FBI Investigation Techniques

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 1 of 17 EE UNITED STATES DISTRICT COURT [eg ~SR_5< MAR -8 2016 reson sandr eaters, } TTT fea oo oo Task Force Agen\Scott Libengood, FBI ___ we 3/81 ry 2 Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 2 of 17 AFFIDAVIT IN SUPPORT OF ARREST WARRANT Your Affiant, Scott Libengood, does hereby depose and state as follows: 1. Tama “federal law enforcement officer” within the meaning of Federal Rule of Criminal Procedure 41(a)(2)C), that is, a government agent engaged in enforcing the criminal laws. Ihave been employed as a Task Force Officer of the Federal Bureau of Investigation (FBI) since 2015, and am currently assigned to Miami Division, Palm Beach Office. | am a federal law enforcement officer who is engaged in enforcing criminal laws, including 18 U.S.C. §§ 875 and 1038, and | am authorized by the Attomey General to request an Arrest Warrant 2. Ihave probable cause to believe that PRESTON ALEXANDER MCWATERS, white male, date of birth July 24, 1990, has committed one or more offenses against the United States, that is, 18 U.S.C. § 875(c), the transmission in interstate commerce of a communication of threats to injure the person of another; and 18 U.S.C. § 1038, conveying false or misleading information regarding an explosive device (i.e. making false bomb threat). 3. The statements contained in this affidavit are based in part on: information provided to me by FBI Special Agents; written reports about this and other investigations that | have received, directly or indirectly, from other law enforcement agents; information gathered from the service of subpoenas, court orders, and search warrants; the results of physical and electronic surveillance conducted by law enforcement agents; independent investigation and analysis by FBI agents/analysts and computer forensic professionals; and my experience, training and background as a Task Force Agent with the FBI. Because this affidavit is being submitted for the limited purpose of securing authorization for the requested arrest warrant, I have not included cach and every fact known to me concerning this investigation. Instead, I have set forth 1 Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 3 of 17 only the facts that I believe are necessary to establish the necessary foundation for the requested warrant BACKGROUND OF THE INVESTIGATION AND PROBABLE CAUSE Stalking Report 4. On March 17, 2015, the Oconee County Sheriff's Office responded to an address in Watkinsville, Georgia in reference 10 a stalking complaint. Upon arrival, the deputy met with the victim Devon Kenney (hercinafier Kenney) and her mother Kathryn Cooper. Kenney and her mother made a complaint that Preston McWaters (hereinafter McWaters), a former co- worker with Kenney, was stalking Kenney by calling her, texting her, sending her messages on Facebook, and has been showing up at their house. Kenney estimated that McWaters had tried to contact her approximately 100 times through telephone or other electronic communications after being asked 0 stop, and that he made the statement that if he couldn't have her, that no one could 5. Kenney advised the Sheriff's Deputy that McWaters was outside their house hiding and when Kenney came out of the garage, McWaters confronted her. Kenney asked him 10 leave and he did not until they called the police. Kenney and her mother stated that his behavior frightened them. 6. The Sheriff's Office located McWaters, who was residing at the time, in Bogart, Georgia. McWaters admitted to the Sheriff’s Deputy that he had been at Kenney's home but said he rang the doorbell and Kenney came out. Further, he admitted to being asked several times to leave and that he did not initially comply. MeWaters alleged that he and Kenney had formally dated and he was trying to patch things up. He was told not to have any further contact with 2 Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 4 of 17 cither Kenney or her mother. This incident was documented in a Sheriff's Office report. The allegations from Kenney were sufficient to warrant a judge to issue a “Threat Protection Order” which prohibits McWaters from making contact with Kenney. The Order i still in effect and has been entered into the NCIC system Twitter account EricMead82 7. On December 11, 2015, a Twitter account was created under the username “EricMead82". This account was then used to post several hoax bomb threats to John I. Leonard High School and the Palm Beach Intemational Airport, both located in Palm Beach County, Florida. Examples of the postings are as follows: “The bombs at John I. Leonard high school are going to blow soon!!! Merry Christmas you fucking kids!" and "I hope palm beach international airport enjoys the bombs I left for them!" Email Accounts [email protected] and [email protected] 8. The Palm Beach Intemational Airport general email also received an email from [email protected] on December 30, 2015, that read "The bombs that I have place at palm beach international airport are going to blow at 9:30 pm New Year's Eve. The clock is ticking... Happy new year fuckers!" 