United States v. Meek (affidavit)
IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF VIRGINIA
Alexandria Division
| UNITED STATES OF AMERICA
v. JAMES GORDON MEEK Defendant. |
Case No. 1:23-MJ-32 Filed Under Seal |
AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT AND ARREST WARRANT
I, Tonya Sturgill Griffith, being duly sworn, depose and state as follows:
BACKGROUND
1. I am a Special Agent with the FBI and have been since February of 2002. As such, I am authorized to investigate violations of laws of the United States, and to execute warrants issued under the authority of the United States. Since July 2010, I have been assigned to the Washington Field Office’s Child Exploitation and Human Trafficking Task Force. As an FBI Special Agent, I investigate federal violations concerning child pornography, the sexual exploitation of children, sextortion, and related offenses. I have gained experience through training and work related to conducting these types of investigations. I am a trained and certified digital extraction technician for the FBI.
2. This affidavit is submitted in support of a criminal complaint charging James Gordon Meek with transportation of child pornography, in violation of 18 U.S.C. § 2252(a)(1). That statute prohibits any person from “knowingly transport[ing] or ship[ping] using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign commerce by any means including by computer or mails, any visual depiction, if the producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct, and such visual depiction is of such conduct.”
3. The facts in this affidavit come from my personal observations, my training and experience, and information obtained from other law enforcement officers, witnesses, and/or agencies. Because this affidavit is being submitted for the limited purpose of demonstrating probable cause in support of a criminal complaint, I have not included every fact known to law enforcement concerning this investigation. Rather, I have set forth certain facts intended to establish probable cause to support the complaint.
SUMMARY OF PROBABLE CAUSE
A. Initiation of Investigation
4. The investigation was initiated from an investigative lead sent to the Washington Field Office’s Child Exploitation and Human Trafficking Task Force. The lead stated that on March 11, 2021, Dropbox filed a CyberTip with the National Center for Missing and Exploited Children (NCMEC) regarding child pornography found in a Dropbox account on March 10, 2021. The CyberTip reported that a Dropbox account user had uploaded five videos to Dropbox that were later confirmed by law enforcement to contain child pornography. The username associated with the account was “James Meek,” and the CyberTip contained IP addresses that were subsequently determined to be assigned to Meek, at an address in Arlington, VA (Meek’s Residence).
5. Based on this and other investigative information, a search warrant was obtained for Meek’s Residence. On April 27, 2022, the search warrant was executed at Meek’s Residence by members of the Washington Field Office Child Exploitation and Human Trafficking Task Force. Meek alone was present at the Residence; law enforcement officers believe that the Residence had no permanent residents other than Meek at the time. Several electronic devices were collected from the residence and subsequently searched.
B. Evidence of Transportation of Child Pornography
6. Law enforcement seized an iPhone 8 from an entry table by the door to Meek’s Residence}}. The device was powered on and password protected at the time it was located and collected.
7. The iPhone 8 contained three chat conversations in which the username “Pawny4” was engaging in sexually explicit conversations where the participants expressed enthusiasm for the sexual abuse of children. In two of those conversations, Pawny4 received and distributed child pornography image and video files through Kik, an internet-based messaging platform.
8. Forensic review of the iPhone 8 showed that between February 26, 2020, and February 27, 2020, Pawny4 and USERNAME 2[1] exchanged child pornography and messaged on Kik about their mutual interest in the sexual exploitation of children. USERNAME 2 identified as a 25-year-old male, and when Pawny4 asked, “Love kids?”, USERNAME 2 responded, “Yesss” and “mmmm im glad I found someone likeminded”. Pawny 4 and USERNAME 2 exchanged pictures of their penises and continued their conversation (spellings as in original):
USERNAME 2: Youre so sexy. I want your cock while those kids suck me
USERNAME 2: Its so beautiful
USERNAME 2: I love your cock
Pawny4: Have you ever raped a toddler girl? It’s amazing
USERNAME 2: itsmy dream
Pawny4: Do you have any pictures of bitches?
USERNAME 2: I want you with me fucking her together while we kiss and use her
USERNAME 2: I have a vid
Pawny4: I would give anything to do that
Pawny4: Show itUSERNAME 2: Sadly not as young as id like
Pawny4: Send me a video so I can see you stroking that gorgeous cock
9. USERNAME 2 then sent Pawny4 a video focused on the genital area of an apparent minor female depicting a female using her fingers to masturbate her vagina. The female appeared to be between a pre-adolescent and adolescent, and there was no visible hair on her visible pubic region. The female stated several times during the video, “Daddy fuck me”.
