Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 1 of 14

AO 9l (Rev. 08/09) Criminal Complaint

UNTTBn STRTBS DTsrrucT CoURT

for the
Southern District of Alabama

United States of America

v.
JERRY L. CANNON caseNo, M5 tl- OOf2- C

Defendant(s)

CRIMINAL COMPLAINT

I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
On or about the date(s) of 0112512011 &021021201'l in the county of Mobile in the
Southern District of Alabama , the defendant(s) violated:

Code Section Offense Description

1 8 u.s.c. $2252A(a)(2)(A) Certain Activities relating to Material involving the Sexual Exploitation of
Minors

This criminal complaint is based on these facts:

See attached Affidavit, incorporated herein by reference.

d Continued on the attached sheet.

Marya Wilkerson, Special Agent, FBI

Printed name and title

Sworn to before me and signed in my presence.

Date: 02t14t2011

City and state: Mobile. Alabama William E. Cassadv, United States Maoistrate Judoe
Printed name and title
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 2 of 14

IN THE LINITED STATES DISTRICT COURT

FOR THE SOUTHERN DISTRICT OF ALABAMA

United States of America

V. Court No.
JERRY L. CANNON

AFFIDAVIT IN SUPPORT OF
CRIMINAL COMPLAINT

I, Marya Wilkerson, Special Agent of the Federal Bureau of Investigation, being

first duly sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND

1. I make this affidavit in support of an application for a Criminal Complaint and

Arrest Warrant for Jerry L. Cannon for violations of Title 18 U.S. Code Section
92252A(a)(2XA), Certain Activities relating to Material involving the Sexual
Exploitation of Minors .

2. I arn a Special Agent with the Federal Bureau of Investigation (FBD and have
been since April 13, 2008. I am currently assigned to the Mobile, Alabama, Division. I
am authorizedto investigate violations of Federal Law, including Title 18 U.S. Code,
Sections 92252(a)(5)(B) and 52252A(a)(2XA), certain activities relating to the mateial
constituting or containing child pornography. Prior to my employment with the FBI, I
was a Prosecutor for the Knox County District Attorney's Office in Knoxville,
Tennessee, for approximately four and ahalf years. With the FBI, I have obtained
kaining related to investigating crimes against children and internet crimes in particular.

3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and wifiresses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant
and does not set forth all of my knowledge about this matter.

4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that violations of Title 18, U.S.Code, Section
52252A(a)(2XA) has been committed by Jerry L. Cannon through the use of the multiple
false Facebook accounts.
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 3 of 14

USE OF COMPUTERS WITH CHILD PORNOGRAPHY

5. As a result of my training and experience, I know that computers are used by

individuals who exploit children (which includes collectors of child pornography) to: a)
correspond with like-minded individuals via e-mail, chat, bulletin boards, newsgroups,
instant messages, file transfers and other means; b) store identifying information
concerning child victims, as well as identifying information about other individuals who
share the same interests; c) locate, view, download, collect, and organize images of child
pornography found through the Internet. Computers also afford individuals a degree of
anonymity.

6. Collectors and distributors of child pornography also use online resources to

retrieve and store child pornography, including services offered b y Internet Portals such
as Yahoo! and Hotmail, among others. The online services allow a user to set up an
account with a remote computing service e that provides e-mail services as well as
electronic storage of computer files in any variety of formats. A user can set up an online
storage account from any computer with access to the Internet. These online storage
accounts are often free but can involve a charge. Payment is almost always made via
credit card, debit card, or other similar payment service,

7. A subscriber assigned a free online storage account frequently can setup such
accounts by providing limited identifying information. Any information provided is
frequently fictitious in an attempt to preserve the anonymity of the user. Consequently,
even if it is known that a collector or distributor of child pornography is a subscriber of a
free online storage service, the service provider frequently will have no records in that
subscriber's name. Instead, the online service will only be able to identify fields,
including child pornography, that are associated with aoologin," or unique, user-created
identity the subscriber uses to "1og on" to the online service.

