AO 91 (Rev.

11/11) Criminal Complaint

UNITED STATES DISTRICT COURT
for the
__________ District of __________
United States of America )
)
)
)
)
)
)
v.
Case No.
Defendant(s)
CRIMINAL COMPLAINT
I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
On or about the date(s) of in the county of in the
District of , the defendant(s) violated:
Code Section Offense Description
This criminal complaint is based on these facts:
u Continued on the attached sheet.
Complainants signature
Printed name and title
Sworn to before me and signed in my presence.
Date:
Judges signature
City and state:
Printed name and title
District of Massachusetts
GARY S. SPRING
14-mj-04291-DHH
June 2014 to present Essex
Massachusetts
18 USC 2252(a)(4)(B) and
2252A(a)(5);
Possession of child pornography.
See Affidavit of FBI Special Agent Laurence Travaglia, attached hereto.

Laurence Travaglia, FBI Special Agent

09/19/2014
Boston, MA DAVID H. HENNESSY, U.S.M.J.
ur ur uur ur urreeeeee
d tit tle le le le le le le le
SYYYYYYY, U , UU , U , U , U , U.S .S .S .SS .S .S.M .M .M .M .M .M .M .M.J .J .J .J .J .JJ.
AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT
I, Laurence A. Travaglia, a Special Agent with the Federal Bureau of Investigation, being
duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI), United States
Department of Justice, and have been so employed for approximately twenty four years.
Since March 1991, I have been assigned to the Boston Division and I am currently assigned
to the Lowell Resident Agency in Lowell, Massachusetts, where my primary duty is the
investigation of general criminal matters, including but not limited to bank robbery offenses,
white collar crime and public corruption. Prior to my current assignment, I was a
Supervisory Special Agent within the Boston Division, initially overseeing the operation of
the Boston FBIs Bank Robbery/Violent Crimes Task Force, which included the Crimes
Against Children program, and subsequently assuming management responsibility for the
Boston FBIs Organized Crime Task Force. I have participated in numerous investigations
involving child pornography, and I am currently investigating the activities of Merrimack
College Professor Gary S. SPRING, who is the chairman of the colleges Civil Engineering
Department.
2. As will be shown below, there is probable cause to believe that SPRINGs possessed and/or
accessed child pornography, in violation of 18 U.S.C. 2252 and 2252A. Since this
affidavit is being submitted for the limited purpose of securing a criminal complaint, I have
not included each and every fact known to me concerning this investigation. I have set forth
only the facts I believe are necessary to establish probable cause to believe that SPRING
possessed child pornography in violation of 18 U.S.C. 2252 and 2252A.
2

INVESTIGATION
Initial Investigation
3. On June 30, 2014, North Andover Police Department (NAPD) Detectives responded to
Merrimack College (MC) per the request of MC Campus Police Chief Michael DelGRECO.
Upon arrival, the Detectives were informed that MCs Information Technology (IT)
Department had uncovered suspicious activity associated with one of the colleges loaner
computers, herein referred to as the subject computer. IT personnel were notified via e-mail
that virus threats had been detected on the subject computer on June 29, 2014.
1
Investigation by IT personnel disclosed that the virus alerts were triggered when the subject
computer was used to access a series of .JPG photos resident in a file folder labeled LF
little katya. IT personnel advised investigators that the user of the subject computer was
required to address a popup notification acknowledging that a virus was detected, and
affirmatively had to address the alert on the subject computer, or the alert would remain on
the screen until it was addressed. Investigation further disclosed that the .JPG photos
triggering the virus alert were labeled Chiquititas_Melina, and that approximately 40
photos were accessed and/or viewed using the subject computer. Because these file names
were potentially indicative of child pornography, IT decided to further investigate the cause
of the virus alerts.
4. IT personnel were subsequently able to determine that the subject computer was signed out
to SPRING on June 11, 2014, and that SPRINGs logon credentials were used to access

1
Upon detection of a virus on the computer, anti-virus software installed on the computer will
send a general email to MCs IT department, identifying the computer, the user login
information, and the name of the file causing the virus alert.
3

