2008, advising that the account is active,

with the most recent activity noted on March 18, 2008, from the

IP address as previously identified by Comcast as belonging to

the Subject Premises.

41. Based upon the information set forth herein, as well as

my training and experience, I believe that the individual using

the Google Hello username of “Suzybibaby” is ALAN HESKETH, who

lives at the Subject Premises.

Specifics Regarding the Seizure

and Searching of Computer Systems

42. Based on my own experience and consultation with other

36
agents who have been involved in the search of computers and

retrieval of data from computer systems and related peripherals,

and computer media, there are several reasons why a complete

search and seizure of information from computers often requires

seizure of all electronic storage devices, as well as all related

peripherals, to permit a thorough search later by qualified

computer forensic agents or experts in a laboratory or other

controlled environment:

a. Computer storage devices, such as hard disks,

diskettes, tapes, laser disks, compact discs, and DVDs, can store

the equivalent of hundreds of thousands of pages of information.

Additionally, when an individual seeks to conceal information

that may constitute criminal evidence, that individual may store

the information in random order with deceptive file names. As a

result, it may be necessary for law enforcement authorities

performing a search to examine all the stored data to determine

which particular files are evidence or instrumentalities of

criminal activity. This review and sorting process can take

weeks or months, depending on the volume of data stored, and

would be impossible to attempt during a search on site; and

b. Searching computer systems for criminal evidence is a

highly technical process, requiring specialized skill and a

properly controlled environment. The vast array of computer

hardware and software available requires even those who are

computer experts to specialize in some systems and applications.

37
It is difficult to know before a search what type of hardware and

software are present and therefore which experts will be required

to analyze the subject system and its data. In any event, data

search protocols are exacting scientific procedures designed to

protect the integrity of the evidence and to recover even hidden,

erased, compressed, password-protected, or encrypted files.

Since computer evidence is extremely vulnerable to inadvertent or

intentional modification or destruction (both from external

sources or from destructive code imbedded in the system as a

booby trap), a controlled environment is essential to its

complete and accurate analysis.

43. Based on my own experience and my consultation with

other agents who have been involved in computer searches,

searching computerized information for evidence or

instrumentalities of a crime often requires the seizure of all of

a computer system's input and output peripheral devices, related

software, documentation, and data security devices (including

passwords) so that a qualified computer expert can accurately

retrieve the system's data in a laboratory or other controlled

environment. There are several reasons that compel this

conclusion:

a. The peripheral devices that allow users to enter or

retrieve data from the storage devices vary widely in their

compatibility with other hardware and software. Many system

storage devices require particular input/output devices in order

38
to read the data on the system. It is important that the analyst

be able to properly re-configure the system as it now operates in

order to accurately retrieve the evidence listed above. In

addition, the analyst needs the relevant system software

(operating systems, interfaces, and hardware drivers) and any

applications software which may have been used to create the data

(whether stored on hard drives or on external media), as well as

all related instruction manuals or other documentation and data

security devices; and

b. In order to fully retrieve data from a computer system,

the analyst also needs all magnetic storage devices, as well as

the central processing unit (CPU). In cases like the instant one

where the evidence consists partly of image files, the monitor

and printer are also essential to show the nature and quality of

the graphic images which the system could produce. Further, the

analyst again needs all the system software (operating systems or

interfaces, and hardware drivers) and any applications software

which may have been used to create the data (whether stored on

hard drives or on external media) for proper data retrieval.

c. I am familiar with and understand the implications of

the Privacy Protection Act ("PPA"), 42 U.S.C. § 2000aa, and the

role of this statute in protecting First Amendment activities. I

am not aware that any of the materials to be searched and seized

from the Subject Premises are protected materials pursuant to the

PPA. If any such protected materials are inadvertently seized,

39
all efforts will be made to return these materials to their

authors as quickly as possible.

CONCLUSION

44. Based on the above information, there is probable cause

to believe, and I do believe, that 18 U.S.C. §§ 2252(a)(2) and

2252A(a)(2), which, among other things, make it a federal crime

for any person to knowingly possess and/or receive and/or

distribute child pornography, have been violated by ALAN HESKETH,

and that evidence, fruits, contraband, and instrumentalities of

these offenses, as further identified in Attachment B to this

Affidavit, are located at the Subject Premises. Further, I

respectfully request that this Court authorize a criminal

complaint and arrest warrant as against ALAN HESKETH and a search

warrant for the Subject Premises, as more particularly described

in Attachment A and A-1, authorizing the seizure of the items

described in Attachment B.

_______________________________
JASON DRAGON
SPECIAL AGENT
DEPARTMENT OF HOMELAND SECURITY,
U.S. Immigration and Customs Enforcement

Subscribed and sworn before me in Hartford, Connecticut this

26th day of March, 2008.

_______________________________
DONNA F. MARTINEZ
UNITED STATES MAGISTRATE JUDGE

40