How internet sex crime hunters snared SC State Rep. RJ May in a digital trap
In the spring of 2024, S.C. state Rep. Robert “RJ” May III was diving into internet chat groups dedicated to trading child sex images and using the name “joebidennnn69” to hide his secret life, federal prosecutors say.
What May, 39, apparently didn’t know — or discounted — was that across the internet, organizations dedicated to detecting child sex predators were on the prowl.
“Child sex predators are always being hunted,” said Derek Shoemake, a former South Carolina federal prosecutor who investigated white collar crimes and crimes against children.
Predator hunters include social media platforms who are required to report illegal child sex images if they detect them, organizations like the National Center for Missing and Exploited Children and even undercover government agents who infiltrate predator sex chat rooms, Shoemake said.
In May’s case, a government undercover agent penetrated an internet group of child sex predators that included May, according to a federal court filing.
“It is not unusual, as is the case for this Defendant (May), for an offender to only be discovered because he had the misfortune of law enforcement infiltrating a secret group of like-minded offenders who use the Internet to sexually abuse and exploit children,” a government memo in May’s case said.
Federal prosecutors in the U.S. Attorney’s Office in South Carolina, which is prosecuting May’s case, have not revealed more details about exactly how May’s alleged misdeeds were discovered.
The charges against him — 10 felony counts of distributing child sexual abuse material — are sharply at odds with the public image of May, a married father of two young children and an ultra conservative supporter of President Donald Trump.
May is now being held without bond pending trial. He has pleaded not guilty to distributing child porn. He still holds office but has been suspended.
A 22-page filing by federal prosecutors reveals how actions by groups that hunt child predators led to May’s arrest in early June.
Kik tells NCMEC
The filing said that more than a year ago, on May 27, 2024, Kik — a social media company headquartered in California — sent a Cyber Tipline report to the National Center for Missing and Exploited Children, or NCMEC. Users of Kik’s Messenger app can share photos and videos in groups and in person.
Under an act of Congress, NCMEC is a private, non-profit that is a national resource center and clearinghouse for missing and exploited children.
“The Cyber Tipline serves as the centralized reporting mechanism within the United States, both for members of the public, as well as what we call electronic service providers, to report any suspected online child sexual exploitation,” said Fallon McNulty, executive director of the NCMEC’s Exploited Children Division.
People who report to the Tipline are members of the public, family members of victims or victims themselves, McNulty said in an interview. Last year, NCMEC received more than 20 million tips, McNulty said.
The May 27, 2024, Cyber Tipline Report received by NCMEC from Kik contained crucial information that led to May. But it did not contain his name, according to the prosecution memo.
The report noted that a Kik user named “joebidennnn69” had transmitted child sex abuse material while on Kik. The report also included files with pornographic videos.
NCMEC analyzed the files and determined they contained 28 different videos with child sex abuse material. The report from Kik also contained an AT&T Internet Protocol address that belonged to “joebidennnn69.” IP addresses are unique locators for each device that links to the internet.
Crucially, the IP address revealed the suspected user’s approximate geographic location, which was in West Columbia, in Lexington County, the prosecutor’s memo said.
National center tells SC authorities
NCMEC has connections with law enforcement agencies across the country.
It forwarded Kik’s Tipline report and its analysis with the IP address to South Carolina’s Internet Crimes Against Children task force, which is located in Attorney General Alan Wilson’s office.
Wilson’s internet crimes against children task force, which includes four investigators, four attorneys, seven forensic examiners, a cybertip analyst and others, coordinates with local task forces around South Carolina.
Since the geolocation data pinpointed “joebidennnn69” in Lexington County, the attorney general’s task force assigned the case to the Lexington County sheriff’s internet crimes against children task force. Authorities at that point still did not know who was connected to the IP address.
Lexington investigators uncover May’s name
The Lexington County internet crimes against children has two investigators trained in online investigations. They are also trained in computer and cell phone forensics and undercover chat and dark web investigations.
On June 27, 2024, seeking a name to go with the IP address, the Lexington County investigators sent out two search warrants.
One went to AT&T asking for the identity of the subscriber for the AT&T account associated with the IP address that had been sent to the AG’s office and forwarded to the Lexington task force.
The other search warrant went to Kik and requested the contents of the Kik account related to the username “joebidennnn69.”
On July 12, 2024, Kik complied and provided subscriber information, including that “joebidennnn69” was using a Samsung SM-G781U1 Android smart phone to access an account that contained 265 files with child sex abuse material.
Kik also reported that “From March 30, 2024, until April 4, 2024, the account with the user name ‘joebidennnn69’ sent or received approximately 1,147 messages with other Kik users. The messages discussed trading CSAM (child sex abuse material) with other users.”
It was AT&T that delivered the key information.
It told the Lexington County Sheriff’s Department that the billing party was RJ May and the service address was May’s residence in West Columbia, the prosecution memo said.
At Kik, May had used the name “joebidennnn69” and participated in “multiple chat groups dedicated to the trading of child pornography,” the memo said.
On learning RJ May was the suspect, the Lexington County Sheriff’s Department realized it had a conflict of interest.
“Once we saw the name of the subscriber was that of a member of the General Assembly, we referred the case to our federal counterparts. Due to our working relationships with lawmakers and council members, this is standard procedure,” said Lexington sheriff’s spokesman Adam Myrick.
Feds get involved
The case was transferred to federal Homeland Security Investigations, a federal agency that investigates child exploitation, online crime and other unlawful activities.
Homeland security agents did a further analysis of the Kik material and learned the “vast majority” of messages at the IP addresses used by “joebidennnn69” were connected to May’s house or his Verizon cellphone account, the memo said. Most were connected to his house.
