(The documentation below was submitted to the Ohio Internet Crimes Against Children Task Force on June 12, 2009. This public version has been modified to remove some of the actual names. — R.J. Carter)
The following is a summary of the Toledo, Ohio-based activities of a pedophile CP production and distribution ring centered around BoyChat member and pedophile Anakinboy10 aka YouTube username LoganSperman2.
Two years ago, Troy Riser (then-YouTube username ‘troyriser’) and others posted a series of videos—known as ‘vlogs’ on YouTube— exposing and publicizing the attempts of an online pedophile ring calling itself ‘The YouTube Vigilantes’ or ‘YTV’ to gain influence over a children’s video-making group called Young Tubers United, which is in turn ran by YT user ‘Jesari’ a now-14- year-old boy whose first name is Jesse, along with his father. The membership of Young Tubers United numbered thousands of children, at one point, and made several feature ‘kid collaboration’ videos garnering millions of views. There was talk of corporate sponsorship. A separate website distinct from YouTube was established. This separate Young Tubers United website contained a Frapper map holding the physical and email addresses of hundreds of children, who would supply this information—along with photographs—to show support for this kids’ group. Videos made by Troy Riser and others questioned the purpose of such a website and the gathering of personal information. Later, an attempt was made to establish a chat forum with nonexistent safeguards, allowing real-time interaction between the YTU children and anonymous adults. The forum was in place for a short time before YouTube username ‘Logansperman2’ ordered Charles Daigley, the YTU site webmaster, to remove it due to the unfavorable publicity the forum was generating. A screencap of the YTU homepage, shown below.
The YouTube Vigilantes (YTV) claimed (and still claim) to be a group of concerned adults who ‘fight haters’ and ‘help children.’ The following YouTube users are the central members of the YTV, although there are several—perhaps dozens—more:
• Logansperman2: identity unknown; claims to be a teenager although an analysis of ‘Logan’s’ voice captured from a YTU site snapvine call by audio engineer [engineer’s name] of [company, city, state], determined that ‘Logan’ is an adult using voice changer or audio editing software to make his voice sound like that of a child. A visual analysis by YT user ‘HeyItsFey, a former police artist, of one of Logan’s videos and several of his photographs demonstrates a clumsy attempt at ‘head-on-body’ Photoshop manipulation. The audio file containing ‘Logan’s’ voice has been attached to this or subsequent emails. Logansperman2 is, in all probability, Ohio pedophile Anakinboy10.
• TBD1000: [given name], a software engineer and metrics expert from [country].
• Irish282: [given name], a refurbisher of musical instruments from [city, state].
• Dynacatlovesme: [given name, state]
• Th3C0br4: name unknown. First name possibly ‘Iain’.
• Other known pedophiles with direct or peripheral involvement in the Young Tubers United group include BoyChat member ‘Santi’ (YT user Santi101), BoyMoment member BigCD, whose real name is [actual name] of [city, state], BoyChat member ‘Slvrspun’ (YT user ‘Silvrspn’ whose real name is [actual name], of [country]), BoyChat member ‘Oldtimer’ (YT user ‘Oldtuber’), former YT user TobrianHorde, BoyChat webmaster ‘DylanThomas’, whose real name is John Schillaci, formerly on the FBI’s Most Wanted list and currently serving life in prison.
The following screen capture shows the purported PM exchange between BoyChat member Santi (YT username Santi101) with Jesse (last name unknown; former YT user Jesari and current owner of YT channel ‘Youngtubersunited2’)
THE JAKERISER CHANNEL
On January 15, 2008, pedophiles created a YouTube channel featuring Troy Riser’s then 14-year-old son, Jacob.
