Application for a Warrant by Telephone or Other Reliable Electronic Means
- Date
- 2023-03-30
Summary
An AO 106A application for a warrant by telephone or other reliable electronic means, Case No. 23MJ1164 (3:23-mj-01164-BLM), filed March 31, 2023 as Document 1 in the U.S. District Court for the Southern District of California and attested before Magistrate Judge Barbara L. Major on 03/30/2023. It seeks AT&T records for a cellular telephone number, including subscriber, toll and cell-site location data from July 1, 2020 to August 31, 2022, citing 18 USC §§ 1343 and 1349 and 18 USC § 1956(h). The affidavit of an FBI special agent describes the California EDD unemployment insurance program and expanded CARES Act benefits. It states investigators' belief that an individual helped others file fraudulent EDD applications and received $3,600.00 and $26,250.00 on applications. The filing closes with a blank AT&T certificate of authenticity.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.1 Page 1 of 19
AO 106A (08/18) Application for a Warrant by Telephone or Other Reliable Electronic Means
UNITED STATES DISTRICT COURT
for the
Southern District
__________ DistrictofofCalifornia
__________
In the Matter of the Search of )
(Briefly describe the property to be searched )
or identify the person by name and address) ) Case No. 23MJ1164
Information associated with a cellular telephone number )
(330)-232-0667 that is stored at premises controlled by )
AT&T
)
APPLICATION FOR A WARRANT BY TELEPHONE OR OTHER RELIABLE ELECTRONIC MEANS
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):
See Attachment A, incorporated herein by reference.
located in the Southern District of Florida , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B, incorporated herein by reference.
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
✔ evidence of a crime;
u
✔ contraband, fruits of crime, or other items illegally possessed;
u
✔ property designed for use, intended for use, or used in committing a crime;
u
u a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 USC §§ 1343 and 1349 Conspiracy to Commit Wire Fraud
18 USC § 1956(h) Conspiracy to Commit Money Laundering
The application is based on these facts:
See Attached Affidavit of FBI Special Agent Courtney M. McGuire, incorporated herein by reference.
u Continued on the attached sheet.
u Delayed notice of days (give exact ending date if more than 30 days: ) is requested under
18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.
Courtney M. McGuire
Applicant’s signature
Courtney M. McGuire, FBI Special Agent
Printed name and title
Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1 by
telephone (specify reliable electronic means).
Date: 03/30/2023
Judge’s signature
Barbara L. Major
City and state: San Diego, California Hon. , U.S. Magistrate Judge
Printed name and title
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.2 Page 2 of 19
1 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANT
2 I, Courtney M. McGuire, Special Agent with the Federal Bureau of Investigation
3 (FBI), being duly sworn, hereby state as follows:
4 INTRODUCTION
5 1. I submit this affidavit in support of an application for a search warrant for:
6 AT&T, a wireless telephone service provider headquartered at 11760 US Highway 1, 4th
7 floor, North Palm Beach, Florida 33408, as described in Attachment A, to search the
8 accounts associated with a cellular telephone number (330)-232-0667 (“Subject
9 Account”) for subscriber information, telephone toll data, and cell-site geo-location
10 information, for the period of July 1, 2020 up to and including and August 31, 2022. There
11 is probable cause that these records and information constitute evidence, fruits, and
12 instrumentalities of violations of federal criminal law, namely, Title 18, United States
13 Code, Sections 1349 and 1956(h), as more fully described in Attachment B. This affidavit
14 and application are sought pursuant to Rule 41 of the Federal Rules of Criminal Procedure
15 and 18 U.S.C. § 2703(a), which applies to providers of electronic communication services.
16 In this case, as will be shown below, AT&T provides electronic communication services
17 in the form of cellular and wireless telephone service for the Subject Account.