MCs network at the time the virus alerts were triggered. IT personnel advised law
enforcement that the subject computer accessed the MC college network via a WiFi
connection at the time the virus threat was detected.
5. The investigating detective was informed by IT personnel that the intended purpose, or use,
of the subject computer was to assist the civil engineering department in the administration
of a summer camp. By way of background, for the last several years, MC has received
federal funding, by way of grants, to host a residential youth summer camp for middle and
high school aged children. SPRING has been the administrator of this camp since its
inception.
6. On June 30, 2014, in an effort to confirm who possessed the subject computer at the time the
virus threats were detected, the investigating detective cross-referenced the colleges WiFi
access log, which showed date and time accessed, with available surveillance tapes. The log
indicated that, on June 29, 2014, SPRING connected to MCs WiFi in the cafeteria area of
the campus. A review of the surveillance tapes confirms that SPRING was in the cafeteria
on the date and during the time that MCs WiFi was accessed. SPRING was observed on
the tapes to be in possession of a black laptop bag fitting the general description of the
subject computer. The surveillance tapes are currently in the possession of the MC Campus
Police Department. After it was confirmed that SPRING was in possession of the subject
computer, law enforcement officials located SPRING in his office at MC, where they
conducted a voluntary interview.
The SPRING Interviews
7. During his initial interview, SPRING confirmed that he was in fact in possession of the
subject computer at the time the virus was detected on June 29, 2014. SPRING denied
4

having any knowledge of the virus threat alerts, and denied taking any action to address the
active virus threats. SPRING further indicated that the computer was functioning normally.
SPRING was asked to produce the subject computer, at which time he directed investigators
to a chair in his office where the subject computer was located. During this interview,
SPRING further advised that he had requested that the subject computer be wiped by the
IT department, which was scheduled for the following day. SPRING stated that he
requested that the subject computer be wiped to allow him to install camp software on the
computer. Investigators then took possession of the subject computer, and decided to
confirm by serial number with the IT department that it was in fact the subject computer.
Investigators then exited SPRINGs office through the front of the science building.
8. While en route to the IT department, investigators were caught off-guard when SPRING
suddenly appeared right behind them. SPRING had apparently exited his office through a
different door in order to intercept investigators before their arrival at the IT department.
The investigators asked SPRING what he was doing. SPRING responded that he too was
going to the IT department about the subject computer, because he wanted IT to call him
after the computer was checked. Shortly thereafter, SPRING abruptly left the college
campus. SPRINGs actions were highly unusual, as SPRING was the administrator of the
summer camp, it was the first day of camp, and SPRING was abruptly leaving. SPRING
was then contacted by MC Chief DelGRECO, who explained that investigators had
additional questions to ask him. SPRING was asked if he would voluntarily return to the
campus and submit to a second interview. SPRING agreed without hesitation.
9. Upon his return, and during his second interview, SPRING again denied any knowledge of a
virus threat detection, insisting that the subject computer was functioning properly while in
5

his possession. When asked what the subject computer was being used for and how SPRING
used it, SPRING indicated that he was working on a PowerPoint presentation that he had on
a thumb drive. SPRING described the PowerPoint presentation as containing photos of
students from past summer camp programs. SPRING advised that the photos used in the
presentation originated from himself as well as from others who supplied the photographs to
him. SPRING then produce a thumb drive from his pocket, and indicated that it was MCs
property and investigators were free to examine it.
10. SPRING then informed investigators that the thumb drive he produced was not the thumb
drive he had used on June 29, 2014, and stated that the thumb drive he used on that date was
located in his office. SPRING walked with investigators in the direction of this office,
walked past his office, and went into a computer lab, where he demonstrated a PowerPoint
presentation he was working on for MC. Investigators asked where the second thumb drive,
used on June 29, 2014 was located, and SPRING took a second thumb drive from the
desktop computer in the computer lab and provided it to investigators. SPRING then left
the computer lab.
11. During both interviews with law enforcement, SPRING indicated that he left the subject
computer in the MC cafeteria unattended and logged into the network for approximately 30
minutes, as he ushered camp attendees into the cafeteria. Video surveillance footage shows
SPRING in the cafeteria, but given SPRINGs positioning, the open nature of the cafeteria,
and the location of the subject computer, SPRING would have noticed if another party was
accessing it.
12. IT personnel subsequently confirmed that, on June 30, 2014, the computer in SPRINGs
possession, and turned over to investigators, was in fact the subject computer.
6