8. Such an online storage account is particularly useful to a collector or distributor of

child pornography. Such a subscriber can collect, store, view and distribute electronic
images, including child pornography, directly from the online service. Consequently, the
illegal files have minimal contact with the subscriber's home computer, The subscriber
can also manipulate the files on an online storage service from any computer connected
to the Internet.
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 4 of 14

9. As is the case with most digital technology, communications by way of computer

can be saved or stored on the computer used for these purposes. Storing this information
can be intentional, i.e. by saving an e-mail as a file on the computer or saving the location
of one's favorite websites in, for example, "bookmark" files. Digital information can
also be retained unintentionally, e.g. traces of the path of an electronic communication
may be automatically stored in many places (e.g., temporary fields or ISP client software,
among others). In addition to electronic communications, a computer user's Internet
activities generally leave traces or "footprints" in the web cache and history files of the
browsers used. In other words, if a computer user were to go to the website called ,,DOJ.
Gov," a "footprint" in the browser's cache may be found pointing to that website,
indicating thatparticular computer was used to visit that website.

10. The majority of individuals who collect child pornography are persons who have a
sexual attraction to children. They receive sexual gratification and satisfaction from
sexual fantasies fueled by depictions of children that are sexual in nature.

11. Individuals who collect child pomography often collect sexually explicit materials,
which may consist of photographs, magazines, motion pictures, video tapes, books,
slides, computer graphics or digital or other images for their own sexual gratification.
The majority of these individuals also collect child erotica, which may consist of images
or text that do not rise to the level of child pornography but which nonetheless fuel their
deviant sexual fantasies involving children.

12. Individuals who collect child pornography rarely, if ever, dispose of the sexually
explicit material and may go to great lengths to conceal and protect from discovery, theft,
and damage to their collections of illicit materials.

13. Individuals who collect child pornography often seek out like-minded individuals,
either in person or on the Internet, to share information and trade depictions of child
pomography and child erotica as a means of gaining status, trust, acceptance and
support. This contact helps these individuals rationalize and validate their deviant sexual
interest and associated behavior. The different Internet-based vehicles used by such
individuals to communicate with each other include, but are not limited to; e-mail, e-mail
groups, bulletin boards, Internet relay chat (IRC), newsgroups, instant messaging, and
other similar vehicles.

14. Individuals who collect child pornography often maintain books, magazines,
newspapers, and other writing, in hard copy, or digital medium, on the subject of sexual
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 5 of 14

activities with children, as away of understanding their own feelings toward children,
justifying those feelings and finding comfort in their illicit behavior and desires. Such
individuals rarely destroy these materials because of the psychological support they
provide.

15. Individuals who collect child pornography often collect, read, copy or maintain
names, address (including e-mail address), phone numbers, or lists of persons who have
advertised or otherwise made known in publications and on the Internet that they have
similar sexual interests. These contacts are maintained as a means of personal referral,
exchange or commercial profit. These names may be maintained in the original medium
from which they were derived, in telephone books or notebooks, on computer storage
devices, or merely on scraps of paper.

DEFINITIONS

16. "Child Erotica" are materials or items that arc sexually arousing to pedophiles but
that are not in and of themselves obscene or which do not necessarily depict minors in
sexually explicit poses or positions.

17. "Child Pornography," as used in this affidavit, includes the definition in 18 U.S.C.
Section 92256, as well as any visual depiction, the production of which involves the use
of a minor engaged in sexually explicit conduct (See U.S.C. Section zz52).
18. The term "computer," as used herein, is defined pursuant to 18 U.S.C. Section
ooan
s1030(e)(1), as electronic, magnetic, optical, electrochemical, or other high speed
data processing device performing logical or storage functions, and includes any data
storage facility or communications facility directly re.lated to or operating in conjunction
with such devices."

D. "IP address" refers to unique number used by a computer to access the Internet.
IP addresses can be dynamic, meaning that the Internet Service Provider (ISP) assigns a
different unique number to a computer every time it accesses the Internet. IP addresses
might be static whereby the user's ISP assigns his computer a unique IP address and that
same number is used by the user every time his computer accesses the Internet.