18 AGENT EXPERIENCE AND BACKGROUND
19 2. I am an investigative or law enforcement officer within the meaning of Title
20 18, United States Code, Section 2510(7); that is, an officer of the United States, who is
21 empowered by law to conduct investigations of and to make arrests for offenses
22 enumerated in Title 18, United States Code, Section 2516. I have been employed as a
23 Special Agent with the Federal Bureau of Investigation (FBI) since December of 2021. I
24 am presently assigned to the FBI San Diego’s Transnational Organized Crime – Global
25 squad (TOC-G). This squad investigates money laundering and other derivative financial
26 crimes committed by criminal organizations. Prior to my assignment with the TOC-G
27 squad, I completed the 17-week FBI Academy in Quantico, Virginia and was trained in
28 investigative techniques, procedures and strategies. Prior to my appointment as a Special
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.3 Page 3 of 19
1 Agent, I worked for the FBI as a Tactical Specialist and administrative support employee
2 for four years. As a Tactical Specialist, I conducted research and analyzed data in support
3 of federal criminal and national security investigations. Prior to my appointment to the FBI,
4 I served as a Jailer for the Laguna Beach Police Department in Laguna Beach, California.
5 I have a Bachelor of Science degree in Biology from Boise State University.
6 3. As both a Tactical Specialist and a Special Agent with the FBI, I have
7 participated in numerous investigations involving individuals of criminal organizations
8 engaged in money laundering, drug trafficking, human trafficking and robbery. Through
9 my investigations, my training and experience, and discussions with other law enforcement
10 personnel, I have become familiar with the tactics and methods used by criminal enterprises
11 to collect and launder the proceeds from specified unlawful activity to include drug
12 trafficking, interstate transportation of stolen goods, wire fraud and mail fraud.
13 FACTS SUPPORTING PROBABLE CAUSE
14 Background on Romanian Organized Crime Group
15 4. In September 2021, Romanian law enforcement provided information to the
16 FBI regarding various organized crime groups coming to the United States from Romania
17 to commit various frauds, swindles, and schemes, to obtain as much money as possible
18 and then launder the funds back to Romania. In November 2021, the San Diego Police
19 Department (SDPD) became aware of a series of felony theft related crimes targeting the
20 elderly population in San Diego, believed to have been committed by Romanian
21 organized crime groups.
22 5. Through a series of custodial interviews and search warrants for Facebook
23 accounts used by members of the Romanian organized crime groups, investigators
24 discovered a separate but overlapping wide-spread conspiracy to conduct wire fraud and
25 fraudulently obtain unemployment benefits in California. This conspiracy was
26 perpetrated by hundreds of members of Romanian organized crime groups, and was
27 facilitated by SANDU.
28
2
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.4 Page 4 of 19
Background on California EDD
1
2 6. The Unemployment Insurance (“UI”) Program is a joint federal-state
3 partnership administered on behalf of the U.S. Department of Labor by agencies in each
4 state. In the State of California, the UI Program is administered by California’s
5 Employment Development Department (“California EDD”).
6 7. On March 13, 2020, President Trump declared a nationwide emergency due
7 to COVID-19, and in March 2020, the Families First Coronavirus Response Act
8 (FFCRA) and the Coronavirus Aid, Relief, and Economic Security (CARES) Act
9 provided additional funding for state UI agencies to respond to the COVID-19 pandemic.
10 The CARES Act allowed states to expand the scope of workers who were eligible to
11 receive state UI benefits, to extend the period of time for which workers could be eligible
12 for UI benefits, and to allow workers who may have exhausted UI benefits under
13 traditional programs to receive benefits.
14 8. The CARES Act further expanded the ability of states to provide benefits to
15 unemployed workers by creating three new unemployment programs, namely, the
16 Pandemic Unemployment Assistance (PUA) program, which permitted states to provide
17 benefits to individuals who were self-employed, seeking part-time employment, or
18 otherwise would not qualify for regular unemployment benefits, the Federal Pandemic
19 Unemployment Compensation (FPUC) Program, which provided an additional amount
20 in federal benefits to individuals collecting traditional UI program benefits, and the
21 Pandemic Emergency Unemployment Compensation (PEUC) program, which provided
22 additional weeks of benefits for individuals who had otherwise exhausted their
23 entitlement to regular UI benefits (collectively referred to herein as “expanded pandemic
24 UI benefits”) PUA and FPUC benefits were 100% federally funded benefits paid through
25 state UI agencies. To receive UI, PUA, PEUC, and FPUC benefits from a state UI agency,
26 an applicant could file a claim, via the internet, with the state UI agency from which he
27 was eligible to seek benefits.
28
3
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.5 Page 5 of 19
9. California EDD provided unemployment insurance benefits for regular UI
1
2 and expanded UI pandemic benefits to individuals whom California EDD determined
3 were entitled to receive such benefits through debit cards, which were funded by
4 California EDD and issued by Bank of America N.A.
5 10. California EDD’s determination of whether the individuals were entitled to
6 receive unemployment insurance benefits relied, in part, on confirmations from the
7 employer (from which the individual has been recently unemployed) that the employee
8 had worked with the employer.