10. Shortly thereafter, USERNAME 2 told Pawny4 “Id give anything to rape toddlers with you”. Pawny4 responded “I think I’m in love with you” and sent a video that was 1 minute and 14 seconds in length depicting an erect penis penetrating the anus of a female infant. Throughout the duration of the video, the infant can be heard loudly crying and screaming. The man continues to rape the infant despite her screams and becomes more forcible in the penetration of her anus as the video progresses. Shortly after sending this video, Pawny4 said “I wish I could lick up all that cum all over that little baby that he just raped”. Pawny4 later stated “I wish you came on a toddler we just raped hard” and “Wishing I was licking your cum off a bald labia”. Pawny4 sent USERNAME 2 at least one more image and one more video depicting child pornography.
11. Between February 26, 2020, and February 28, 2020, Pawny4 and USERNAME 3 exchanged child pornography files and messaged on Kik about the sexual exploitation of children. USERNAME 3 identified himself as a 22-year-old male, and when Pawny4 asked “Love kids?”, USERNAME 3 responded, “I do”. Pawny4 sent an image of a prepubescent girl on the beach with her chest exposed, and then stated “Rape this little bitches mouth with that gigantic cock”. USERNAME 3 responded, “I’d love to get her little throat bulging”. Pawny4 shared an image of a nude woman breastfeeding two infants at the same time and shared his fantasies about raping the woman, licking USERNAME 3’s semen off the woman and her children, and impregnating the woman. Pawny4 also referenced another conversation he was having with a 21-year-old woman who wanted him to impregnate her so that they could sexually abuse their child together.
12. Pawny4 and USERNAME 3 continued to chat about masturbating and wanting to see each other. Pawny4 stated “Just to be able to spread my semen all over some nice big fat tits and a naked little girl would be a dream come true. Start raping her ass in infancy and try to get my cock inside her pussy by age 3 as her mother masturbates next to us”. On February 26, 2020, Pawny4 sent to USERNAME 3 the same video depicting the anal rape of an infant discussed above.
13. Pawny4 sent USERNAME 3 via Kik approximately four additional images depicting child pornography. The last image of child pornography, depicting a prepubescent girl with apparent semen on her stomach immediately above her exposed genitalia, was sent on the morning of February 27, 2020.
14. The telephone number connected to the SIM card in the iPhone 8 was the same number that law enforcement had previously determined was associated with Meek’s Dropbox and Gmail account. The device name was “Bone Machine”, and the sync host name was “Computer: crimson ghost\User: JAMES G. MEEK”.[2] The Gmail address associated with the Dropbox account listed in the CyberTip was found on the iPhone8, associated to a Dropbox account and an iCloud account. The iPhone 8 contained a Skype account with the username “8:meekwire” and the account name “@meekwire”. Finally, the phone included health data for Meek.
15. Travel records and evidence from the iPhone 8 indicate that from February 24, 2020, to February 28, 2020, Meek was located in the area of Charlotte, North Carolina and/or Rock Hill, South Carolina. American Airlines records demonstrate that Meek traveled on a flight from Charlotte, North Carolina, to Ronald Reagan Washington National Airport, within the Eastern District of Virginia, on February 28, 2020, at 12:57 PM.
16. Evidence from the iPhone 8 indicates that Meek carried this phone with him during his travel from North Carolina to Virginia. For example, text messages recovered from the phone indicate it was used to send several text messages throughout the period of Meek’s travel. Among other evidence, the phone contained a message dated February 26, 2020, Meek texted a friend that he was in South Carolina, as well as messages dated February 28, 2020, in which Meek discussed going to the airport, as well as Meek’s messages to family members coordinating their joining him at his residence in Virginia that evening.
17. Additionally, on or about October 25, 2021, Kik provided records related to the Pawny4 account that indicated that the device used to access the Pawny4 Kik account was an iPhone. Kik also provided IP addresses used to access the account during the relevant time frame. From between February 24, 2020, and approximately 12:52 PM UTC on February 28, 2020, open-source information indicates the IP addresses geolocated to locations in North and South Carolina. The next IP address used to access the Pawny4 Kik account several hours later geolocated to Arlington, Virginia.