FBI Forensic Computer Examination
13. On July 29, 2014, I took possession of the subject computer from the North Andover Police
Department (NAPD), per a request for assistance in conducting a forensic examination. I
subsequently prepared an official, internal request to have the subject computer forensically
examined for any evidence of child pornography given the suspicious and questionable .JPG
files which triggered the virus alerts.
14. On September 9, 2014, I was verbally notified by the assigned forensic examiner that he
found evidence that the subject computer accessed what appeared to child pornography. The
initial forensic examination was concluded on or about September 11, 2014, the results of
which were made available for my review.
15. On September 12, 2014, I and NAPD Detective Daniel Cronin began review of the forensic
examination results. Prior to the physical review, the assigned forensic examiner advised us
that there were no images of child pornography stored on the subject computers hard drive,
but based upon the examiners review of the subject computers history, was able to
determine that the subject computer had been used to access and view child pornography
stored on other computer media, such as an external hard drive and/or a CD rom. The
examiner retrieved serial numbers for the external devices from which suspected child
pornography was accessed, and determined that two types of external drives were used: (a)
a thumb drive or large external drive; and (b) a DVD/CD reader drive. These external
drives are portable, and may be used to connect to any number of different computers.
16. On September 5, 2014, Detective Cronin was recently advised by MC Campus Police that
SPRING has made numerous, recent attempts to enter his office for the stated purpose of
retrieving an external hard drive.
7

17. The forensic examiner was able to retrieve over 300 images of child pornography stored in
the subject computers thumb nail cache. Furthermore, the examiner was able to
determine that child pornography images were viewed on the subject computer from June
13, 2014 through June 29, 2014.
18. Forensic examination further disclosed that, on Saturday, June 28, 2014, at approximately
4:00 a.m., SPRING accessed images labeled ULYA & LILYA from an external
drive CD. A significant number of the photos reviewed by myself and Detective Cronin
depicted two (2) nude, prepubescent females, in a variety of poses, exposing their genital
area.
19. Forensic examination of the subject computer revealed that the following images of child
pornography were viewed on the subject computer between June 13, 2014 through June 29,
2014, by means of an external drive:
x File name: 108adaa67bfa3c76 depicts a nude, prepubescent female, with exposed
vagina and breasts.
x File name: 17952c9ea0dbb8a4 depicts a nude, prepubescent female, bending at the
waist exposing her vagina and anus.
x File name: 342f643f4b8a4e80 depicts a nude, prepubescent female, seated with
exposed vagina and breasts.
The images have been saved to a disc and will be available for the Courts review.
Search of SPRINGS Residence
20. In interviews with investigators, SPRING admitted to use of at least two thumb drives.
As set forth above, thumb drives are portable and may be attached to any computer.
8

21. A forensic examination of the subject computer indicates that external drives, on which
images of child pornography were stored, were attached to the subject computer and
accessed by SPRING.
22. Forensic examination of the subject computer disclosed that at least two external forms of
media were used by SPRING to both store and access images of child pornography. Such
media is easily concealed and transported. During his second interview, SPRING
produced two thumb drives, later determined not to be the source of the child
pornography. SPRING also told investigators that he accessed the Internet through the
use of his personal computer. From training and experience, I have learned that people
that collect and/or view these images often download them from the Internet and store
them on external drives and other portable computer media that could easily be concealed
in order to maintain the collection.
September 19, 2014
23. On September 19, 2014, a search warrant was executed at SPRINGS Merrimack College
Civil Engineering Office 103, located within the Mendel Building, 315 Turnpike Street,
North Andover, MA. A search warrant was also executed at SPRINGS residence, 4
Alden Street, Unit 2, Danvers, MA, where SPRING was present.
24. SPRING was advised of his Miranda rights. SPRING stated that he understood his rights
and agreed to speak with agents. SPRING stated that, after his interview with Detective
Cronin on June 29, 2014, he freaked out and began destroying evidence that he
possessed child pornography. SPRING stated that he took two thumb drives, totaling 6
gigabytes, which were full of child pornography and threw them in the trash at his home.
He added that he also destroyed the thumb drives because he did not want his adult-aged
9