9 11. Once a debit card for unemployment insurance benefits was issued,
10 California EDD funded those debit cards by having funds drawn from the United States
11 federal treasury in Washington, D.C., and wired those funds to Bank of America N.A.
12 12. Bank of America N.A. utilized debit processing services located in Colorado
13 and Virginia to create accounts, load funds, and post payments for unemployment
14 insurance debit cards. When a withdrawal was made from an account using a debit card,
15 information was sent electronically to servers in Colorado and Virginia to post a debit to
16 the account.
17 13. Between March and October 2020, over 8 million Californians filed for
18 unemployment benefits. In light of the high volume of applications, on October 5, 2020,
19 California implemented a new verification process for EDD through ID.me, which
20 provided an automated process with a virtual in-person session with an ID.me
21 representative, known as a “trusted referee,” to quickly verify the identity of the applicant
22 through a multi-step process using Artificial Intelligence and Human Intelligence
23 together.
24 14. With the addition of ID.me, each applicant needed to complete a verification
25 process before applying for benefits. Once the verification process was completed, they
26 could re-enter the EDD portal and apply for benefits. The applicant would be given a
27 “Confirmation Number” connected to their application for future reference.
28
4
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.6 Page 6 of 19
15. Once approved for pandemic benefits, the recipient of the benefits would be
1
2 required to periodically recertify under the penalties of perjury that, among other things,
3 the recipient was unemployed due to the COVID-19 pandemic and therefore remained
4 eligible to receive pandemic benefits.
5 SANDU’s Role In The Wire Fraud Conspiracy
6 16. Based on an interview with a cooperating witness, and the review of social
7 media search warrant returns, EDD applications and ID.me records, Investigators
8 determined that SANDU developed a process to receive the most benefits possible by
9 using fraudulent identifications, falsified utility bills, falsified earnings statements,
10 falsified W2s, and fraudulent Health Insurance cards. He would also “backdate” or
11 modify an EDD application with an earlier unemployment start date to generate
12 additional fraudulent income.
13 17. In June 2022, cooperating witness F.T.1 identified SANDU via his Facebook
14 profile as the individual who assisted with F.T.’s fraudulent EDD application. Facebook
15 returns associated with SANDU later confirmed for Investigators that SANDU had
16 conspiratorial conversations on Facebook with individuals looking to fraudulently apply
17 for EDD benefits or “backdate” their EDD applications.
18 18. SANDU applied for EDD four separate times, on September 18, 2020, July
19 10, 2021, July 13, 2021, and June 5, 2022. For the application submitted on September
20 18, 2020, SANDU received $3,600.00. On this application, SANDU listed his true social
21 security number (SSN). Following the initial submission of the application, California
22 implemented the ID.me process, as discussed below. On October 21, 2020, SANDU
23 completed the ID.me process for that application. He provided a verification phone
24 number of 330-232-0667 (the Subject Account). Investigators have determined that the
25 Subject Account is serviced by AT&T Wireless. A records check was conducted that
26
1
F.T. was detained in June of 2022 for suspicion of California Penal Code (PC) 186.10 (a) money
27 laundering, PC 182(a)(1) conspiracy and PC 532(a) obtain money under false pretenses. F.T. waived
28 his/her Miranda rights and provided a voluntary statement to law enforcement. F.T. was not promised
anything in return for his/her cooperation and was ultimately released.
5
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.7 Page 7 of 19
revealed that the phone number was associated with David CONSTANTIN, who
1
2 investigators have determined is SANDU’s brother and who is believed to have worked
3 with SANDU to create fraudulent documents for applicants, as discussed herein. SANDU
2
4 used different, and fraudulent , SSNs in each subsequent application.
5 19. In the application submitted on July 10, 2021, SANDU submitted a
6 photograph of himself, a Maryland ID, and a W-2 showing he worked for Kraftsman
7 Construction Co. According to California Franchise Tax Board records, Kraftsman
8 Construction Co. does not exist. Despite this, SANDU’s W-2 indicates payment of
9 California State income tax using a fraudulent California State Identification Number for
10 Kraftsman Construction Co. On July 10, 2021, SANDU also completed the ID.me
11 process.