20. "Browser" refers to a software application that allows a computer user to navigate,
or "surf'the Internet. Common browser applications include Microsoft's Internet
Explorer or Netscape Navigator.

21. The terms "records," "documents," and "materials" include all information
recorded in any form, visual or aural, and by any means, whether in handmade form
(including, but not limited to writings, drawings, paintings), photographic form
(including, but not limited to, microfilm, microfiche, prints, slides, negatives, videotapes,
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 6 of 14

motion pictures, photocopies), mechanical form (including, but not limited to ,

phonograph records, printing, typing)_ or electrical, electronic or magnetic form
(including, but not limited to, tape recordings, cassettes, compact discs, electronic or
magnetic storage devices such as floppy diskettes, hard disks, CD-Multi Media Cards
(MMCs), memory sticks, optical discs, printer buffers, smart cards, memory calculators,
electronic dialers, Bernoulli drives, or electronic notebooks, as well as digital data files
and printouts or readouts from any magnetic, electrical or an electronic storage device).
3
22. "Sexually Explicit Conduct" means actual or simulated (a) sexual intercourse,
including genital-genital, oral-genital, or oral-anal, whether between persons of the same
or opposite sex; (b) bestiality; (c) masturbation; (d) sadistic or masochistic abuse; or (e)
lascivious exhibition of the genitals or pubic area of aperson.

23. or o'Uniform Resource Locator: refers to Internet addresses. Each file on

ooIJRI."
the Internet has a unique address called a Uniform Resource Locator, more commonly
known as URL.

24. "Visual Depictions: include undeveloped film and videotape, and data stored on
computer disk or by electronic means which is capable of conversion into a visual image.
Gee_l8 U.S.C. Section s2256(5)).

TECHNICAL BACKGROUND

25. Facebook owns and operates a free-access social networking website of the same
name that can be accessed at http://www.Facebook.com. Facebook allows its users to
create their own profile pages, which can include lists of their persgnal interests, photos
of themselves and friends, and links to pages within and outside the Facebook
environment. Facebook also permits users to send and receive private messages (the
functional equivalent of e-mails) with other Facebook users, and to restrict the disclosure
of certain information (blogs, profile information) exclusively to the Facebook "friends"
of their choosing.

26. Facebook's Headquarters is located at 1601 South California Avenue, Palo Alto,
California,94304. Facebook uses data centers in Santa Cl,etd,California and Ashburn,
Virginia. These data centers house the servers. (Servers are a computer or series of
computers that link other computers or electronic devices together. They often provide
essential services across a network to public users via the internet. For example, when
you enter a query in a search engine, the query is sent from your computer over the
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 7 of 14

internet to the servers that store all the relevant web pages. The results are sent back by
the server to your computer).

27. According to statistics provided by Facebook, there are more than five hundred
million active users. An average user has one hundred and thirty friends. People spend
over 700 billion minutes per month on Facebook. More than 30 billion pieces of content
(web links, news stories, blog posts, notes, photo albums, etc.) are shared each month. In
addition, more than2.5 million websites have integrated with Facebook and more than
250 million people engage with Facebook on external websites. Furthermore, there are
more than 200 million active users currently accessing Facebook through their mobile
devices.

28. Facebook asks users to provide basic identity and contact information to
Facebook, either during the registration process or thereafter. This information may
include the user's full name, user ID, e-mail addresses, physical address (including city,
state, andzip code), date of birth, gender, hometown, occupation, and other personal
identifiers. For each user, Facebook also retains information about the date and time at
which the user's profile was created, the date and time at which the account was created,
and the Internet Protocol ("IP") address at the time of sign-up. Because every device that
connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Facebook account.

29. Facebook also keeps IP logs for each user. These logs contain information about
the user's log-ins to Facebook, including, for each access, the IP address assigned to the
user and the date stamp at the time the user accessed his or her profile. Facebook retains
IP log information about each account access for at least one year.

