CASE 0:21-mj-00340-ECW Doc. 3 Filed 05/04/21 Page 1 of 2
CASE 0:21-mj-00340-ECW Doc. 3 Filed 05/04/21 Page 2 of 2
2021R00038
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MINNESOTA
UNITED STATES OF AMERICA
v.
MITCHELL JAMES OTTINGER
FILED UNDER SEAL PURSUANT TO 18
U.S.C. § 3509(d)(2) AND LOCAL RULE
39.1(c)(1)(G)
Case No. 21-MJ-340 (ECW)
AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT
I, Matthew Vogel, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1. I am a Special Agent of the United States Department of Justice, Federal
Bureau of Investigation (FBI), and have been so employed since July 2010. I am currently
assigned to the Minneapolis Division and the Minnesota Child Exploitation Task Force,
where my investigative responsibilities include investigation of child sexual abuse and
exploitation crimes such as production, possession, receipt, and distribution of child
pornography. I have gained knowledge and experience through training at the FBI
Academy, in service training, and everyday work in conducting these types of
investigations. I have received training in the area of child pornography and child
exploitation investigations and have reviewed numerous examples of child pornography as
defined at 18 U.S.C. § 2256, in various forms of media, including computer media.
2. I am an “investigative or law enforcement officer” of the United States within
the meaning of 18 U.S.C. § 2510(7), and am empowered by 18 U.S.C §§ 3052 and 3107 to
conduct investigations of, and to make arrests for, violations of federal criminal statutes.
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 1 of 18
PURPOSE OF AFFIDAVIT
3. I make this affidavit in support of an application for a Criminal Complaint
charging MITCHELL JAMES OTTINGER (DOB XX/XX/1996
1
) a/k/a “Rachel Meyer”
and “Taylor Malek” (hereinafter OTTINGER) with Threats via Interstate Communications
in violation of 18 U.S.C. § 875(d), and Production of Child Pornography and Attempted
Production of Child Pornography in violation of 18 U.S.C. §§ 2251(a) and (e).
4. To date, OTTINGER has used several Internet accounts to encourage and
direct minors to create sexually explicit images and videos
2
of themselves to send to
OTTINGER. To obtain child pornography, OTTINGER used techniques commonly
referred to as “catfishing” or “baiting,”
3
and generally involve OTTINGER posing as a
young female using the alias or “Taylor Malek” or “Rachel Meyer,” with a sexual or
romantic interest in a victim. If a victim acquiesced to “Rachel” or “Taylor’s” requests for
a sexually explicit image, and later blocked or ignored “her,” OTTINGER would contact
1
Per local rules and 18 U.S.C. § 3509, I have partially redacted personally identifying
information, such as dates of birth, from this affidavit. Unless otherwise noted, this
information is known to me and available to the Court.
2
For brevity, I have referred to such files collectively as “images” throughout this affidavit.
3
From my training and experience, I am aware that these terms refer to the act of using a
fictitious online persona to lure another person into an online relationship of some sort—
often with the goal of obtaining sexually explicit images of the other person. In my training
and experience, I am also aware that many adults engage in such “catfishing” by posing as
minors online in order to lure actual minors into taking and sending sexually explicit
images and videos of themselves.
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 2 of 18
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 3 of 18
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 4 of 18
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 5 of 18
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 6 of 18
11. On or about August 18, 2020, an FBI Minneapolis analyst searched for
information about the location of the developer or business responsible for the application.
The analyst sent an email to the listed “contact us” address for the application and inquired
about their location for service of legal process. In reply, a representative requested the
username of the account under investigation. The FBI analyst replied that the account under
investigation was “rachm786.” Later that day, the application representative voluntarily
provided certain information about the account. According to that information, the account
was created on July 21, 2020, and was active until at least on or about August 17, 2020.
