Detention motion: Joplin man had cell phone "wiped" before officers could find child porn

Details of the reasons for a Joplin man's arrest for receiving and distributing child pornography were included in a detention motion filed this morning in U. S. District Court for the Western District of Missouri.

The assistant U. S attorney asked that Shawn Ryan Valentine, 35, be held in prison while awaiting trial, noting Valentine's alleged efforts to destroy evidence by having a remote factory reset done on his cell phone.

From the motion:

On August 2022, and April 2023, the Southwest Missouri Cyber Crimes Task Force (SMCCTF) received ten CyberTips (CT) from the National Center for Missing and Exploited Children (NCMEC). 

All of the CTs originated from Synchronoss Technologies, and indicated that, between April 28, 2022, and April 13, 2023, an individual had uploaded suspected files of child sexual abuse material (CSAM) to Sychronoss’s servers. 

Through investigation, it was determined that the suspect behind the ten CTs was likely Shawn VALENTINE. SMCCTF Task Force Officer (TFO) Corbett obtained a state search warrant directed to Synchronoss Technologies to provide the content of the suspect Synchronoss account. 

On April 17, 2023, TFO Corbett received a response from Synchronoss. The response included a folder that contained approximately 80 video files, and 30 image files depicting child pornography. Also included in the content were several files indicating that the account belonged to VALENTINE, including an image of a collection notice addressed to VALENTINE, an image of VALENTINE’s Missouri driver’s license, and an image of VALENTINE holding his Missouri driver’s license. 

TFO Corbett executed a state search warrant on VALENTINE’s residence on April 27, 2023. VALENTINE was present when the search warrant was executed. Corbett interviewed VALENTINE, after reading VALENTINE his Miranda rights. VALENTINE provided a cell phone number that matched the phone number associated with the suspect in the ten CTs. 

During the interview, VALENTINE admitted to searching for, viewing, and downloading child pornography, which he defined as images that depicted children under the age of 18 years old.

VALENTINE indicated that he had viewed child pornography as recently as a week before law enforcement executed the search warrant. During the search warrant, law enforcement seized VALENTINE’s personal cellular phone which VALENTINE admitted to using to view child pornography. 

On April 28, 2023, Homeland Security Investigations (HSI) TFO Larry Roller attempted to conduct a forensic examination of VALENTINE’s cellular phone and found that someone had remotely factory reset the cellular phone. 

On May 1, 2023, TFO Corbett submitted a search warrant to Google LLC for VALENTINE’s Gmail account. The response indicated that VALENTINE requested a remote reset of the phone three times after the search warrant was executed on his residence. 

TFO Corbett also reviewed the forensic report on VALENTINE’s cellular phone. He found that, on April 27, 2023, the cellular phone received a “Wipe” event to “Factory Reset” the device. The command was performed from Google’s “Find My Device.” 

Additional information included, “Reason: Find My Device wiping device remotely, and “Wipe Trigger: Wiped remotely by user.” 

Google’s factory reset is a feature available on Android devices that allows an individual to erase all data and settings on the device and restore it to its original factory state. 

Following the search warrant, the SMCCTF received additional CTs linked to VALENTINE, although the incident dates associated with those CTs occurred before the execution of the search warrant.