Case 2:20-mj-30195-DUTY ECF No.

$86$
1 filed.HYLQ
06/09/20
0XOFDK\ PageID.1 7HOHSKRQH
Page 1 of 16

$25HY  &ULPLQDO&RPSODLQW 6SHFLDO $JHQW /DXUD 7UDLQHU 7HOHSKRQH  

81,7(' 67$7(6 ',675,&7 &2857

IRUWKH
(DVWHUQ'LVWULFWRI0LFKLJDQ

8QLWHG6WDWHVRI$PHULFD
Y &DVHíPMí
'HDQ :LOOLDP 3DXO &DVH1R $VVLJQHG7R8QDVVLJQHG
$VVLJQ'DWH
86$93$8/&03&0&

&5,0,1$/&203/$,17

,WKHFRPSODLQDQWLQWKLVFDVHVWDWHWKDWWKHIROORZLQJLVWUXHWRWKHEHVWRIP\NQRZOHGJHDQGEHOLHI

2QRUDERXWWKHGDWHVRI 0DUFK   WKURXJK $SULO   LQWKHFRXQW\RI :D\QH LQWKH
(DVWHUQ 'LVWULFWRI 0LFKLJDQ WKHGHIHQGDQWVYLRODWHG
Code Section Offense Description
 86& † $DE 3RVVHVVLRQ RI FKLOG SRUQRJUDSK\
 86& † $D 5HFHLSW DQG GLVWULEXWLRQ RI FKLOG SRUQRJUDSK\
 86& †  8VH RI PDLO RU LQWHUVWDWH FRPPHUFH WR NQRZLQJO\ WUDQVIHU REVFHQH PDWHULDO WR D
SHUVRQ XQGHU WKH DJH RI  RU DWWHPSWV WR GR VR

7KLVFULPLQDOFRPSODLQWLVEDVHGRQWKHVHIDFWV
VHH DWWDFKHG DIILGDYLW

✔ &RQWLQXHGRQWKHDWWDFKHGVKHHW

Complainant’s signature

/DXUD / 7UDLQHU 6SHFLDO $JHQW +6,

Printed name and
nd title
nd
6ZRUQWREHIRUHPHDQGVLJQHGLQP\SUHVHQFH
DQGRUE\UHOLDEOHHOHFWURQLFPHDQV

'DWH June 9, 2020 Judge’s signature

&LW\DQGVWDWH 'HWURLW 0LFKLJDQ +RQ

+R
+ 5 6WHYHQ :KDOHQ
Q 5 :KDOHQ 8QLWHG 6WDWHV 0DJLVWUDWH -XGJH
Printed name and title
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.2 Page 2 of 16

AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR

CRIMINAL COMPLAINT AND ARREST WARRANT

I, Laura Trainer, being first duly sworn, state as follows:

INTRODUCTION

1. I am a Special Agent with the Department of Homeland Security Homeland

Security Investigations (HSI) in Detroit, Michigan. I have been employed as

a Special Agent for HSI since March 2007 and am currently assigned to the

Cyber Crimes Group. While employed as a Special Agent by HSI, I have

assisted with investigations related to child exploitation and child

pornography. I have received training in the area of child pornography and

child exploitation and have had the opportunity to observe and review

examples of child pornography (as defined in 18 U.S.C. § 2256) in all forms

of media, including computer media. In June 2019, I successfully completed

the International Crimes Against Children (ICAC) Undercover Chatting

Investigations training held in Fairfax, Virginia.

2. This affidavit is made in support of an application for a criminal complaint

and arrest warrant for Dean William PAUL for violations of Title 18,

United States Code, Sections 2252 and 2252A(a)(5)(b) and 2252A(a)(2),

which criminalize, among other things, the possession, receipt, and

distribution of child pornography and other related materials, as well as 18

1
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.3 Page 3 of 16

USC § 1470, which makes it a crime to use the mail or any facility or means

of interstate of foreign commerce knowingly transfers obscene matter to

another individual who has not attained the age of 16 years, knowing that

such other individual has not attained the age of 16 years, or attempts to do

so.