9. On February 2, 2016, the Principal of Jupiter High School in Palm Beach County received an email from [email protected], with the following threat: "I have placed several ‘bombs at your school. They are set 10 blow at 2:30 pm on Wednesday 02/03/16. You will all dic unless you do as 1 say. If you call the cops then I will have my friends come to you house and they will kill your family”. This email created a panic situation that resulted in the school having to be evacuated, all the parents of the children had to respond to the school to pick up 3 Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 5 of 17 their children, and approximately two dozen law enforcement officers responded to search the school. There was a follow up email the next day stating that it was a hoax and the user was laughing at the police. 10. The Principal of John I. Leonard High School, located in Greenacres, Florida, also received an email from [email protected] on February 7, 2016, that read "I have placed 5 bombs containing c4 throughout John 1. Leonard high. 1 will detonate the bombs at 1pm on 02/08/16 unless you deliver $500,000 In cash the the address below. If you do not comply within that time, then I will detonate the bombs and people WILL die. You have my demands. Make the smart choice and don't get innocent people killed by informing the police 2111 White Pine Cir, Apt C Greenacres Florida 33415." 11. There was also another email sent to the same Principal of Jupiter High School on February 17, 2016, from [email protected] that read: "We have placed 10 pounds of C4 plastic explosive around the interior of Jupiter community high school. If you do not bring $10,000,000.00 in cash to 2500 Via Royale Apt. 2508, Jupiter, FI 33458 by 12pm on Friday, then we will blow up your school and everyone inside. This is not a negotiable term. Don't be heroes and get people killed. Bring the cash and your school wil be spared the blood of infidels. Allah Akbar." The address provided in the email is the real home address of Eric Mead and current address of Devon Kenney. Devon Kenney stated she relocated to Palm Beach County from Georgia in April of 2015 to live with her boyfriend Eric Mead. 12. A company named Kimley Hom also received an email bomb threat from [email protected] on January 27, 2016, which read * I have placed several pounds of c4 plastic explosive at one of your offices. 1920 Wekiva Way Suite 200 West Palm Beach, Fl 33411 If 4 Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 6 of 17 you do not comply with my demands then I will detonate the bombs and bring your building to the ground with everyone inside. I want $500,000 deliver to the address 2111 white pine cir, apt C in greenacres, Florida 33415. You have 24 hours to comply. If you call the cops or any other funny business then you will cost a lot of lives. Don’t do anything stupid or else... Kaboom!" 13. This email resulted in the evacuation of a multi-story building with many businesses and employees. The City of West Palm Beach Police Department and Fire Department responded and searched the office building. Nothing was found. Interview of Eric Mead 14. On December 30, 2015, a former Athens, Georgia but now Palm Beach County resident named Eric Mead was located and interviewed. Mead denied any knowledge or involvement in the creation or ownership of the “EricMead82” Twitter account. However, Mead confirmed the photo attached to the “EricMead82” Twitter account was him. Mead said the address listed on the Twitter posting, 2111 White Pine Circle, was his mother's address. Mead stated that he works at the Kimley Hom office in West Palm Beach, Florida, and the “82° represents Mead’s year of birth, 15. On January 21, 2016, due to on-going social media postings negatively affecting his reputation, Eric Mead made an identity theft report to the Jupiter Florida Police Department. 