Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Galarza

United States District Court, District of Columbia

May 8, 2019



          BERYL A. HOWELL Chief Judge

         The government has appealed a Magistrate Judge decision denying the government's motion for pretrial detention of the defendant, Vincent Galarza, who has been charged by criminal complaint, with knowingly conspiring to Distribute Child Pornography through Interstate Commerce, in violation of 18 U.S.C. § 2252(a)(2) & (b)(1), Crim. Compl. at 1, ECF No. 1, based on evidence that the defendant, from approximately June 25, 2016 to December 21, 2016, uploaded more than 500 videos depicting child pornography to, and from approximately May 31, 2017 to February 9, 2018, downloaded approximately 174 videos from, a website (“the CP Website”), which was hosted overseas “as a hidden service on the Tor network” and “dedicated to the advertisement and distribution of child pornography, ” Aff. Supp. Crim. Compl. and Arrest Warrant (“Franklin Aff.”) at 3, 6, ECF No. 1-1.[1] This is the government's second attempt to have the defendant detained pending trial. The government's first effort was based on information contained in the criminal complaint detailing the defendant's distribution of child pornography; the second unsuccessful request for detention, giving rise to the instant appeal, is based on additional evidence that the government has only recently discovered, namely, that the defendant surreptitiously recorded a minor in her bathroom and bedroom, used those recordings in an attempt to extort her for additional videos, crawled into bed with the same minor on multiple occasions when she was 12 years old, and has threatened to rape the minor's adult sister, while holding a pellet gun. Gov't's Mot. for Review and App. of Release Order (“Gov't's Mot.”) at 9-13, ECF No. 18.

         This Memorandum Opinion sets out the findings and reasons for detention. See 18 U.S.C. § 3142(i)(1) (requiring that a detention order “include written findings of fact and a written statement of the reasons for the detention”); see also United States v. Nwokoro, 651 F.3d 108, 109 (D.C. Cir. 2011) (noting that the Bail Reform Act requires pretrial detention order be supported by “a clear and legally sufficient basis for the court's determination” in written findings of fact and a written statement of the reasons for the detention or in “the transcription of a detention hearing” (quoting United States v. Peralta, 849 F.2d 625, 626 (D.C. Cir. 1988))) (per curiam).


         Following the defendant's arrest, on December 11, 2018, in the Eastern District of New York, the government's motion for pretrial detention was denied by a Magistrate Judge in that district at a detention hearing held the same day. Gov't's Mot. at 1. The government did not appeal. Id. Then, on December 19, 2018, the defendant appeared before a Magistrate Judge in this district, where the charges arose, and the defendant was again released, with the government's consent, on the same release conditions previously imposed in the Eastern District of New York, which conditions included that the defendant was restricted to home detention at his parent's house, with location monitoring, and no travel outside New York City or Washington, D.C. without Court approval, and that he not have contact with any minor or use any device with internet access, along with execution of a $200, 000 bond secured by real property. Order Setting Conditions of Release at 2, ECF No. 6. Minute Entry (Dec. 19, 2018); Order (Dec. 28, 2018), ECF No. 10. During the ensuing five months, the defendant agreed to exclude time under the Speedy Trial Act, 18 U.S.C. § 3161(h)(7)(A), see, e.g., Minute Entry (Dec. 19, 2018); Order (March 20, 2019); Minute Entry (May 3, 2019), and the government continued its investigation. Specifically, the government conducted forensic examinations of both the server that hosted the CP Website after the server was seized by South Korean law enforcement and the defendant's electronic devices, which included a self-built computer consisting of multiple hard drives in a RAID (Redundant Array of Independent Disks) configuration and was lawfully seized pursuant to a search warrant at the time of the defendant's arrest. Due to the complex “electronic configurations” of the defendant's computer, “it took law enforcement considerable time to forensically extract and review the approximately 1.7 million images and videos recovered from the device” and “to override the defendant's password, ” Gov't's Mot. at 10.

         The government's investigation uncovered evidence of additional criminal conduct by the defendant, prompting the government to seek reconsideration of pretrial detention. See Gov't's Mot. Reconsider Def.'s Bond Status, ECF No. 12. On May 3, 2019, the Magistrate Judge denied the government's motion and continued the defendant on pretrial release, after imposing the additional conditions that the defendant have no contact with witnesses and not receive any visitor who is in possession of any device with internet access. See Order Denying Gov't's Mot. for Reconsideration and Modifying Conditions of Release to Add Additional Conditions, ECF No. 17. The government's filed an appeal of the release order, on May 5, 2019, Gov't's Mot. at 1, and a further detention hearing was held by this Court on May 7, 2019, Minute Entry (May 7, 2019).

         At the most recent detention hearing, the government relied, as support for seeking the defendant's pretrial detention, on both the factual proffer set out in the criminal complaint, as well as a summary of the new evidence obtained by the government through forensic analysis of seized electronic devices, and witness interviews.