3. The facts set forth in this affidavit are based upon my personal observations,

my training and experience, and information made available to me by other

law enforcement professionals. These facts are provided for the sole

purpose of establishing probable cause for the issuance of a criminal

complaint and arrest warrant; therefore, this affidavit does not necessarily

contain all information uncovered during this investigation. Because this

affidavit is being submitted for the limited purpose of securing a criminal

complaint and arrest warrant, I have not included each and every fact known

to me concerning this investigation. I have set forth only the facts that I

believe are necessary to establish probable cause for an arrest warrant for

Dean William PAUL.

4. Pursuant to the provisions of Title 18, United States Code, section 2256,

“child pornography,” as used in this affidavit, includes any visual depiction,

including any photograph, film, video, picture, or computer generated image

2
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.4 Page 4 of 16

or picture of sexually explicit conduct where the production of the visual

depiction involved the use of a minor engaging in sexually explicit conduct.

BACKGROUND ON KIK APPLICATION

5. The KIK application advertises itself as “the first smartphone messenger

with a built-in browser.” KIK Messenger allows its users to “talk to your

friends and browse and share any web site with your friends on KIK”. KIK

believes it is at the forefront of the “new era of the mobile web.” According

to the website, KIK Messenger, a free service easily downloaded from the

Internet, has become the simplest, fastest, most life-like chat experience you

can get on a smartphone. Unlike other messengers, KIK usernames - not

phone numbers - are the basis for KIK user accounts, so KIK users are in

complete control with whom they communicate. In addition, KIK features

include more than instant messaging. KIK users can exchange images,

videos, sketches, stickers and even more with mobile web pages.

6. The KIK app is available for download via the App Store for most iOS

devices such as iPhones and iPads. Additionally, the KIK app is available

on the Google Play Store for Android devices. KIK can be used on multiple

devices.

7. In general, providers like KIK ask each of their subscribers to provide

certain personal identifying information when registering for an

3
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.5 Page 5 of 16

account. This information can include the subscriber’s full name, physical

address, and other identifiers such as an e-mail address.

8. Providers typically retain certain transactional information about the creation

and use of each account on their systems. This information can include the

date on which the account was created, the length of service, records of log-

in (i.e. session) times and durations, the types of service utilized, the status

of the account (including whether the account is inactive or closed), the

methods used to connect to the account, and other log files that reflect usage

of the account. In addition, providers often have records of the Internet

Protocol address (“IP address”) used to register the account and the IP

addresses associated with particular logins to the account.

9. KIK offers users the ability to create an identity within the app referred to as

a “username”. This username is unique to the account and cannot be

changed. No one else can utilize the same username. A KIK user would

have to create a new account in order to obtain a different username. The

username for a particular KIK account holder is displayed in their KIK

profile.

INVESTIGATIVE DETAILS

10. HSI Detroit received information from HSI St. Paul, Minnesota that between

March 28, 2020 and April 8, 2020, a subject using KIK screen name

4
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.6 Page 6 of 16

“xlegend69x” was talking about abusing children and posted child

pornography to a public KIK group. Although this public group is not

exclusively devoted to child pornography, numerous users share child

pornography and/or explicit images of children on a near daily basis with the

group and often talk about their sexual interest in children. An HSI St. Paul

Special Agent acting in an undercover capacity (herein referred to as

“UCA”) and “xlegend69x” communicated via KIK in the public group chat

and via private chat. During the private chat the UCA received a “live”

picture from a KIK user with username “xlegend69x” depicting an adult

male.

11. During a conversation in the public group chat with the UCA on March 28,

2020, “xlegend69x” indicated he is sexually active with his seven-year-old

daughter and had a previous two-year relationship when he was 25 years old

with his 14-year-old cousin. Subsequent to these comments by

“xlegend69x,” this KIK user and the UCA had a private conversation.