16. Currently, Eric Mead is the boyfriend of Kenney. Twitter, Tracfone, and AT&T Records 17. On February 9, 2016, a judicial order requested Twitter, Inc. provide Account/Subscriber Information and IP Records on the “EricMead82” account. On February 11, 2016, Twitter, Inc. provided the requested information. Upon reviewing the information, it was 5 Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 7 of 17 determined that the “EricMead82” Twitter account was created on December 11, 2015, at 19:01 hours (7:01 PM) using AT&T Wireless phone number 561-797-9156. Your Affiant knows that in order to create the account, Twitter requires verification by sending either an email to an email account or a text message to a cellular telephone. 18. Additional investigative work and subpoena compliance revealed that S61-797- 9156 was a Tracfone (a prepaid wireless service provider) with cellular phone/data services being provided by AT&T Wireless. The 561-797-9156 number/account was purchased at a Walmart store on Lexington Road in Athens, Georgia on December 11, 2015 and activated on the same date, and deactivated on January 11, 2016. The name registered on the Tracfone account was Eric Mead, West Palm Beach, FL 33415, with an email address of emead82@usacom. A second Tracfone, 561-601-3416, was also purchased at the same ‘Walmart store on January 22, 2016, and it was activated with Tracfone and AT&T on January 24,2016. The name registered on the second Tracfone account, 561-601-3416, was also Eric Mead, West Palm Beach, FL. 33415. 19. When he was interviewed, Eric Mead was asked about the first Tracfone purchase. Mead denied making any Tracfone purchases and stated that he did not give anyone permission to purchase a Tracfone in his name. 20. Further investigation revealed that Tracfone number 561-797-9156 received an SMS message from 40404 (40404 is a short code to allow mobile phones to access Twitter) on December 11, 2015, at 19:03 hours (7:03 PM); this would indicate Twitter was verifying the creation of the account. Cellular records subpoenaed from AT&T Wireless revealed that S61- 797-9156 sent and received SMS messages to 40404 approximately sixteen times, approximately 6 Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 8 of 17 five of those times were on December 16, 2015, which is the same day that the “EricMead82" Twitter account had approximately four postings threatening to blow up John 1. Leonard High School. Search Warrants 21. On February 12, 2016, two State of Florida search warrants were authorized. The first warrant requested Twitter Inc. to disclose all information regarding the “EricMead82” account and a second Twitter account under the name "MeadLewis. Both of these accounts were made using the same profile picture of the real Eric Mead. The real Eric Mead said that the picture may have been copied from another social media account that he had created before he moved to Florida called Linkedin. The second warrant requested Facebook Inc. to disclose all information regarding an "Eric Mead" account which had been created with the same profile picture used in the fake Eric Mead Twitter accounts and was now being used to send death threats to Kenney. 22. Lewis is the former last name of the real Eric Mead before he had it legally changed. This new “MeadLewis™ account was used to make postings of death threats directed at Kenney. The "MeadLewis" Twitter account was used 10 send several messages to Kenney's Twitter account one of which read "your going to fucking die you cunt bitch, I want to hear you scream while I skull fuck you, you psychotic whore!”. The fake Facebook “Eric Mead" account was used 10 send several death and rape threat messages to Kenney's Facebook account, one of which read: "They are going to come to your house in Florida and are going to rape and kill you... You disgusting fuck slut. I've paid them well. Your gonna suffer.” Unlike the other messages sent, this message sent through Facebook shows that it was posted via mobile. 7 Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 9 of 17 23. Your Affiant believes that the suspect is using both a computer and a telephone to send these death threats. 