children to find them if he died. SPRING admitted to viewing child pornography on his
personal Apple computer, and further stated that after his interview with Det. Cronin he
took his personal computer to a local computer store to be wiped clean. After the
computer was wiped, SPRING brought the computer to be recycled during a town
recycling day and is no longer in possession of the computer. A second MacBook
computer, belonging to SPRING, was found at the residence. SPRING indicated that he
used this second personal computer to view child pornography stored on various thumb
drives.
25. SPRING was shown the digital images set forth in paragraph 19, above. He was able to
state the name of one of the female file names, admitted to viewing and possessing the
images, and described the several child pornography series and websites from which the
photographs originated. SPRING stated generally that the child pornography series that
he viewed began with the children fully clothed and ended with them naked. SPRING
admitted being sexually aroused by child pornography, and masturbating to images of
child pornography.
26. SPRING stated that when he downloaded child pornography from various websites, he
would create a file folder within the thumb drive, rename it to the name of the girl(s) in
the series, and save all photos associated with the series into the newly created file folder.
SPRING was asked about a file folder named LF little katya, as referenced in
paragraph 3 above. SPRING immediately recognized the name and identified that file
folder as one that he created on a thumb drive. This file folder name is the file folder
from which the several virus alerts to MC originated. SPRING was also familiar with the
.JPG file names from which the virus alerts were triggered.
10

27. During his interview with agents, SPRING produced a thumb drive from his pocket, and
turned it over to agents. He stated that he preferred thumb drives because they were
accessible and easier to move around and they were clean.
2
However, when agents
searched SPRING incident to arrest, a second thumb drive was discovered in SPRINGs
pocket. SPRING had no explanation as to why he did not give the second thumb drive to
agents at the time he gave them the first thumb drive.
28. SPRING admitted that he viewed child pornography on MCs computers. In addition to
admitting viewing child pornography on MCs Lenovo Think Pad laptop computer in his
possession on July 29, 2014,
3
he also admitted viewing child pornography on a second
computer belonging to MC, a MacBook computer, which he turned in and exchanged for
the Lenovo Think Pad.
CONCLUSION
29. Based on the foregoing, that there is probable cause to believe that Gary S. SPRING
possessed child pornography in violation of 18 U.S.C. 2252(a)(4) and 2252A(a)(5).
Sworn to under the pains and penalties of perjury,
_________________________________
Laurence A. Travaglia
Special Agent, FBI

2
Based on my training and experience, the term clean is indicative of not leaving a trace that
child pornography was viewed.
3
This is the computer from which the virus alerts were triggered.
June
xxxx
11
SWORN AND SUBSCRIBED TO BEFORE ME THIS 19th DAY OF
SEPTEMBER, 2014.
_____________________________________
HONORABLE DAVID H. HENNESSY
UNITED STATES MAGISTRATE JUDGE
I have reviewed the images referenced in paragraph 20 and I find probable cause to believe they
depict minors engaging in sexually explicit conduct and child pornography. The Affiant shall
preserve the images and video provided to the Court, for the duration of the pendency of this
matter, including any relevant appeal process.
_____________________________________
HONORABLE DAVID H. HENNESSY
UNITED STATES MAGISTRATE JUDGE
_____ __ __ __ ____ _____ __ __ ____ ____ __ __ __ __ __ _ ______
EEEEEEESS SS SS SS SSS SS Y YYYYY
EEEEE JJJJJJUD UD UD UD UD UD UD DGE GE GE GE GE GE GE
enced in pppppppppar ar ar ar ar ar ar ar arag ag ag ag ag ag ag ag agra ra ra ra ra ra ra ra raph 20 an
________ __ __ __ __ __ ____ _____ ______ ________
SS SSSSSSY YYYYYYY
UD UD UD UUUUU GE GE GE GE GE GE GEE