The JakeRiser YouTube channel contained Jacob Riser’s photographs pulled from his boxing gym web page, his full name, address, school, the names of his mother and sister, the route he used to go to school, and other detailed information. Troy Riser was told by the JakeRiser channel’s creator, later determined to be [actual name] (an exposed BoyChat pedophile , former YT user ‘kwclark’ and current YT user ‘SmugMugg’, of [city, state]), to shut down his ‘troyriser’ channel or other channels would go up featuring his teenage daughter, Maggie. The FBI was notified regarding child endangerment and interstate transmission of a threat (Agent [agent’s name], [email address]@ic.fbi.gov ) and numerous complaints were submitted to YouTube. Once the JakeRiser channel went down, however, another one—JakeRiser2—took its place, along with the LoriRiser channel, this time featuring Troy Riser’s ex-wife.
[‘SmugMugg’] closed all of his JakeRiser and LoriRiser channels once FBI involvement became known. After several months, he reopened a new YT channel, SmugMugg.
On January 28, 2008, in response to the then-ongoing extortion attempts against Troy Riser, Riser’s longtime friend and writing collaborator R.J. Carter wrote and posted an editorial at The- Trades.com, a commercial website reviewing pop culture and entertainment trends. The article was entitled “YouTube: Pedophile Playground”. The-Trades.com, like most commercial sites, captures and keeps detailed visitor records. This data was used to identify [‘SmugMugg’] as the pedophile primarily responsible for the JakeRiser channels, and captured the IPs of several of the posters responding to the article, and as a later source for the IPs of the article’s readers. (Refer to Appendix A for complete article text.)
The-Trades.com later removed the article after a letter was sent to The-Trades publisher threatening legal action on behalf of one [given name], who operates YouTube account Irish282. [Given name], strongly suspected of being an online predator, was/is an adult agent for the YTU video-making group, and regularly files DMCA notifications on its behalf. The letter, signed ‘ytu’ was sent from the email address of firstname.lastname@example.org. The profile for this account, created by the Frappr mapping utility linked to the website, displays a supposed photograph of the owner, shown below, which matches images used in videos created by YouTube username LoganSperman2, represented as himself. (Refer to Appendix B.) The email headers showed the complaint email was sent from IP address 22.214.171.124, resolving to Toledo, Ohio.
LoganSperman2 has a documented history of asking children to dance for him on video:
THE JRADEN LETTER
The article was then reposted as a WordPress blog (https://therjcarter.wordpress.com/youtube-pedophile-playground) where it quickly received a dissenting post from a user signing as JRaden (https://therjcarter.wordpress.com/youtube-pedophileplayground#comment-4. (Refer to Appendix C for full text.)
JRaden’s response followed several of the regular talking points utilized by YouTube user LoganSperman2, employing many (if not most) of Logan’s stylistic mannerisms and ticks. The IP address 126.96.36.199 extracted from this email resolved to the Toledo, OH server.
The JRaden posting also left behind an email address, Jeremy75000@hotmail.com. A quick search showed this to be the same email address used to register the YouTube channel, JeremyAndFriends.
The JeremyAndFriends channel’s main featured video is a solicitation for donations for a new web camera. The video features an obvious editing cut when the subject speaks the email address, demonstrating that the video itself has—in all probability—been culled from the Internet. More importantly, the video description bar includes the Jeremy75000@hotmail.com address as a point of contact—the same email address used by ‘jraden’.
The ‘Help Me I Need Money’ video is posted throughout the Internet. Note the advertisement for a custom video.
A query was sent to the Jeremy75000@hotmail.com email address, asking the channel’s owner how funds might be delivered. The following response was received:
Please note the email exchange between our operative and the owner of the ‘Jeremyandfriends’ YouTube channel can be viewed in its entirety by accessing the original Live.com email account used to initiate the exchange, as follows:
The IP can be stripped from the ‘jeremy’ emails, furnishing solid independent evidence.
Additionally, note the difference in writing styles between JRaden’s WordPress comment versus his email.
Note the AnakinBoy10@gmail.com email address used to accept donations via payoneer for JeremyAndFriends ‘camera fund’. Anakinboy10 happens to be a member of BoyChat:
Anakinboy10 has a web presence under that username going back at least six years. His focus is the distribution of boy-related images and videos. On one of his accounts, he gives his age at 30.