24. On February 22, 2016, Twitter Inc. provided the following information: a new telephone number, S61-601-3416, had been used in the creation of the “MeadLewis™ account on January 25, 2016, along with the email emead82 @usa.com. Walmart Purchases of the Tracfones 25. Walmart security investigators have been able to identify the store security video of the financial transactions for the purchases of the two Tracfones. They have supplied the transactions and the video to the FBI. Upon looking at the still photographs of the individual ‘making the purchases, the suspect appears to be a white male, medium build, 20 to 30 years of age, with slight facial hair. He appears to be wearing the same hat in both of these transactions, possibly a tan colored baseball hat with the University of Georgia emblem on it. In the first transaction, he appears to be wearing a rather unique jacket, one that is a black and camouflage patie. In the second transaction, the suspect can be seen leaving the store driving a newer model reddish in color Chevrolet Camaro. 26. On February 24, 2016, Walmart security from Athens, Georgia contacted the FBI. They had been instructed to be on the lookout for the individual returning to the Walmart, One of the security officers that had reviewed the video tape and was looking out for the suspect was outside Walmart ata Shell gas station at College Road and Barnett Sholas Road in Athens (Your Affiant knows that this road is near the subdivision where McWaters resides). The security officer observed the individual at that gas station/store and identified him from the video surveillance from Walmart. The security officer took a picture of him and his car with the tag 8 Case 9:16-m|-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 10 of 17 ‘number and sent it 10 the FBL. It should be noted that Walmart security personnel were never advised of the suspect’s name, Preston McWaters or the tag number of McWaters Chevrolet Camaro. Walmart security made the identification on their own. The tag number of the vehicle that they identified is identical to McWaters' tag number, Georgia plate number CEGO1SS. Georgia DMV records show that this tag is registered to Preston McWaters and his mother Annette Phelabaum, 155 Snapfinger Lane, Athens, Georgia. 27. Your Affiant has reviewed the Georgia Driver's License photograph of Preston MeWaters, white male date of birth July 24, 1990, and compared it to the photos of the suspect purchasing the phones at Walmart. The suspect looks like McWaters. Investigation has also revealed that the house located at 155 Snapfinger Lane in Athens, Georgia, is owned by MeWaers" mother, Phelabaum, however, McWaters has this address as his place of residence in numerous databases. Surveillance of SUBJECT PREMISES 28. On or about February 22, 2016, the FBI in Athens conducted a drive by surveillance of this house and located McWaters red Camaro at this address. Your Affiant has conducted a google maps search and has determined that there are three Walmarts in the Athens, Georgia area. The Walmart on Lexington Road where the Tracfones were purchased is the closest one to McWaters house, it is approximately $ miles away. 29. On February 29, 2016, FBI Agents conducted surveillance of 155 Snapfinger Lane. Due to the rural nature of the neighborhood, the Agents were unable to setup directly in front of the home. The Agents were able 10 see from a distance that a subject who matches the description of Preston McWaters, (and based upon all the known facts, Your Affiant believes is 9 Case 9:16-m-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 110f 17 MeWaters), did come out of the residence and drove away in McWaters” red in color Chevrolet Camaro at approximately 5:15 am. “The Agents followed him to the University of Georgia where he stayed for the day apparently working. They then followed him back to 155 Snapfinger Lane that afternoon. Employment of McWaters 30. Your Affiant has also leamed through the University of Georgia (UGA) Police Department that MeWaters works at UGA. in the dining hall in Athens, Georgia. The UGA police have provided a copy of McWaters work schedule and it shows that he works as carly as 5:55 am. Cell Site Location from Tracfones 31. On February 22, 2016, a Florida state court order requested that AT&T provide toll records and cellular site location data for the fist target telephone, 561-797-9156. On that same day, AT&T responded with the requested information. The FBI conducted a cell phone analysis of the data and provided the following response: The results were that target telephone 561-797-5156 connected 10 the cellular towers 28 times. Of those 28 times, 24 times (on 12/11/2015 and 12/15/2015) the cell tower location data showed that the target telephone was in the geographical area of 155 Snapfinger Lane, Athens, Georgia. The remaining 4 times (on 12/16/2015), the target telephone was in the geographical area of the University of Georgia in Athens. Those dates are significant because December 11”, 2015 was the date the phone was purchased, activated, and used to create the fake "EricMead82" Twitter account. December 15", 2015 was the date that the first two messages were posted on the "EricMead82" account which were general in nature and it appeared that the suspect was testing the account. December 16, 10 Case 9:16-m-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 12 of 17 2015 is significant because that was the date that the first bomb threats to John I. Leonard High School were posted. 