The user self-reported location information was “Hudson.” Self-reported gender was
female. Without being asked to do so, a representative or representatives from the
application reviewed the contents of the account and voluntarily reported that the user “is
asking for people number, and then he stop chatting.” The application also voluntarily
provided the user’s authentication images and information about the user’s identity
authentication. The application confirmed that the user-submitted authentication images
must be uploaded from a live camera and cannot come from stored image galleries. The
authentication images consisted of four still images depicting an adult male wearing what
appears to be a light blue tank top with white lettering. The individual is seen making
certain hand signals corresponding with similar graphic hand signals superimposed on the
photograph (i.e., a closed fist, a thumb up).
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 7 of 18
12. I have reviewed the images sent by the application and found that the
individual depicted in the images bears a significant resemblance to known images of
OTTINGER.
13. On or about January 20, 2021, TextNow, Inc. provided records responsive to
an administrative subpoena for information associated with the -6740 and -6234 telephone
numbers used to text after blocked messages from “Rachel Meyer.” According to
TextNow, Inc. subscriber and registration records, the -6740 number was assigned to
account ID “bmike7406” between July 7, 2020 at 4:00:00 A.M. UTC
8
and September 24,
2020 at 3:59:59 UTC. The “bmike7406” TextNow account was created with
[email protected] as the registration address on September 20, 2019. The
“bmike7406” account was created on IP address
9
75.72.114.49. According to Google LLC
records, the same IP address was used to access [email protected],
[email protected], and [email protected]. According to TextNow, Inc.
8
An abbreviation for Universal Time Coordinated, which is an international coordinated
time scale.
9
A unique number or series of numbers and letters used by a computer to access the
Internet. IP addresses can be dynamic, meaning that the ISP may assign a different unique
number to a computer every time it accesses the Internet. IP addresses might also be static,
if an ISP assigns a user’s computer the same IP address each time the computer accesses
the Internet. The most familiar version of an IP address is IP version 4, which is a series
of four numbers separated by a period, e.g., 172.16.254.1. However, in recent years IP
version 6 has come unto use. IP version 6 addresses are eight groups of four hexadecimal
digits with the groups separated by colons, e.g.,
2001:0db8:0000:0042:0000:8a2e:0370:7334.
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 8 of 18
records, the -6234 account was assigned to account ID “ccandy7862” between July 9, 2020
at 10:54:53 P.M. UTC and August 25, 2020 at 6:07:07 A.M. UTC. The “ccandy7862”
account was created with [email protected] as the registration address on May 15,
2020. The “ccandy7862” account was registered on IP address 75.72.114.49, the same IP
address used to access rachelmeyer786@gmail.com, [email protected], and other
accounts described herein.
14. According to TextNow, Inc. message detail records, during the time the
-6740 number was assigned to the “bmike7406” account, it was used to send or receive
text messages to/from approximately 491 unique telephone numbers, including s
known telephone number. TextNow, Inc. message detail records for the -6234 number for
the relevant timeframe show the account was used to send or receive messages to/from
approximately 30 unique telephone numbers, including s known telephone number.
15. I applied for and was granted a search warrant in District of Minnesota case
21-MJ-80 (TNL) for records and the content of communications associated with TextNow,
Inc. accounts “bmike7406” and “ccandy7862.” TextNow, Inc. records contained messages
from the user using aliases “Rachel Meyer” and “Taylor Malek.”
16. Those records included the contents of text messages with For example,
on or about July 21, 2021, the “bmike7406” account wrote the following messages:
? Sorry you don’t have to. If u make me a hot video again I’ll send the
one I made I just wanted to make sure u weren’t like 13.
Unblock me? I’m sorry I’ll send it you do
I’m sorry
Its Rachel say something
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 9 of 18
Sometime later, the “ccandy7862” account sent the following messages:
Unblock me and be a good boy or I’
10
ll show my friends who will show
there’s and so on. U can’t just ghost me.