12. During the private conversation between the UCA and “xlegend69x” on

March 28, 2020, “xlegend69x” stated he was 37 years old, lived in the

Detroit area in Michigan, and was not married. “xlegend69x” admitted to

touching his daughter while masturbating in her room and performing oral

sex when she was five years old. When asked if “xlegend69x” was worried

5
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.7 Page 7 of 16

the daughter would tell, he responded that “she knows it’s only about us and

for us to know.” On March 30, 2020, “xlegend69x” was asked to be an

administrator in the group, and he accepted.

13. On April 2, 2020, “xlegend69x” posted a 28 second video of a pre-pubescent

female (who your affiant estimates, based on my training and experience, to

be approximately 8 years old) wearing a purple and pink dress with white

dots and a hood and green cotton panties with a small print dancing in front

of the camera. The camera is set up in what appears to be a child’s

playroom with colorful striped wallpaper. Children’s toys and furniture are

visible during the video. The little girl walks into view of the camera and

says something in a foreign language. She walks out of view of the camera

briefly and when she returns, stands approximately 2-3 feet in front of the

camera with her dress pulled up and her panties showing. The little girl is

not wearing anything on her legs. She bends over from the hip in front of

the camera displaying her buttocks and begins to move her hips back and

forth and up and down with her hands on her knees in a sexually suggestive

manner. While still bent over, she grabs onto the sides of a small table in

front of her and bends over more. Although the girl is wearing underwear,

the focal point at this point of the video is the girl’s buttocks. She then turns

around, pulls her dress up higher as if to hold it up with her chin, displaying

6
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.8 Page 8 of 16

her bare stomach, panties and tops of her thighs. She walks approximately 1

foot from the camera, raises her right leg up in front of the camera and

places her foot next to the camera, displaying her panties. The focal point of

the video at this point is her vagina. Her face and body are all visible down

to her knees as she does this. She then lowers her leg, puts her dress down

and walks towards the camera as if to stop the video. Your affiant and

another trained HSI agent (who has participated in hundreds of child

pornography investigations and viewed tens of thousands of child

pornography images),1 reviewed this file and it meets the federal definition

of child pornography. When asked who the female was, “xlegend69x”

responded, “Just a vid..obviously some Russian girl on her own.”

14. On April 8, 2020, “xlegend69x” posted a picture of a nude pre-pubescent

female (who your affiant estimates to be approximately 8 years old) standing

in what appears to be a bedroom with bunk beds. Her arms are bent and

covering her chest and it appears as if she is attempting to tuck her hair

behind her ears. Her chin is down, and she had a slight smile on her face.

Her bare vagina is visible. “xlegend69x” commented under the picture, “I’ll

just say she is better than both of them but not quite the best out there (with a

winking emoji).”

7
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.9 Page 9 of 16

15. A subpoena was administered to KIK requesting subscriber information for

“xlegend69x” on March 31, 2020, and on April 6, 2020, KIK reported the

following account information in response to the subpoena:

Username: xlegend69x
First Name: legend
Email: [email protected]
Username: xlegend69x
IP Address: 68.41.121.145

According to KIK, the account was registered on February 7, 2018 at

21:49:56 UTC with an iPhone. Between the dates of March 15, 2020, and

April 6, 2020, there are hundreds of logins each day to the KIK account

using the IP address “68.41.121.145.” On March 31, 2020, between 1517

and 1550, there are 17 logins that utilized a different IP address located in

Cleveland, Ohio; however, the IP logins from that same day both

immediately before and after that timeframe are from the residence of Dean

Paul in Dearborn Heights, Michigan. Every login to the account while

“xlegend69x” was communicating with the UCA and sending child

pornography was from the PAUL’S residence in Dearborn Heights,

Michigan.

16. A subpoena was administered to Comcast requesting subscriber information

for IP address 68.41.121.145 on April 6, 2020. Comcast reported that the

8
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.10 Page 10 of 16

subscriber for that IP address was “Ashley Paul at 27026 E. Pleasant Ridge

Drive, Dearborn Heights, Michigan 48127, telephone number (734) 837-

6870”. Two email addresses were linked to the account:

“[email protected]” and “[email protected].” The

account was still active as of the date of the subpoena return on April 7,

2020.

