A Federal Way man was charged with first-degree possession of child pornography on Friday after a lengthy federal investigation that linked the man’s IP address to a website that sold child erotica.
Primitivo Altares Bambao III, age 44, was arrested on July 18 at his Federal Way home in the 32000 block of 41st Ave. SW. During a subsequent search of his home that day, Homeland Security Investigations found numerous images and a dozen videos on Bambao’s computer hard drive that depicted minors — some younger than 4 years old — engaged in sexually explicit conduct.
Bambao posted bond on a $50,000 bail and was released from King County Jail on Saturday.
In March 2012, Homeland Security Investigations in Phoenix, Arizona initiated an investigation into a password-protected, fee-based website referred to as “Website M” in court documents. The investigation involving the Federal Way man was prompted by an interview with another Website M user in connection with a separate child exploitation investigation. The defendant in that case provided agents with his username and password and allowed Homeland Security to assume his online identity on the website.
Phoenix agents determined that the website advertises files depicting minors engaged in sexually explicit conduct for purchase. Once logged in as a member, the user sees the names of folders available for purchase, which contain previews of images contained in the folders, according to King County Superior Court documents. As of March 2012, the website advertised that it offered 600,000 images and 400 hours of video. The content can be accessed after downloading them by purchasing a password.
Website M hosted its content on a server located outside of the U.S., and typically charged between $40-$110 to purchase the password for encrypted archive files containing the images and videos depicting minors engaged in sexually explicit conduct. Once downloaded, the user can “decrypt” the selected archive file by entering the purchased password to reveal multiple image and video files.
Several Website M members that agents interviewed said they received an email inviting them to join the site after they purchased child erotica from another website.
Between April 2014 and May 2017, investigating agents in Phoenix made multiple undercover purchases of archive files from Website M.
They found that most of the files contained between 500 and 2,000 images or videos files, the majority of which depict minors engaged in sexually explicit conduct. This includes video and image files that the National Center for Missing and Exploited Children has identified and verified to depict a pre-pubescent child who appears to be less than 10 years old, the documents continue.
Investigating agents also found that Website M allows members to preview “samples” of the images/video contained in an archive folder prior to purchase. Agents previewed more than 100 sample folders and found that the majority of the content depicted many pre-pubescent minors engaged in sexual activity with adults and/or posed in a sexually explicit manner, according to court documents.
Homeland Security agents in May 2017 identified a U.S. company as both a payment processor and online business management tool that Website M used. The investigation further revealed that Website M registered its business with the U.S. payment processor in order to appear as a legitimate company.
Agents served a search warrant to the company in August 2017 and the processor provided a spreadsheet that listed all the transactions the company processed on behalf of Website M. The list included over 1,000 purchases made from the website.
Agents also located the content server for Website M in March 2018. They traveled outside of the U.S. to a location that is unspecified in court documents, and copied the content server that contained the videos and images for sale on Website M, as well as membership records. Analysis of that information indicated there were approximately 950 registered users of Website M, which included usernames, dates and the IP addresses that appeared to correspond to purchases of child exploitation materials from the website. Based on that information, agents were able to identify Bambao as an alleged purchaser of child pornography from the website.
Records that Homeland Security obtained from the U.S. payment processor show Bambao paid $89 to purchase a password for an archive file on Dec. 7, 2016. His file contained approximately 12 video files that depicted prepubescent child victims engaged in sexually explicit conduct. Court documents describe one of the videos in detail that involves a man attempting to vaginally rape a girl under the age of 4, among other sexually explicit conduct.
Agents reviewed the list of log-ons to Website M, which shows that Bambao allegedly logged on to the site over 900 times between Sept. 14, 2015 to June 25, 2018.
A Department of Homeland Security summons was served to Comcast Communications on May 30, 2018 for the subscriber information of an IP address. A search of the address revealed that it was geo-located in Federal Way and Comcast confirmed it belonged to Bamboa. A second IP address was also linked to his previous SeaTac home.
Agents conducted surveillance of Bamboa’s Federal Way home on three occasions between March and June 2019.
On July 18, agents from Homeland Security, along with detectives and officers from the Federal Way and Seattle police departments executed a search warrant at his Federal Way home, where they arrested Bamboa. He declined to answer any questions without a lawyer present.
Bamboa has no known criminal history. His arraignment hearing is scheduled for Aug. 1 at King County Superior Court.
A spokesperson for the Homeland Security Investigations office in Phoenix told the Mirror this is an ongoing investigation and they couldn’t provide any further information on this case, including whether any other suspects have been arrested in connection with Website M.