12 20. In the application submitted on July 13, 2021, which SANDU submitted
13 under the alias Ionut Mihai, SANDU submitted a photograph of himself, a Washington
14 state ID, a California state ID, and another W-2 from Kraftsman Construction Co.
15 Investigators compared the supporting documents and photographs for “Ionut Mihai’s”
16 application to confirm the applicant’s true identity to be SANDU. Additionally, SANDU
17 participated in an ID.me verification session where he confirmed he was applying for
18 California EDD benefits and received $26,250.00 for this application.
19 21. In the application submitted on June 5, 2022, SANDU again used a different
20 SSN, submitted another W-2 from Kraftsman Construction Co., and a Maryland ID.
21 SANDU did not receive benefits from this application.
22 22. Beginning in July 2021, SANDU and another individual sent public
23 announcements via social media to a large network of co-conspirators, offering services
24 or meetings to conduct the fraud. Co-conspirators communicated with SANDU via
25 Facebook messaging or other electronic means, and/or met with him in person to provide
26
2
In my training and experience, I know that a Social Security Number (SSN) is a nine-digit, unique
27 identifier issued by the Social Security Administration to U.S. citizens, permanent residents, and
28 temporary (working) residents. It is needed to work and is used to determine an individual’s eligibility
for Social Security benefits and certain government services. Most individuals have only one SSN.
6
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.8 Page 8 of 19
their personal identifying information (PII). SANDU used PII provided by co-
1
2 conspirators to create or have others create the fraudulent documents listed above, which
3 SANDU then submitted in support of fraudulent EDD applications.
4 23. Beginning in October 2020, EDD contracted with ID.me to assist in the
5 identity verification of applicants. ID.me developed a process to verify supporting
6 documents submitted by EDD applicants. As a result, applicants were required to
7 participate in a recorded ID.me video verification session. Investigators reviewed many
8 EDD applications using the ID.me verification process. A review of ID.me records
3
9 identified four devices with specific device fingerprints that were used to create and/or
10 modify ID.me profiles that facilitated the verification of at least 137 fraudulent EDD
11 applications for 137 different individuals. Investigators traced each of the four devices to
12 SANDU and/or his assistant through conversations and EDD applications they created.
13 Investigators also reviewed hundreds of ID.me verification sessions for SANDU’s co-
14 conspirators. On several occasions, SANDU and his assistant, were seen in the
15 background of recorded ID.me video sessions for various co-conspirator EDD
16 applications.
17 24. Hundreds of EDD applications were reviewed by Investigators. They
18 identified a significant number of consistencies across numerous supporting documents
19 provided by applicants that reflected SANDU’s reuse of resources in support of the
20 scheme. For example, documents submitted in support of co-conspirators’ applications
21 listed the same names of businesses, Employer Identification Numbers (EINs), California
22 State Identification Numbers, Blue Cross/Blue Shield member identification numbers,
23 account numbers for Southern California Edison utility bills and passwords
24 (“Romania221$”) for almost all email addresses used to submit EDD applications.
25 According to the California Franchise Tax Board, none of the companies in the various
26
27 3
A device fingerprint is a unique identifier (aggregated hash value) associated with a user’s device, from
the hardware, operating system, audio stack, and its configuration. Browser fingerprinting refers to the
28
process of collecting information through java script to create a fingerprint of a device.
7
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.9 Page 9 of 19
W-2’s submitted for conspirators’ EDD applications were established companies in the
1
2 State of California. Despite this, all W-2’s submitted for conspirators’ EDD applications
3 indicate California State Income Tax withholdings by companies with fraudulent
4 California State Identification Numbers. According to Blue Cross/Blue Shield and
5 Southern California Edison, none of the member identification numbers or account
6 numbers submitted in support of co-conspirators EDD applications were real.
7 25. In total, SANDU is believed to have conspired with at least 214 unnamed
8 co-conspirators to fraudulently obtain no less than $5,207,687.00 in California
9 Unemployment Insurance benefits. For his services, Investigators have determined that
10 SANDU was then paid a fee by the individual co-conspirator, often ranging between
11 $250.00 and $1,000.00.
12 a. For example, social media returns showed that on July 14, 2021, A.G.
13 communicated with SANDU via Facebook regarding EDD for his wife, T.G.