17. On April 20, 2020, personnel from HSI Detroit executed a federal search

warrant at 27026 E. Pleasant Ridge Drive, Dearborn Heights, Michigan

48127. Dean William PAUL was encountered at the residence at that time.

HSI Detroit Special Agent (SA) Laura Trainer asked PAUL who else lived

at the residence, to which he stated his soon to be ex-wife Ashley and his 7-

year-old son lived there until the beginning of March, and that no one else

lived at the residence besides the three of them.

18. HSI Detroit SA David Alley and Trainer spoke with PAUL regarding the

nature of the search warrant. PAUL agreed to speak with law enforcement.

PAUL was informed he was not under arrest at this time. PAUL was read

his Miranda rights and signed ICE form 73-025. He stated he understood his

rights and was willing to speak to HSI agents. This interview was recorded

in its entirety. PAUL made the following pertinent, non-verbatim statements:

9
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.11 Page 11 of 16

i. PAUL stated he lived at 27026 E. Pleasant Ridge Drive,

Dearborn Heights, Michigan for approximately 13 or 14
years. PAUL stated no one else lived at the residence.
PAUL stated his date of birth was 11/**/1972, and his email
address was “[email protected]”. PAUL claimed he
could not think of other emails offhand.
ii. PAUL stated he had been arrested before.
iii. PAUL stated they utilized Comcast internet service, and that
the wifi was password protected; however, he did not
remember the password.
iv. PAUL stated he utilized Facebook and has social media but
would not answer yes or no when asked about other social
media.
v. When asked about Instagram, PAUL did not answer and
stated, “I’m probably screwed”.
vi. PAUL stated he didn’t harm anyone, nor had he ever touched
anyone.

19. At this point in the interview, PAUL stated he should probably speak with a

lawyer.

20. PAUL told SA’s Trainer and Alley about his criminal history. He stated he

was arrested for Indecent Exposure in Farmington Hills, Michigan after he

was caught looking at adult pornography in a library and also for a probation

violation but did not elaborate on the details of that arrest.

10
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.12 Page 12 of 16

21. PAUL stated he has had an iPhone since they came out and an iPhone 7

prior to his new phone. PAUL also stated he had an iPad that was a couple

years old, and he used it for games but not chatting.

22. During the forensic examination of PAUL’S Apple iPhone 11 Pro Max that

was seized from his residence on April 20, 2020, four files were located

which are consistent with child pornography. All four files are of minor

females who are using the social media application Instagram to create live

videos. Multiple users requested to be part of the live video feed, including

“petr.backup” with User ID “14014100228”. This Instagram user account is

associated with PAUL’S iPhone 11 Pro Max.

23. Video #1 is approximately 54 seconds in length and shows a fully clothed

minor female with blonde hair sitting in front of the camera and speaking in

a foreign language. “petr.backup joined” is visible on the screen along with

a profile picture of a clown face. Approximately two seconds into the video,

a dialog box appears that states, “Request To Be In This Live Video”.

“petr.backup’s” profile picture is visible along with the profile picture of the

minor female, indicating “petr.backup” is requesting to be in the live video.

Approximately 20 seconds into the video, a dialog box stating, “[minor

female] accepted your request to join their live video. You’ll start sharing

live video soon” appears. Immediately after, a live video appears of an adult

11
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.13 Page 13 of 16

male masturbating. The male’s face is not visible in the live video; however,

his blue shirt and dark blue shorts are visible. During the live video, “[minor

female’s username] with petr.backup” appears at the top of the screen. The

live video lasts approximately 40 seconds. This video was created on

4/14/2020 at 1:10:44 PM(UTC-4) and accessed on 4/14/2020 at 1:10:44

PM(UTC-4).

24. Video #2 is approximately one minute and five seconds in length and shows

a fully clothed minor female with blonde hair sitting in front of the camera

and speaking in a foreign language. As the video begins, a dialog box

appears that states, “Request To Be In This Live Video”. “petr.backup’s”

profile picture is visible along with the profile picture of the minor female,

indicating “petr.backup” is requesting to be in the live video. The dialog

box disappears and “petr.backup joined” is visible on the screen.