Be a good boy [
Now
CATFISHING/BAITING AND SEXTORTION OF
17. My review of the TextNow, Inc. records also revealed the “bmike7406”
account contacted date of birth XX/XX/2005. Messages in the account indicate
OTTINGER—posing as “Rachel Meyer”—contacted on or about June 21, 2020.
During the approximately 27 hours following initial contact, approximately 435 messages
were exchanged between “Rachel Meyer” and During the conversation, reported
he was entering 10th grade. “Rachel Meyer” purported to be 17 and entering 11th grade.
“Rachel Meyer” repeatedly requested sexually explicit images of including images of
his naked genitals. “Rachel Meyer” wrote, “Just send one chest abs and dick and ill send.”
From the context of the conversation, I believe “Rachel” was offering to send sexually
explicit images of “herself” in exchange for images sent by
18. Although there were no images retained by TextNow, Inc. pertaining to this
conversation, data within the account shows image files were sent by during the
conversation. According to the context of the TextNow, Inc. records, apparently sent
10
The text, “’” provided in the TextNow, Inc. records is an encoded apostrophe. I
have included the text of messages verbatim as shown in the TextNow, Inc. records,
including typographical errors of the messages’ writers.
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 10 of 18
at least one image of his own penis. As the conversation ended, “Rachel Meyer” suggested
“she” would send s “dick pic” to a minor friend of “Rachel Meyer” wrote, “if u
senf a full like u said I won’t show him ig.
11
” From my training and experience, as well as
the context of the surrounding conversation, I believe the reference to “a full” meant an
image showing s fully naked body. The conversation continued:
Rachel Meyer- If u send by 930 I won’t show him then. Deal?
Idk
12
you relies I’m only 15 and your blackmailing me to send a dick
pic?
Rachel Meyer- Full nude. And I’m 17.
I was going to tonight but now I can’t trust you.
Rachel Meyer- That’s a lie
Rachel Meyer- Haha send or ig I’ll show him
Rachel Meyer- So
Rachel Meyer- Guess thats a yes.
19. On or about March 15, 2021, was interviewed by an FBI
Child/Adolescent Forensic Interviewer. I observed the audio/video recorded interview.
recalled the above conversations and confirmed that he took and sent a photograph of
his naked penis at “Rachel Meyer’s” direction. hoped that by complying with “Rachel
Meyer’s” “annoying and aggressive” requests, she would leave alone. described
the image as a “selfie” he took in front of the bathroom mirror at his home. His naked penis
was visible in the image.
20. attends a school in SCHOOL DISTRICT 1.
11
An abbreviation for “I guess.”
12
An abbreviation for “I don’t know.”
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 11 of 18
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 12 of 18
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 13 of 18
GOOGLE ACCOUNT CONTENT
23. As mentioned above, the investigation involved search warrants on email
accounts believed to have been used by OTTINGER. One of those accounts,
[email protected], received an email on or about January 10, 2021, on the subject
“Welcome to ‘Exposure Game.’” The email documented registration of an account on a
web forum “for adult guys only.” The username selected contains s first name.
24. In response to administrative subpoenas and search warrants (see 21-MJ-81
(TNL) and 21-MJ-289 (KMM)), I received records from Google LLC associated with
thirteen Gmail accounts, including three containing OTTINGER’s first and last names as
part of the username. Google LLC records showed the accounts were connected through
association by use on common IP addresses (including at least one IP address resolving to
an identified individual at OTTINGER’s Carver, Minnesota residence), use on common
devices (i.e. accounts were accessed on the same device ID(s) or connected by cookie), by
use as recovery accounts for each other (i.e. [email protected] has
[email protected] as a recovery address), and/or through emails sent between
accounts (i.e. [email protected] sent pictures of young females later used to
send to boys or men to bmike7406@gmail.com; bmike7[email protected] and
[email protected] sent Google Drive collaboration requests for folders titled
“Boys” and “Guys” to taylor[email protected]). Based on this evidence, I believe all
of the accounts were established, controlled, and used by OTTINGER.