18. Furthermore, I know from my training and experience and from information provided by Kik, that a user can only be logged into a Kik account from one device at a time. If the user logs into their Kik account from another device, the Kik account will be logged out on the first device and chat messages are deleted.
19. Between at least February 25, 2020, and March 9, 2020, Pawny4 also engaged in a Kik chat with USERNAME 1 in which he described a fantasy of abducting, drugging, and raping USERNAME 1 when she was a 12-year-old girl. Pawny4 also sent USERNAME 1 images of women breastfeeding. At least some of this conversation occurred within two hours of when Meek used the phone to communicate with his family member.
20. Law enforcement also located approximately 100 additional images depicting children engaged in sexually explicit conduct on the iPhone 8. Most or all of these images were thumbnails and/or stored in cache memory.
C. Other Evidence of Distribution of Child Pornography
21. Law enforcement also seized a 2TB Silicon Power external hard drive from Meek’s kitchen table during the execution of the search warrant. A review of the external hard drive indicated that it primarily contained back-ups of images and videos from other devices. Several folders were labeled “i6”, and there were folders titled “i5c lacie only”, “i4a”, “i4d”, “i5a”, “i6 lacie only”, and “i8pix080718a”. The folder labeled “i8pix080718a” contained a subfolder called “Bone Machine”, which was the device name for Meek’s iPhone 8. Based on my training and experience, the structure and names of these folders indicate they were organized by iPhone model. There were also several zip files that were labeled with “iCloud Photos” followed by a number and “.zip”, for example “iCloud Photos 26.zip”. Based on my training and experience, the folders and zip files indicate these folders are backups for pictures and videos from an iCloud account.
22. The external hard drive contained an image titled “IMG_6817.PNG” that depicted a screenshot of the messaging application Telegram on an Apple device. The image was stored at the location pipehitter\0-iphone pix backup072220\iCloud Photos 6, which, as discussed, appears to indicate that the image was saved down to the hard drive from an iCloud backup. At the top of the screenshot, the date on the Apple device was displayed as Sunday, April 5. The messaging application depicted the different chat threads on the left side, and the contents of a group chat on the right side. The top chat thread, which was the thread that was displayed on the right side, was titled “Cocks, Cunts, and Kids.” The group’s profile picture depicted a child eating a popsicle. The contents of this group chat were partially visible behind a bubble depicting the names of the group chat members. There were 13 members in the group chat and two were active at the time of the screenshot.
23. The last message sent on the group chat was from the user of the messaging application on the device where the screenshot was taken. In the second-to-last message in the group, another user in the chat had commented that people in the group were not sharing videos and photos anymore. The last message, sent in response, contained at least one video. The frozen frame of that video depicted a young girl performing or about to perform oral sex on a man’s visible erect penis, with a circle with a triangle in the center of the image indicating that it was a video. The user sending this video also stated, “Not everyone is as prolific as you.” This message was sent at 11:07 AM, and it contained two check marks indicating the message had been delivered to the server, and that a user had opened the chat since the message had been delivered.
24. A search warrant for Meek’s iCloud account was obtained on November 14, 2022. The iCloud account contained backups of at least two of Meek’s devices, and the contents of the backup included significant numbers of photos of Meek’s family members and bills addressed to him at his known residence. During a review of the search warrant return, law enforcement located another copy of this screenshot. This second image contained metadata reflecting the image’s creation on April 5, 2020, at 11:07 AM UTC.
25. Another image located during the review of the iCloud search warrant return depicted the Woodrow Wilson Bridge as seen from the vicinity of Jones Point Park in Alexandria, Virginia, within the Eastern District of Virginia. That image was created with the rear camera of an iPhone 8 on April 5, 2020, at 17:52 UTC. This image indicates Meek was located in the Eastern District of Virginia at the time the child pornography video was distributed on Telegram, as discussed above.
26. The external hard drive also contained an image titled “IMG_5333.PNG”, saved in a folder titled “iphone pix backup”, which depicts a screen shot of an iPhone with the open applications/window shown as tiles. The open windows include the Safari internet browser with “Omegle” website displayed (other evidence, discussed below, indicates that Meek used Omegle to chat with and attempt to chat with purported minors); a photo album with the heading “Tandies” with several breastfeeding images visible (the iPhone 8 contained an Instagram account with the username “TandiesClare” that purported to be collecting images of and stories about women breastfeeding, one of Meek’s known interests); the Kik application; and a window that is only partially visible that appears to be the internet-based chat application Telegram.