Approximately 23 seconds into the video, a dialog box appears stating

“[minor female] accepted your request to join their live video. You’ll start

sharing live video soon”. Immediately after, a live video appears of the

same adult male from Video #1 masturbating. The male is wearing the same

clothing from Video #1. During the live video, “[minor female’s username]

with petr.backup” appears at the top of the screen. The video lasts

approximately 16 seconds. When the video stops, “petr.backup’s” name

12
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.14 Page 14 of 16

disappeared from the top of the screen. This video was created on 4/14/2020

at 1:15:36 PM(UTC-4) and accessed on 4/14/2020 at 1:15:36 PM(UTC-4).

25. Video #3 is approximately one minute and 54 seconds in length and the

same minor female from Video #1 is visible on the screen. She is wearing

different clothing and her hair style is different in this live video. A dialog

box is visible at the start of the video that states "[minor female] Wants You

To Be In This Live Video”. Approximately 5 seconds into the video, a live

video appears of the same adult male from Video #1 and Video #2

masturbating. The male’s face is not visible in the video; however, a blue

shirt and gray and black shorts are visible. “petr.backup joined” is visible at

the bottom of the screen and “[minor female’s username] with petr.backup”

appears at the top of the screen. The video lasts approximately 15 seconds.

This video was created on 4/18/2020 at 12:36:09 PM(UTC-4) and accessed

on 4/18/2020 at 12:36:09 PM(UTC-4).

26. Video #4 is approximately one minute and three seconds in length and the

same minor female from Video #1 and Video #3 is visible. “petr.backup

joined” is visible on the screen. Approximately 11 seconds into the video, a

dialog box appears that states, “Request To Be In This Live Video”. The

profile picture for “petr.backup” and the minor female is also visible in the

dialog box, indicating that “petr.backup” is requesting to be in the live video.

13
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.15 Page 15 of 16

Approximately 22 seconds into the video, a dialog box stating, “[minor

female] accepted your request to join their live video. You’ll start sharing

live video soon” appears. Immediately after, a live video appears of the

same adult male from all three previous videos masturbating. The male is

wearing the same outfit as in Video #3. The video lasts approximately 1

second and disappears. A dialog box appears at the top of the screen that

states, “Invitation expired”. This video was created on 4/18/2020 at

12:36:10 PM(UTC-4) and accessed on 4/18/2020 at 12:36:10 PM(UTC-4).

27. On April 12, 2020 and April 18, 2020 respectively, “petr.backup” also

requested to be in two additional live videos with minor females; however,

neither of those females accepted his request.

28. All of the minor females depicted in the videos above appear, based on my

training and experience, to be prepubescent, and under the age of 16.

CONCLUSION

29. Your Affiant respectfully submits that there is probable cause to believe that

Dean William PAUL violated Title 18, United States Code, Sections 2252

and 2252A(a)(5)(b) and 2252A(a)(2), which criminalize, among other

things, the possession, receipt, and distribution of child pornography and

other related materials, as well as 18 USC § 1470, which makes it a crime to

use the mail or any facility or means of interstate of foreign commerce

14
 Case 2:20-mj-30195-DUTY ECF No. 1 filed 06/09/20 PageID.16 Page 16 of 16

knowingly transfers obscene matter to another individual who has not

attained the age of 16 years, knowing that such other individual has not

attained the age of 16 years, or attempts to do so.

30. Wherefore by this affidavit and application, Affiant requests that the Court

authorize the issuance of a criminal complaint and arrest warrant for Dean

William PAUL.

Respectfully submitted,

Laura L. Trainer, Special Agent

Department of Homeland Security
Homeland Security Investigations

Sworn to before me and signed in my

presence and/or by reliable electronic means.

HO
HON.
ON. R.
R. STEVEN WHALEN
UNITED
U NITED STATES MAGISTRATE JUDGE

Date: June 9, 2020

15