14 On July 14, 2021, T.G. participated in a recorded video interview with
15 ID.me, in which she identified herself by name and date of birth, and
16 confirmed that she was applying for California EDD. A fraudulent Anthem
17 Blue Cross/Blue Shield member ID was added to her ID.me account. On
18 July 15, 2021, A.G. sent SANDU a Facebook message with the phone
19 number 669-239-5640. Following this, SANDU sent A.G. a screenshot via
20 Facebook message of an EDD application confirmation screen for T.G. with
21 confirmation number 38022946. SANDU also sent A.G. via Facebook
22 message the email address marta22121m@gmail.com and the password
23 Romania221$. Also on July 15, 2021, SANDU received via Facebook
24 message a falsified W-2 for T.G. from another individual. According to
25 California Franchise Tax Board, the company listed does not exist in the
26 State of California.
27 b. According to EDD records, an application was submitted for T.G. on July
28 15, 2021, under the email address of marta22121m@gmail.com. The phone
8
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.10 Page 10 of 19
number connected to the application was 669-239-5640, the same as the
1
2 number provided by A.G via Facebook message.
3 c. On July 25, 2021, T.G. began receiving EDD benefits, ultimately totaling
4 $27,000.00.
5 d. In October 2021, A.G. told SANDU he would be in San Diego, and they
6 discussed money. Bank of America records show the money fraudulently
7 obtained by A.G. and T.G. was withdrawn at ATMs in the Southern District
8 of California, as well as in Oregon and other parts of California, including a
9 $400.00 ATM withdrawal in Escondido, CA on August 4, 2021.
10 Specifically, Bank of America ATM footage revealed A.G. withdrawing
11 money from T.G.’s EDD account in California both by himself and with
12 T.G.
13 e. In another example, on July 14, 2021, C.G. participated in a recorded video
14 interview with ID.me, during which he confirmed that he was applying for
15 California EDD benefits, and presented a fraudulent California driver’s
16 license. According to the California DMV, this drivers license number
17 belongs to someone else. On July 15, 2021, SANDU sent C.G. a Facebook
18 message indicating that he “needed a W-2”. That same day, C.G. responded
19 with a W-2 for his son, providing a SSN and photograph with the email
20 address gioninebunuo@gmail.com, the password Romania221$, and the
21 phone number 714-837-3249. An application for unemployment benefits
22 was submitted to EDD for this individual, claiming to be a US Citizen, and
23 being employed by Kraftsman Construction, on the same day.
24 f. SANDU sent the ID.me verification codes for both C.G. and his son to C.G.,
25 and on July 15, 2021 sent a facebook message to C.G. with a confirmation
26 screen from EDD, confirmation number 38029477. On August 9, 2021,
27 C.G.’s son began receiving $6,000.00 in EDD benefits. On August 29, 2021,
28 C.G. began receiving $27,000.00 in EDD benefits.
9
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.11 Page 11 of 19
g. Bank of America records confirm C.G. withdrew $26,950 from ATMs in
1
2 the Southern District of California, including $900 in Escondido, CA on
3 September 23, 2021, as well as other parts of California. As of December
4 29, 2022, the account had a balance of $8.27.
5 26. Ultimately, Investigators have determined, based on cooperating witness
6 interviews, financial records, social media search warrant returns, and the review of EDD
7 applications and ID.me records, that between September 2020 and August 2022, SANDU
8 conspired with over 214 individuals known and unknown to commit this wire fraud.
9 SANDU’s Laundering of the Money Obtained
10 27. According to a review of Facebook messages between SANDU and co-
11 conspirators, SANDU charged a fee between $250.00 and $1,000.00 for assisting
12 individuals with submitting fraudulent EDD applications online. Based on Facebook
4
13 messages, SANDU received payment for his services via counter deposit and Zelle
14 transfers. On multiple occasions via Facebook message, SANDU sent his Bank of
15 America account and routing numbers to co-conspirators to conduct counter deposits into
16 SANDU’s bank account following an EDD payout. The following are examples of
17 SANDU’s means and methods for receiving funds obtained via EDD fraud from his co-
18 conspirators.
19 a. I.C. communicated directly with SANDU via Facebook message regarding
20 EDD applications for himself and his wife, L.D. On July 10, 2021, L.D.
21 fraudulently applied for EDD, and ultimately received $27,000.00. On
22 September 2, 2020, SANDU sent his account and routing information to I.C.
23 via Facebook message. I.C. responded to SANDU via Facebook message
24 with a receipt for a $300.00 deposit. According to SANDU’s bank account
25 records, a $300.00 counter deposit was conducted on September 2, 2020.