32. On February, 25, 2016, a state court order requested that AT&T provide cell site records on the second Tracfone, 561-601-3416. These records show that the target telephone connected to Twitter via text messaging 10 40404 two times on January 25, 2016, which was the creation date of the second fake Eric Mead Twitter account "Mead Lewis". The FBI conducted a cell phone analysis of the data and provided the following response: The results were that target telephone 561-601-3416 connected to the same cellular towers as did the previous target telephone, this time a total of 14 times on January 24, 2016, and once on January 29, 2016. OF the 14 times on January 24", the cell tower location data showed that the target telephone was in the geographical area of 155 Snapfinger Lane, Athens, Georgia. The remaining one time, the phone was in a geographical area south west of Athens; IP Addresses 33. During the course of the investigation, subpoenas and search warrants have been directed to various companies in an attempt to identify the intemet protocol (IP) address from where the email messages are being sent. One of the companies identified is 1&1, who is the domain holder of numerous free email accounts including @usa.com, @techic.com, and @engincer.com. The response from Facebook showed that the account was created using an email address of [email protected]. All of the responses from 1&1, Facebook, Twitter, and Tracfone have been traced by IP address back to a company named London Trust Media dba privateintemetaccess.com. This company is an anonymizing company whose purpose is to allow users of the internet to mask their original IP address where they are sending messages from. A n Case 9:16-m-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 13 of 17 subpoena was sent to London Trust Media and the only information they could provide is that the cluster of IP addresses being used was from the east coast of the United States. However, London Trust did provide that they accept payment for their services through credit card with a vendor company of Stripe and/or Amazon. They also accept forms of payment online through paypal, bitpay, bit coin, cashyou, ripple, ok pay, and pay garden. 34. Although the investigation has not revealed any payment by MeWaters to London Trust, he did make a purchase from AnchorFree Inc on October 23, 2015. AnchorFree, according to their website, is a Hotspot Shield VPN (virtual private network) service that “protects your IP address, enabling you to surf the web anonymously and privately”. Bank Records 35. On February 29, 2016, a subpoena was sent to the First Madison Bank in Athens, Georgia requesting banking records for Preston McWaters. First Madison responded with the requested information. The banking records show that McWaters listed his address as the 155 Snapfinger Lane in Athens, Georgia. The banking records also show that on December 11, 2015, MeWaters made a cash withdrawal of $80.00 and on January 22, 2016, he made a cash withdrawal of $60.00. These dates are significant because these are the exact same dates that the prepaid Tracfones discussed previously in this affidavit were purchased from Walmart in Athens with cash. On the January 22, 2016, transaction, the cash tendered at the register was $60.00, the exact amount that McWaters withdrew from his bank account that day. First Madison also provided video surveillance photos of McWaters making the withdrawals on those two dates. On December 11%, the photo shows McWaters face directly in front of the camera making the withdrawal at 11:44 am. In the photo you can also see that he is wearing sunglasses, a black and 12 Case 9:16-m|-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 14 of 17 camouflage colored jacket, and a baseball style hat with the University of Georgia emblem on it He is driving a dark colored Jeep SUV. This clothing matches the description of the clothing worn by the suspect purchasing the