30. Facebook users can exchange private mail messages with other users via
Facebook. A given message typically includes the Facebook user accounts of the sender
and the recipient of the message, a subject line, the actual content of the message, and a
date stamp reflecting when the message was sent. Private messages are sent to the
recipient's Facebook inbox and remain available there until the recipient removes them.
Private messages are also available from a "sent box" for the Facebook who sent the
message; Facebook retains these sent messages for at least 14 days, unless the sender
manually deletes them from the sent box.
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 8 of 14

3 1 . Facebook users can add a vaiety of information to their profiles, including

photographs, videos, music, and other audio files, lists of personal interests and
preferences, journals or web logs ("blogs), bulletins, news feeds, links to other locations
on the Internet, and "About Me" entries, which typically contain personal information
about the user. Facebook users can also post comments on the Facebook profiles of other
users or on their own profiles. Facebook allows users to edit or delete comments on their
own profile pages, and users can also adjust their profile settings to allow them to pre-
approve comments on their own profile pages.

32. A Facebook user can link his profile page to the profile of another Facebook user
by becoming'ofriends" with that user on Facebook. Each user profile page includes a list
of that user's oofriends," along with links to the friends' profile pages. Facebook users can
adjust the privacy settings for their profile so that their profile information is visible only
to their Facebookoofriends," rather than to the public (which is the default setting).

33. Facebook users can post free classified ads on Facebook Classifieds. Facebook
also allows users to place applications in their profiles.

34. For a given user, Facebook retains the basic identity information entered by the
user, all data displayed on the user's profile, and all stored files (such as images and
videos) contained in the user's account as long as the user has not edited the data or
removed the files from the profile. When a given Facebook account is deleted, Facebook
retains certain information relating to that account for at least one year, including user
identity information and IP logs.

35. In some cases, Facebook users may communicate directly with Facebook about
issues relating to their account, such as technical problems or complaints. Social
networking providers like Facebook typically retain records about such communications,
including records of contacts between the user and the provider's support services, as
well records of any actions taken by the provider or user as a result of the
communications.

PROBABLE CAUSE

36. On January 9,2011, a private citizen contacted the Fairhope Police Department
concerning child pornography that was posted on Facebook. Task Force Officer (TFO)
Stephanie Hollinghead, a Detective with the Fairhope Police Department, spoke to the
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 9 of 14

private citizenwho provided information on a Fairhope citizen thathadposted images of

child pornography on his Facebook account. (A review of the information provided by
the private citizen showed that there was child pornography posted to that Facebook
account).

37. On January 24,2011, SA Wilkerson spoke to the above private citizen who
advised of other child pornography that was being posted on various Facebook accounts.
The private citizen advised that there had been communication with one Facebook user,
"Terry Lewis." SA Wilkerson gained consent of the private citizento take over the
Facebook account and was able to see the account of the Facebook user, "Terry Lewis."

38. In addition, review of the private citizen's electronic mail account,

a
"avalittle@ymai1.com," shows that communication started with "Terry Lewis" on
January 21,2011. on January 22,2011,"Terry Lewis" sent messages asking:

'oAva, do you like to see pics and do you swap pics,

sweet, just asking, kiss"

oook
sweet, what ages do you like in girls, from the youngest
to the oldest, kisses, I feel as if I know you I do not know whjr"

oowow,
take me some pics please and fill me in real good,
i have about 25 albums of pics on here so far, I had to start over
when I was deleted, I will add you to see all, they range mostly
9-21 yrs old, I like them to be 10-16 myself, but in personal
Relationship, older 2I -3 5, kisses"

oo...give
me 10 minutes and you can see a few..."

On January 23,2011, "Terry Lewis" wrote the following message:

o'...hope
you have pics for me, i added you to see my pics
So far i posted, kisses"

39. On January 25,20Il,"Terry Lewis" communicated with SA Wilkerson, operating

undercover through the private citizen's facebook account, via Facebook's instant
messaging program. The communication from o'Terry Lewis" took place while SA
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 10 of 14

Wilkerson was at the FBI Mobile Division field office with an address of 200 North
Royal Street, Mobile, Alabama, 36602. (The communication was transmitted and
processed through the internet to the Facebook server located in Santa Claru,California
or Ashburn, Virginia). "Terry Lewis" expressed an interest in trading child pornography
pictures.