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 14 of 18
25. In my review of the Google LLC records, I found evidence suggesting that
OTTINGER had been engaged in sextortion and baiting/catfishing activity since at least
2012. Internet search history on the [email protected] account that year included
searches for videos about “how to fake your webcam for chat roulette or omegle.
15
” Later
emails between [email protected] and [email protected] contained
screenshots of an Omegle chat between a female persona and a purported 16-year-old boy
along with sexually explicit images of that boy. In the following years, email activity and
search history on other accounts shows OTTINGER enrolled in a newsletter for an
application used to “fake” a user’s live camera
16
(on [email protected]), and
searched for information on “girl peace sign,” “pussy pic middle finger,” “fake kik
camera,” “how to fake snap,” and “how to send pics from the photo library on Snapchat”
(on [email protected]). In my training and experience, I believe these searches
together constituted research on how to successfully deploy a young, female persona or
personae to lure boys and men into producing and sending sexually explicit images to
OTTINGER.
15
Both are online video chat services which randomly connected users to chat partners and
are commonly used by children and child pornographers alike.
16
Some chat applications—such as Snapchat and Kik—have features that allow users to
distinguish between pictures taken contemporaneously on a mobile device’s camera and
those uploaded from storage space. These features are intended to allow parties to know
they are chatting with a depicted person. “Baiters” and “Catfishers” may use sophisticated
techniques and software to defeat these features, allowing them to appear as someone they
are not.
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 15 of 18
26. Many of the Google accounts were used to register online accounts for dating
services such as Tinder, social media accounts using the name “Taylor,” “Rachel,” or
variations thereof, and several Twitter accounts. Twitter activity in the Google accounts
included email notifications to the user about incoming Twitter direct messages from
Twitter accounts with display names such as “United Baits of America” and
“embarassMENt.” One of the accounts sending direct messages discussed a “method” for
sale, “and not for just one boy,” then wished OTTINGER “happy baiting.”
27. The Google accounts contained significant evidence attributing their
ownership and use to OTTINGER. For example, [email protected] contained
emails from the Minnesota Professional Educator Licensing and Standards Board with
information on OTTINGER’s educator license. The account also contained emails from
SCHOOL DISTRICT 1 where OTTINGER is employed as a substitute teacher and
paraprofessional. The account contained an image of OTTINGER’s work badge for an
identified elementary school in SCHOOL DISTRICT 1.
28. [email protected] contained several emails arranging sexual
encounters. These emails appear to involve other adult males. Some of these emails
included an image of OTTINGER picking apples.
29. [email protected] contained an email from “Mitchell Ottinger” on an
email address domain controlled by the University of Minnesota. The email contained a
cropped and edited version of the aforementioned image of OTTINGER picking apples. It
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 16 of 18
also contained an email from Amazon confirming an order sent to MITCHELL
OTTINGER at his identified Carver, Minnesota address.
30. The [email protected] account also contained images of
apparent child pornography stored in the Google Photos service. For example:
a) On or about December 7, 2018, the user of taylormalek3758@gmail.com uploaded
a file ending in -3764.jpg. The file is an image depicting a boy approximately 10-
13 years of age sitting naked holding his penis. The image has text superimposed
reading, “Send Daddy.”
b) On or about August 11, 2018, the user of [email protected] uploaded
a file ending in -3765.jpg. The file is an image depicting prepubescent three boys
sitting naked. Two of them—approximately 4-6 years of age—are in poses
displaying the genitalia;
c) On or about October 4, 2017, the user of [email protected] uploaded a
file ending in -5408.mov. The video is approximately 5 minutes 12 seconds in
duration and depicts an older male raping a toddler.
31. Based on information provided by Google LLC, these files were stored in the
account and available to the user as of at least on or about April 19, 2021.
CONCLUSION
32. This investigation remains ongoing, as are victim identification efforts.
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 17 of 18
CASE 0:21-mj-00340-ECW Doc. 3-1 Filed 05/04/21 Page 18 of 18