first tracfone referred to in this affidavit, 561-797-9156, at the Walmart store on this same date at 12:11 pm. Therefore, your Affiant believes that it was McWaters who purchased the Tracfone on December 11, 2015. The FBI took a picture of 155 Snapfinger Lane while conducting surveillance on February 29, 2016. McWaters' red in color Camaro and a dark colored Jeep SUV were parked in the driveway. The video surveillance photos also show the transaction that occurred on January 22, 2016. At 8:14 am. McWaters drives up to the ATM in his red in color Camaro. The camera angle did not capture a picture of his face because the vehicle sits 100 low to the ground. However, the vehicle matches the description of the vehicle that the suspect drove to Walmart on that same day to purchase the second Tracfone referred to in this affidavit, 561-601-3416, at 10:04 am. Based on the surveillance video from the bank and Walmart, your Affiant believes that it was Mc Waters who purchased the second Tracfone on January 22, 2016. Activity On-going 36. On March 4, 2016, at 1:03 am, the principal of a Palm Beach County Elementary school reccived an email from DevonKenney94@nmail com that sated the following: “We have placed 13 chemical weapons throughout your facilities. They will detonate at 10:30 a.m. March 7, 2016 if you do not comply with our demands and bring $20,000.000.00 to 2500 Via Royale Apt. 2508. Jupiter, FL 33458 by the time of detonation. If you even try to contact the authorities and alert them to the situation then we will detonate the weapons early and everyone of your students will die. You have 4 days. Do not fuck with us! We are watching you “Leslie Bolte™ 3 Case 9:16-m[-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 15 of 17 and your family.” Search of Residence 37. On March 7, 2016, a federal search warrant was signed by a United States Magistrate Judge in the Middle District of Georgia authorizing the search of 155 Snapfinger Lane in Athens, Georgia. On March 8, 2016, FBI Agenis executed the search warrant. MeWaters was located in his bedroom and in his possession was his Apple iPhone. Upon gaining access to the iPhone, a mobile application for Private Intemet Access (PIA) was discovered. Private Intemet Access is a VPN (Virtual Private Network) provider that specializes in secure, encrypted VPN tunnels which create several layers of privacy and security. Private Internet Access is affiliated with London Trust Media. All email addresses responsible for the emailed bomb threats were email addresses owned by London Trust Media. A search of MeWaters’ red Chevrolet Camaro revealed two LG model car chargers. These car chargers are not compatible with McWaters iPhone and are believed to be the car chargers for the two TracFones purchased by McWaters. Also in the vehicle was a note with the following information: PIA.com, Username: p6808444, Password: 2PDN9YhkAe. McWaters’ wallet, to include his identification, was in the red Camaro. \ 14 Case 9:16-m[-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 16 of 17 INCLUSION 38. Based on the foregoing, there is probable cause to believe that the federal criminal statutes cited herein have been violated by PRESTON ALEXANDER MCWATERS and that sufficient evidence has been presented to authorize an arrest warrant. 1 respectfully request that this Court issue an arrest warrant for PRESTON ALEXANDER MCWATERS. RespectfdNy submitted, Scott Liben) Task Force Officer Federal Bureau of Investigation Subscribed and sworn to before me on this s day of March, 2016 FONORABLE JAMES M. 7 UNITED STATES MAGISTRATE JUDGE 15 Case 9:16-m-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 17 of 17 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF FLORIDA c: a ‘ase No.: 16:8075-JMH FED EY 5 oC. UNITED STATES OF AMERICA, MAR 0 8 7016 v. mvs ose Corns ura PRESTON ALEXANDER MCWATERS, Defendant. / COVER SHEET 1. Did this matter originate from a matter pending in the Northern Region of the United States Attomey's Office prior to October 14,2003? ___ Yes _X_ No 2. Did this matter originate from a matter pending in the Central Region of the United States Attomey's Office prior to September 1, 20072 Yes _X_ No Respectfully submitted. WIFREDO A. FERRER UNITED STATES ATTORNEY » é. Edvard C. Nucci Assistant United States Attorney Florida Bar No. 794406 United States Atiomey’s Office Southern District of Florida 500S. Australian Avenue, Suite 400 West Palm Beach, Florida 33401 Telephone: (561) 820-8711 Facsimile: (561) 805-4986 Email: Edward Nueci@usdoj gov