40. On January 25,2011, ooTerry Lewis" later sent the following Facebook message to
SA Wilkerson:

"Ava,I was hoping to chat with you and see how the weekend went,
I am so excited to see your pics sweetheart, I hope you like the ones
I open for you, kisses"

41. On January 25,2011, SA Wilkerson saw the "Terry Lewis" Facebook account
was being used to post over six hundred images of child pornography to include
prepubescent females with their genitalia exposed. The "Terry Lewis" Facebook account
also contained multiple videos of child pornography to include adults performing sexual
acts on prepubescent females.

42. On January 27 ,2011, SA Wilkerson received the following message from the
"Terry Lewis" Facebook account:

"Hi sweetheart, love to see what you look like and so excited to see
your pics, I hope you can find time to send, kisses I added some more
pics for you today, kisses and when you do send send to
tlewis9 8,76 @ gmail. com thanks"

43. On January 30,2011, SA Wilkerson, functioning undercover through a Facebook

account of ooAva Little," received a message from'oTerry Lewis,, as follows:

"Ava thanks for adding me again, i was not sure you were
the same Eva,thatwas friends with, so do we swap pics, and
do you still like young girls kisses i missed you,,

44. On February 2,2011, the "Terry Lewis" Facebook account was still posting
multiple images of child pornography to include prepubescent females with their
genitalia exposed.
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 11 of 14

45. Meanwhile, Facebook initiated an internal investigation once multiple complaints

l
were lodged against the "Terry Lewis" Facebook account. Facebook also disabled the
ooTerry
Lewis" account on more than one occasion. However, the "Terry Lewis" account
has persisted by using various user ids for a total of thirteen false Facebook accounts.

46. SA Wilkerson sent a preservation letter to Facebook on January 26,2011,

requesting that the o'Terry Lewis" account be preserved till further legal process follows.
on Facebooks' own initiative, on February ll,20ll, SA Wilkerson received an
electronic mail, with investigative reports, from the Facebook Investigation team
regarding the "Terry Lewis" account.

47. Facebook Investigative team was able to determine that the "Terry Lewis" account
was being controlled by another user, with the Facebook account of "Jerry Cannon." The
account of "Jerry Cannon" is a legitimate Facebook account and belongs to Jerry Cannon,
a pastor of God's House Church in Dry Ridge, Kentucky. (Jeny Cannon's profile
information lists his hometown as Mobile, Alabama, and the account has pictures of
various houses on Government Street and Dauphin Street in Mobile, Alabama).

48. A driver's license picture of Jerry Cannon, with a resident address of 225Shadv
Lane, Crittenden, Kentucky,4l}3},matches the profile picture of .,Terry Lewis.,,
Moreover, an additional Facebook account of "Theodore Lewis," linked to the account of
"Terry Lewis," contains identical pictures of Jerry Cannon and his daughter, Autumn.
(The profile pictures of "Terry Lewis" and "Theodore Lewis" match the driver's license
picture of Jerry Cannon. The birthdate of April 16, 1958 is listed in the profile
information for both "Terry Lewis" and "Theodore Lewis." fn addition, the birth date
listed on Jerry Cannon's drivers license is April 15, 1948).

49. Jeny Cannon is referred to specifically in one of the false Fakebook accounts of
Facebook user name "Theodore T. Lewis," with a user id of 100001486896448. The
Facebook account of "Theodore T. Lewis" was used to solicit child pornography through '

an elechonic mail account of t1ewis9876@gmail.com. (The tlewis9876@gmail.com

electronic mail account was also used in the other false Facebook accounts to solicit child
pornography).
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 12 of 14

50. On September 30, 2010, Theodore T. Lewis sent a message to Facebook user
"Cindy Vegas, with a user id of 100001486896448, saying that a o.very close friend of
mine Jerry Cannon who works for me" will send one hundred dollars from Wal-Mart.
ooKaren
On November 18, 2010, Theodore T. Lewis sent a message to Facebook user
Kuy," with a user id of 100000719473924,that states Jerry Cannon is going to send
another one hundred dollars.