26
27
4
A counter deposit is referred to as a financial transaction at a bank branch in which an individual
28
deposits money in person into a bank account.
10
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.12 Page 12 of 19
b. On September 2, 2020, F.R. applied online for EDD benefits. F.R. received
1
2 his/her first EDD payment on October 23, 2020 and received a large
3 payment on November 4, 2020. A few days after the large payment, on
4 November 11, 2020, SANDU sent F.R. his account and routing information.
5 The following day, a $250 transfer was made into SANDU’s account.
6 c. C.S. communicated directly with SANDU via Facebook message about EDD
7 for himself and his wife, R.M. On July 31, 2020, C.S. applied online for
8 EDD benefits. On December 26, 2020, R.M. applied online for EDD
9 benefits. C.S. received an EDD payout on August 7, 2020 and R.M. received
10 an EDD payout on December 30, 2020. On December 10, 2020, SANDU
11 sent C.S his account and routing information via Facebook message. C.S.
12 responded the same day with a photo of a Bank of America receipt
13 confirming a $900.00 deposit. According to records for SANDU’s bank
14 account, a $900.00 counter deposit was conducted on December 10, 2020.
15 d. R.D. communicated directly with SANDU via Facebook message regarding
16 EDD fraud on behalf of himself and four other individuals: M.D., A.M.,
17 A.D., and M.C.. In July 2021, three of the individuals fraudulently applied
18 for and received EDD benefits. On September 29, 2021, M.C. received the
19 group’s final EDD payout. On the same day, R.D. sent SANDU five $500.00
20 Zelle transfers.
21 28. A review of records associated with SANDU’s Bank of America account
22 revealed numerous payments to a Remitly account5. Investigators’ review confirmed that
23 SANDU opened his Remitly account on September 11, 2020. The phone number listed
24 on his account was (330)-232-0667 (Subject Account). The e-mail address associated
25 5
Open source research identified Remitly as a financial institution known for sending money abroad.
26 As of March 28, 2023, Remitly marketed their business as “Remit Money Abroad – Remit Quickly”.
Based on my training and experience, individuals who have obtained money fraudulently, through illicit
27 means and/or otherwise specified unlawful activity will often attempt to repatriate those funds to another
28 country for the purposes of concealing the source and nature of the funds or to further promote specified
unlawful activity.
11
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.13 Page 13 of 19
1 with the account was constantinbobi@icloud.com. Separately, a review of SANDU’s
2 Facebook messages revealed conversations with I.T. regarding construction work on a
3 house in Romania. I.T. sent SANDU numerous photos of a house in Romania,
4 construction materials, invoices, and receipts from a Romanian home supply store. In
5 response to the receipts, and invoices, SANDU responded with a screenshot of a Remitly
6 transfer confirmation showing funds were sent from SANDU to I.T. According to records
7 received from Remitly, between May 19, 2021 and August 14, 2022, SANDU sent 20
8 transactions to I.T. totaling more than $16,000.00.
9 29. In September 2022, Investigators learned SANDU returned to Romania. On
10 October 25, 2022 and December 6, 2022, SANDU posted photos of himself and his
11 family members in the vicinity of the aforementioned house in Romania. Additionally,
12 Facebook comments indicated the house was owned or occupied by SANDU.
13 SANDU’s Statement of the Offense and Criminal Proceedings
14 30. On February 27, 2023 Defendant, along with his wife and four children, was
15 encountered by Border Patrol entering the United States illegally, approximately one mile
16 west of the San Ysidro, California Port of Entry and approximately 100 yards north of
17 the United States/Mexico International Boundary. Sandu was detained by Border Patrol
18 and then arrested by the FBI on March 1, 2023. On March 1, 2023, he agreed to waive
19 his rights and speak to investigators. Among other things, he admitted to applying for
20 EDD benefits, assisting family in applying for EDD benefits, and sending approximately
21 $24,000.00 to a contractor in Romania to renovate his house. SANDU further admitted
22 that he used a friend to obtain fraudulent W-2s, false identifications, fraudulent utility
23 bills and fraudulent insurance cards for the purposes of applying for EDD benefits.