27. The apparent Telegram tile shows a chat log containing several images on the right side of the chat, indicating they were sent from the user of that account. The images appear to be videos, as they include time stamps in the upper left corner. The images were sent at 1:33 PM and contain two check marks indicating the message had been delivered to the server and that the conversation had been opened once the message was present.
28. The sent images are consistent with child pornography. Also visible is a still image of a video that appears to be 1:30 in length. Based on my training and experience, I know this to be part of a series of child pornography images and videos known to law enforcement and contained in a NCMEC database of identified children.
29. This image shows a created date of January 12, 2022, but law enforcement believes this is the date that the image was either saved to the hard drive or to the iCloud backup, not the date the photo was taken.
D. Evidence of Meek Engaging with Minors and Suspected Minors Through Snapchat
30. Forensic review of Meek’s iPhone 8 revealed that the phone contained a Snapchat account with the username “hoolijax,” as well as several Snapchat conversations with unidentified females. A review of an iPhone 6 seized from Meek’s Residence revealed the Snapchat username “hoolijax” had a Snapchat story associated with this phone.
31. A review of the Snapchat conversations stored on the iPhone 8 revealed a Snapchat conversation from between February 29, 2020. and March 2, 2020, between “hoolijax” and Identified Minor 2. Identified Minor 2 was a minor in 2020.
32. The stored communications did not appear to be the entirety of the Snapchat conversation, and the conversation only contained text messages (i.e., there were no pictures or videos found). The communication started with hoolijax asking “Who do you love most in the world?” Identified Minor 2 responded with the name of a public figure (“public figure 1”). Hoolijax went on to say, “She’s worthy of that big love. You are a beautiful girl and she should feel blessed that you love her more than anyone.” Later in the conversation, hoolijax stated, “I know someone who knows her really well. I thought I could help you. I won’t ask you anymore questions.” Identified Minor 2 then responded, “What” and “What did she say”. Hoolijax went on to say “She talked to my friend about you”, “She doesn’t hate you”, and “I’ll find out more tomorrow from him”.
33. The iPhone 8 also contained an image titled “5003.JPG” that depicts a screenshot of a Snapchat photograph. The image depicts the username for Identified Minor 2 on the top of the image, and the image is focused on the nude body of Identified Minor 2. The breasts, abdomen, and pelvic area of Identified Minor 2 are visible. At the bottom of the image is a text banner that states “Tell [public figure 1] to talk to me or I am getting Snapchat”. The creation date for the image was December 15, 2019.
34. A review of images from the external hard drive revealed approximately 11 images of Identified Minor 2. One image, titled IMG_3379.PNG and dated January 12, 2022, (likely the date the image was saved to the hard drive) depicted a screenshot of a Snapchat image. Identified Minor 2’s Snapchat username was visible at the top of the image. The image depicted Identified Minor 2 with her shirt pulled up to expose her breasts, and her pants pulled down to expose her pubic region. The bottom of the image contains a text banner that states “Who’s little girl do I belong to”. Two additional images also displayed Identified Minor 2’s pelvic area, but her vagina was not visible through the pubic hair.
35. Law enforcement interviewed Identified Minor 2, who confirmed that Meek and other men had approached her through Snapchat and had pressured her to provide pictures depicting sexually explicit conduct.
47. Review of the electronic devices seized during the search warrant has also resulted in significant evidence that Meek has engaged directly, and attempted to engage, with minors online on platforms and applications other than Snapchat.
48. Law enforcement located images of Meek video chatting with self-identified minors on Omegle on the external hard drive. Omegle is a communication platform in which a user can be randomly matched with another user for an anonymous text communication, video communication, or both. It is possible for Omegle users to enter search terms that make it more likely to be matched with certain categories of people, including likely minors.
49. For example, an image on the external hard drive titled “IMG_6957.JPG” depicts the screen of another device. Visible on that screen is an Omegle video chat. The other person in the chat (identified as “Stranger” per Omegle convention) identified themselves as 14 years old in the text portion of the chat and provided their Kik username. Meek’s portion of the video chat was also visible in the image. Meek’s nude abdomen, legs, and penis were visible. Meek can be seen holding his penis with his left hand. This image was taken with an Apple iPhone 6, and the creation date of the image was December 20, 2016. A file on the external hard drive titled “IMG_7388.JPG” depicts a similar Omegle chat in which the other participant in the chat identified herself as 15 years old and provided a Snapchat username. Meek’s nude abdomen, legs, and penis were again visible, and Meek was again holding his penis in his left hand. In this image, however, the video display of the other user was visible, and a female’s breasts were exposed. This image was taken with an Apple iPhone 6, and the creation date of the image was December 28, 2016.