51. On November 18, 2070, Theodore T. Lewis sent a message to Facebook user
"Keith Noble," with a user id of 1411910740, saying that his o'trusted employee, Jeny
Cannon" sent 100.00 to Karen. The messages between Keith Noble and Theodore T.
Lewis discuss enemas and Theodore T. Lewis asks Keith Noble to "just get her to make
me pics of things so I can feel as apart of it, more, I would love it..." Other messages
between the two indicate more money was sent for the production of possibly child
pornography.

52. Moreover, Jerry Cannon's personal Facebook account has been used to solicit and
gain child pornography. On April 16,2010, Jerry Cannon writes Facebook user, "Daisy
Green," with a user id of 100000562885114, the following:

"Well I like looking at young beautiful girls and I can not

seem to get it out of my system. I have tried to put it behind
me but can not seem to bury it."

Jerry Cannon states that his age range for child pornography is "10 and older" and
it is arranged that "Daisy Green" will send pictures to his electronic mail address of
j enylcannon4S@hotmail.com .

Further conversation discusses incest and Jerry Cannon says that he thinks about
his niece, who is ten years old.

53. On April 17,2010, Jerry Cannon wrote to "Daisy Green:"

"Thanks for the pics but a little young yet. I like pics of
11-13 yr old posing sexually looking like they enjoy it. topless
and nude shots. Thanks again, Anya jones has good pics on
Her profile you might like."
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 13 of 14

54. In addition, a review of the IP addresses used by the false Facebook accounts and
Jerry Cannon show that the same IP address is being used. On January 25,2011, when
SA Wilkerson observed child pornography on the Facebook user account of "Terry
Lewis," with auser id of 100001923827524,the Facebook accounts of Jerry Cannon and
"Theodore T. Lewis," with a user account id of 100001486896448, were also accessed
through the same IP address. In addition, the cookie values are the same.

55. The IP addresses listed in the above paragraphbelong to Insight Communications.

Insight Communication is a national company thathas an office at 10200 Linn Station
Road, Louisville, Kentucky, 40223. Insight Communications' Louisville, Kentucky,
office houses the server of the IP addresses listed in the above paragraph.

56. Insight Communications provided the following information upon service of a

subpoena: IP provider records show that the IP address used by J.ty Cannon and the
false Facebook accounts originate from 225 Shady Lane, Crittenden, Kentucky. (Jerry
Cannon lists 225 Shady Lane, Crittenden, Kentucky as his residence for his Kentucky
driver's license). Also, the Insight Communication account is registered to Donnie
Cannon, wife of Jerry Cannon.

CONCLUSION

57. Based upon all the information set forth in this affidavit, the Affiant respectfully
submits that there is probable cause to believe that Jerry L. Cannon, violated Title 18
U.S. Code, Section 52252A(a)(2XA), Certain Activities relating to Material involving the
Sexual Exploitation of Minors.

58. Furthermore, the Southern District of Alabama has jurisdiction in this matter since
the communications by Jerry Cannon, soliciting and diskibuting child pornography, on
and around January 25,2011, through the false Facebook account of "Terry Lewis,"
originated in Kentucky but were transmitted via the internet through Facebook servers in
California or Virginia and ultimately being received by SA Marya Wilkerson in Mobile,
Alabama.

In consideration of the foregoing, the Affiant respectfully requests that this Court
issue a Criminal Complaint and Arrest Warrant for Jerry L. Cannon for violation of Title
18 U.S. Code Section s2252A(a)(2XA).
 Case 1:11-mj-00052-C Document 1 Filed 02/16/11 Page 14 of 14

Respectfully submitted,

Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me

o" z/16 /t

illiam E. Cassady
United States Magistrate Judge