         The multiple steps that the defendant took, over many months, as user “thisthishold, ” in order to access child pornography content on the CP Website, is indicative of his overall commitment to distribution of child pornography. The website was a Tor network-based child pornography website, meaning it anonymized Internet activity “by routing user's communications through a global network of relay computers (or proxies), thus effectively masking the internet-protocol (“IP”) address of the user.” Franklin Aff. at 2. Thus, to access the CP Website, the user had to install Tor software, “which relays only the IP address of the last relay computer (the “exit node”), as opposed to the user's actual IP address.” Id. Then, to download content from the CP Website, users had essentially had to pay in “points, ” which could be earned in various ways, including, as relevant here, uploading videos depicting child pornography, or paying for points with bitcoin (“BTC”). Id. at 3-4. A user earned additional points when other users of the CP Website downloaded a user's videos. The website “operated a digital hash-value check of videos uploaded to the CP Website” to ensure that any videos uploaded were unique compared to other videos on the site, id. at 4, thereby ensuring that users only received points for uploading child pornography not already on the website. Thus, when the defendant uploaded more than 500 videos between approximately June 25, 2016 and December 21, 2016, id. at 6, he was likely accruing points on the CP Website to use for future downloads. Indeed, following the period when the defendant uploaded all the videos to the CP website, he then, between approximately May 31, 2017 and February 9, 2018, downloaded approximately 174 videos of child pornography from the CP Website. The CP Website also allowed users to purchase a “VIP” account using BTC, id. at 3, which the government believes the defendant to have done, on December 17, 2016, id. at 5-6 n.5.

         After law enforcement seized the website's server in South Korea, they were able to pull back the veil of anonymity in which the website's users had hidden their activities. As relevant here, a forensic image of the server “revealed a transfer of approximately 0.00228809 BTC (worth about $1.80 at the time of transaction) on December 17, 2016 from a BTC address to [the CP] Website's BTC address starting with 1Hrb.” Id. at 5. Law enforcement subpoenaed a virtual-currency exchange in the United States, which is required by U.S. law to collect identifying information on its customers, and learned that the BTC transfer starting with 1Hrb was from a BTC Exchange Account number starting with 5855, which was created on or about December 17, 2016 and registered in the name of the defendant, using the defendant's confirmed phone number and email address. Moreover, the BTC Exchange Account was funded by a checking account and credit card account registered in the defendant's name. Thus, the government has provided compelling evidence that the website user who uploaded and downloaded child pornography to and from the CP Website is the defendant.

         The defendant's use of the CP Website was confirmed upon forensic examination of his own computer, which contained “at least two videos that thisthishold uploaded to” the CP Website. Gov't's Mot. at 10. This computer also contained over 500 videos and images of child pornography, most of which depicted sexually explicit conduct of pre-pubescent children. Id. Among the videos recovered from the defendant's computer were eleven videos of the 14-year old younger sister (“Cooperating Witness” or “CW1”) of the defendant's former girlfriend (“W2”).

         Upon subsequent investigation, the government learned that the defendant had surreptitiously produced the child pornography of CW1 from two hidden cameras during the six-month period of March to August 2014. The defendant's own face was recorded on at least two occasions as he covertly set up, and later adjusted the angle of, a camera hidden in the CW1's bathroom, to secretly record CW1, as she undressed and used the shower. Gov't's Mot. at 10. These videos had been edits and clipped to produce over 900 still-shot images focusing on CW1's “genitalia and pubic area.” Id. at 11.

         In addition, forensic examination of the defendant's computer has revealed that the defendant hacked into the computer in CW1's bedroom and remotely activated her web camera to record her in various stages of undress. Id. at 12. As confirmed by CW1 during an interview on April 29, 2019, the defendant used one of the images he obtained of CW1 in her bedroom with her breasts exposed to extort CW1, threatening to release a nude photo of CW1 unless she shared more images or videos with the defendant. Id. at 12. Forensic examination of the defendant's computer uncovered this image of CW1 with the word written on it “to the effect of ‘show me more vids or I'll show everyone.'” Id. “Thereafter, CW1 immediately dismantled her web camera and got a new computer.” Id.

         In addition to this attempted extortion, CW1 told law enforcement that beginning in 2012, when she was just 12 years old, she began locking her bedroom door because the defendant would get into her bed while she was sleeping, and on multiple occasions, starting when she was approximately 11 years old, the defendant touched her on the buttocks inappropriately when walking past her. Id. at 11-12.

         The defendant's former girlfriend, W2, who as noted is the older sister of CW1, has advised law enforcement of an incident in which the defendant, on January 1, 2016, entered the bedroom of W2's adult sister (“W3”), who was asleep. Id. at 13. W3 woke up to find the defendant standing naked next to her bed and holding a pellet gun to her head and threatening to rape W3. W3 filed a police report about the incident, which ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.