In the following exchange, Anakinboy10 is promoting a site called ‘boymodels’:
The Anakinboy10 email address is also the point of contact for payment for videos sold through http://www.boymodels.tk , which has been ‘temporarily’ shut down.
In lieu of the boymodels website, Anakinboy10 established a video gallery at http://www.freewebs.com/videogallery2/.
EVIDENCE OF CHILD PORNOGRAPHY PRODUCTION & DISTRIBUTION
Because the ‘gallery’ has been extensively scrubbed since its existence and connection to YT user Logansperman2 was established, the original is presented in screencaps, as follows. The overly long html page has been sectioned for inclusion here:
Of urgent interest is the line at the bottom advertising ‘kids and teens available for modeling’, now expunged from the freewebs page. An example of his advertising for this aspect of his business is below:
Important: As the above advertisement demonstrates, Anakinboy10’s advertised ‘products and services’ include ‘custom’ videos of children, which in turn implies the actual production of child pornography, child exploitation, prostitution, and sexual assault.
THE MONEY TRAIL
It turns out the preferred method of payment for Anakinboy10’s operation is Amazon gift certificates, thus hiding the money trail. In all probability, the gift certificates are used to buy products from Amazon, which are then in turn sold on eBay or other online outlet.
THE IP TRAIL CONTINUED
By means of his ‘Acme Cleaning Services’ blog, our operative (known as ‘Rez’) captured two postings by the man known as LoganSperman2 — one on http://pub37.bravenet.com/forum/3141133667/fetch/633508 — and derived two additional IP addresses, both of which resolve to the Toledo, Ohio Internet cluster:
The following table documents the connections made from LoganSperman2 to JeremyandFriends to Anakinboy10, with IP addresses that all track to the Toledo, OH Internet node.
Table 1: IP by Identity, History
|Trades FormMail||188.8.131.52||PPPoX Pool – rback5.toldoh 032305-0800 (C01045631)|
|Bravenet Posting||184.108.40.206||PPPoX Pool – rback5.toldoh 080805-1034 (C01149958)|
|Rez #2||220.127.116.11||PPPoX Pool rback5.toldoh 080805-1031 (C01149956)|
|ACME Blog||18.104.22.168||PPPoX Pool – se2.toldoh-1218090961 (C02008052)|
|Email via Yahoo||22.214.171.124||PPPoX Pool – rback5.toldoh (C01242104)|
|WordPress Posting||126.96.36.199||PPPoX Pool – rback5.toldoh 080805-1034 (C01149958)|
|Email Response||188.8.131.52||PPPoX Pool – se2.toldoh-1218089461 (C02008017)|
|Email Feb 9||184.108.40.206||PPPoX Pool – se2.toldoh-1218093061 (C02008056)|
|Email Feb 12||220.127.116.11||PPPoX Pool – se2.toldoh-1218093061 (C02008056)|
(revised table to improve viewing and include newly obtained IP address)
A well-organized, tightly networked group of Internet-savvy online predators has executed a plan to ingratiate themselves with a children’s video collaboration group on YouTube for the long-term purpose of producing and distributing soft- and hardcore child pornography. Over the past few years, these men (and perhaps a few women) have attempted to establish a pedophile-friendly chat forum under the auspices of that kids’ group, and used support for that group’s website to amass the names, email addresses, physical location, and photographs and videos of hundreds of those children. One of the central figures of this pedophile ring is BoyChat member Anakinboy10, who is—in all probability—YouTube username ‘Logansperman2’, a pedophile proven to be a grown man presenting as a teenager online and who has constructed an elaborate persona using faked kid videos and a well-developed, fully realized teenage boy persona. The focus of all of this online pedophile activity invariably resolves to IP addresses in Toledo, Ohio.
The threat to children here is immediate, real, and ongoing. It is vitally important the identities of those children being used to make Anakinboy10’s ‘custom’ videos be found out immediately, as well as those children being groomed for such a role.