At that point, agents began to conduct surveillance at May’s house and determined that the Wi-Fi at his house was password-protected.
“Thus, for the child sex material activity to have been conducted by someone other than May, that person would have had to know the Wi-Fi password,” the prosecutors’ memo said.
“Similarly, someone would have had to possess May’s cell phone to have initiated the child sexual activity material on Kik that utilized Verizon IP addresses,” the memo said.
The raid on May’s house
By Aug. 5, 2024, homeland security investigators believed they had enough evidence to seize May’s digital devices.
Working with the South Carolina Law Enforcement Division, they executed a search warrant on May’s house.
Swooping down on May’s house, agents seized numerous digital devices including a cellphone belonging to May that was a Samsung SM-G781U1, the same make and model that was used to register the Kik account bearing the name “joebidennnn69.” Besides the cellphone, agents seized a Lenovo laptop, an Amazon tablet, three other cellphones, four hard drives, four SD cards, two DVD-Rs and 19 thumb drives.
Examining the contents of a phone linked to May, agents found a user dictionary containing the same email address used to register the Kik account. They also found evidence showing the Kik app had been deleted from his cellphone. May had also deleted apps from Telegram, Mega and Loki Messenger, the memo said.
May had discussed the use of Telegram and Mega “with his fellow like-minded pedophiles,” the prosecutors’ memo said. Both Telegram and Mega are “frequently” used by individuals engaged in child sex abuse material activity “due to their encryption and foreign ownership,” the memo said.
An investigative surprise
Agents made an unexpected find on May’s Mega app.
The app had been registered in the name of Eric Rentling, a fictitious alias May had used to set up a Facebook account.
Agents began exploring the Eric Rentling Facebook account and found a link to South America.
“HSI located a series of conversations with female sex workers in the area around Medellin, Colombia, a place well known for sex work,” the prosecutors’ memo said..
“Between April 12, 2023 and July 31, 2024, there were no Iess than 40 conversations with females using Facebook Instant Messenger via the alias Facebook Account ‘Eric Rentling’,” the memo said.
“These messages were in Spanish and consisted largely of arranging ‘meet up’ dates, time, price negotiations, and rules regarding the videoing of sexual encounters, all of which are indicative of sex work,” the memo said.
After the August 2024 raid on May’s house, prosecutors and agents worked for the next 10 months to put together a case against May.
Although news media had reported on the raid and published information that implied the material seized might involve suspected crimes against children, May won re-election to his Lexington County legislative seat and continued to sit in public sessions at the S.C. General Assembly, where he was a prominent Republican and Trump supporter..
On June 11, HSI agents returned to May’s house. They arrested him on the distributing child pornography charges.
“This defendant has distributed child pornography on numerous occasions to like-minded pedophiles who he gathered with in online communities where such behavior was normalized,” said a memo arguing for May’s detention without bond.
Documents in the case contained graphic descriptions of the kinds of material May was allegedly distributing, including numerous videos of adults performing sex acts on children as young as toddlers. The documents also contained text messages of “joebidennnn69” talking about the images.
May is obsessed with viewing images of adults committing lurid sex acts on children, the prosecution memo said, describing him as “a tech-savvy man with the pressing desire to consume child pornography.”
An analysis of May’s various electronic devices reveals that he was engaged in illegal CSAM activity on Kik at the same time he was engaged in everyday life activities, including texting his wife, emailing clients and calling others, federal documents said.
Questions remain
What took federal law officers 10 months — from August 2024, when they seized May’s digital devices, to June 11, when they arrested him?
“It could have been any number of things,” said Shoemake, whose work as a former federal prosecutor helped put predators in prison, including Hart Grove, a Myrtle Beach man who got 27 years in federal prison in 2022 for child sex trafficking. Hart specialized in grooming and sexually abusing minors.
Matters such as agents’ workloads, the availability of a digital forensics technician to do a “digital dump” on May’s cellphone, getting subpoenas and possible follow-up subpoenas as well as a possible search warrant for Facebook can delay an investigation, Shoemake said.
“Those things, including going before a grand jury, take time,” said Shoemake, now a Camden defense attorney and member of the Kershaw County Council.
Shoemake also said that “One thing the federal government does very well is put cases together without a lot of holes and cracks. Crimes this serious, the last thing you want to do is have a case thrown out and have someone who’s done horrible things against children walk free. And so you are going to make sure you check every box and make sure every single thing is in order.”
Other questions: Why was May active on Kik for six days between March 30 2024, and April 4, 2024, when he suddenly stopped, deleted the Kik and other apps? Had May distributed porn on the internet before?
“It could be a couple of things. This is a sickness. I’ve had cases where the guy would delete everything, walk away and then return. It could be he realized it’s a sickness and he deleted everything, hoping not to return,” said Shoemake.
“Another possibility — he deleted things because he had some idea that somebody was on to him. A third option — maybe he found a better way to do it.”
Jenny Smith, May’s court-appointed public defender attorney, declined comment.
May faces up to 200 years in prison if convicted on all 10 counts of distributing child pornography. Each count carries a maximum 20-year penalty. However, if he pleads guilty, he would likely be sentenced to much less time. Federal Prosecutor Scott Matthews told Magistrate Judge Shiva Hodges in a June hearing he wants a prison sentence close to 20 years upon any conviction.
Shoemake, who has prosecuted more than a dozen child sex exploitation cases, said few people nabbed by law enforcement in these cases are newcomers to the act of distributing child pornography.
“It is extremely rare in a case where someone commits crimes against children that they are caught the first time they do it,” Shoemake said. “More often than not, they’re caught after they’ve been doing it for a while.”
NOTE: The National Center for Missing and Exploited Children’s 24-hour tipline is 1-800-843-5678.
This story was originally published July 2, 2025 at 5:30 AM.