50. Also on the external hard drive, law enforcement located a screen shot titled “IMG_0095.PNG” of a text conversation on an unknown platform. In the text conversation, a user from whose point of view the text conversation was captured asked “Age?”, and the other user responded “I don’t want to say lol”. The first user stated, “Say” and “It’s fine”, and the other user responded, “Ok, I’m basically 15”. The first user then asked, “Would you let me kiss you?”. Those are the only portions of this text conversation visible in the screenshot.
51. Law enforcement also located on the external hard drive several images depicting screen shots of Instagram conversations. Based on the language and the text of the conversations, as well as the display picture showing what appeared to be a minor female, it appears that Meek was using an account with the display name “taytayjadar” in which he posed as a minor female to communicate with other minors on Instagram and solicit pictures.
52. For example, law enforcement located screen shots of a chat in which taytayjader received pictures from a girl who appears to be a minor. The screen shot conversation revealed the other girl did not want to expose her breasts, and taytayjader responds, “ok why did u say u wud??? Maybe I wouldn’t show mine” and “I trust u”. The other girl then responds, “Fine ill show u my boobs”. In another screenshot, Taytayjader said “I like this one the best but I thot u were gonna pose without the shorts lol.” Later, when the other user asks “will u take ur panties off? So I can rub my face in there”, taytayjader responds “if u wanna see u know what pic u should send next lol”. Although the order of the pictures cannot be determined due to the way the chat was recovered, the girl sends pictures of her exposed breasts, a picture of herself wearing a bra, and pictures of the girl’s covered genital region and buttocks.
53. Finally, the external hard drive contained hundreds of screen shots of girls’ social media accounts. Some of these accounts appear to be from dating apps. Many of these accounts depict child erotica; for example, the external hard drive contained at least dozens of screenshots from various social media applications depicting girls doing splits.
F. Possession of Child Pornography
54. During the search of Meek’s Residence, law enforcement also located an Apple laptop in the living room area on a trunk to the right of the couch. A review of the images and videos on the computer revealed that approximately 90 images and videos of child pornography were located on the device. For example, one video compiles multiple clips, including a scene where an adult female places her tongue on a naked toddler’s vagina and a scene where an adult male inserts his penis into a toddler’s vagina. This video was located in a Downloads folder on the computer’s hard drive.
55. A review of the external hard drive revealed approximately 58 images and videos of child pornography. For example, one image depicted a nude prepubescent boy with a strap around his face with a device forcing his mouth open; his hands are bound to his feet. The boy is wearing a “Santa Claus” style hat with a bow pictured around his waist above his penis. Another series of images depicted Identified Minor 1 in progressive states of undress, culminating in a picture of her genitals. The pictures of Identified Minor 1 appear to have been saved to the hard drive in November 2014.
56. As previously discussed, the images and videos of child pornography located on the external hard drive were located in folders that were organized by the respective iPhone backup.
57. Law enforcement located 1B15 (an iPhone 6) in Meek’s bedroom on top of the nightstand. A review of the images and videos on the device revealed approximately 34 images and videos of suspected child pornography, though law enforcement has not been able to conclusively establish the age of the individuals depicted. For example, an imaged titled IMG_9205.PNG depicts what appears to be an adolescent female with her vagina exposed, and the focal point of the image is on her vagina. The word “Love” is superimposed on the image.
CONCLUSION
58. Based upon the above information, I respectfully submit there is probable cause to believe that James Gordon Meek transported child pornography, in violation of 18 U.S.C. § 2252(a)(1).
Respectfully submitted,
A personal signature appears here
Tonya Sturgill Griffith
Special Agent
Federal Bureau of Investigation
Sworn and subscribed before me by reliable telephonic means pursuant to Fed. R. Crim. P. 4.1 this 31st day of January, 2023.
A personal signature appears here
HON. Lindsey R. Vaala
UNITED STATES MAGISTRATE JUDGE
This work is in the public domain in the United States because it is a work of the United States federal government (see 17 U.S.C. 105).
Public domainPublic domainfalsefalse