24 31. On March 2, 2023, a federal complaint was filed in the Southern District of
25 California charging SANDU with Conspiracy to Commit Wire Fraud, in violation of 18
26 U.S.C. § 1349. On March 28, 2023, SANDU was arraigned on an information charging
27 him with Conspiracy to Commit Wire Fraud, in violation of 18 U.S.C. § 1349 and
28
12
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.14 Page 14 of 19
1 Conspiracy to Launder Monetary Instruments, in violation of 18 U.S.C. § 1956(h). He is
2 currently pending those charges in Case No. 23-CR-0386-LAB.
3 METHODOLOGY
4 32. Based on the facts above, there is reason to believe that SANDU committed
5 illegal activities, and that SANDU used the Subject Account to communicate with each
6 other for the purpose of conspiracy to commit wire fraud and money laundering.
7 Additionally, given that people traditionally carry cellular phones on their persons and are
8 rarely away from home without their cellular phones, I believe SANDU possessed this
9 cellular device as he traveled and met with the 214 unnamed co-conspirators for the
10 purpose of committing wire fraud and money laundering conspiracy. I believe that the
11 Subject Account will produce evidence that provides further corroboration of these.
12 33. Based on my training and experience, and my consultation with other law
13 enforcement officers, I am aware that AT&T Wireless routinely collects and stores data for
14 the electronic communication accounts to which it and other providers issue telephone
15 numbers. The data includes: (i) subscribers’ contact and billing information; (ii) detailed
16 information concerning subscribers’ incoming and outgoing telephone calls; (iii) detailed
17 information concerning subscribers’ outgoing direct calls, text message, and SMS
18 messages; and (iv) detailed information concerning cell-site geo-location data.
19 34. In particular, I know that cell phones connect to a provider’s network through
20 cell towers or cell sites. The particular tower or site may change as a phone moves from
21 one location to another. Providers automatically record and retain this connection data as
22 part of the subject account. Records and data identifying the towers or sites to which a
23 phone connected therefore tend to identify the phone’s and phone user’s location at
24 particular times.
25 35. Given these facts, I seek a warrant to search the Subject Account for the
26 records and information in Attachment B.
27
28
13
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.15 Page 15 of 19
1 PRIOR ATTEMPTS TO OBTAIN THIS EVIDENCE
2 36. The United States is unaware at this time of other attempts by the U.S.
3 government to obtain this data by other means.
4 I swear the foregoing is true and correct to the best of my knowledge and belief.
5
6 Courtney M. McGuire
7 Courtney M. McGuire
Special Agent, FBI
8
9
Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1
10 by telephone on this ____
30th day of March 2023.
11
_________________________________
12 HONORABLE Barbara L. Major
13 United States Magistrate Judge
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
14
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.16 Page 16 of 19
1
ATTACHMENT A
2
PROPERTY TO BE SEARCHED
3
AT&T hosts the electronic communication account associated with the telephone number
4 (330)-232-0667 that is the subject of this search warrant and search warrant application
5 (Subject Account). AT&T is an electronic communication service provider whose
primary computer information systems and other electronic communications and storage
6 systems, records, and data are located at 11760 US Highway 1, 4th floor, North Palm
7 Beach, Florida 33408.
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
15
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.17 Page 17 of 19
1
ATTACHMENT B
2 ITEMS TO BE SEIZED
3 I. Service of Warrant
4 The officer executing the warrant shall permit the Provider in Attachment A, as custodian
5 of the electronic files described in Section II below, to locate the files and copy them onto
removable electronic storage media and deliver the same to the officer.
6
II. Items to Be Seized
7
Agents shall seize the following records, data, and information covering July 1, 2020
8
up to and including and August 31, 2022 and maintained by the Provider for the subject
9
account identified in Attachment A:
10
11 a. Subscriber information, including:
i. Names;
12 ii. Addresses (including mailing addresses, residential addresses, business
13 addresses, and e-mail addresses);
iii. Local and long distance telephone connection records;
14 iv. Records of session times and durations, and the temporarily assigned
15 network addresses (such as Internet Protocol (“IP”) addresses)
associated with those sessions;
16 v. Length of service (including start date) and types of service utilized;
17 vi. Telephone or instrument numbers, including MAC addresses,
Electronic Serial Numbers (“ESN”), Mobile Electronic Identity
18 Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”); Mobile
19 Identification Number (“MIN”), Subscriber Identity Modules (“SIM”),
Mobile Subscriber Integrated Services Digital Network Number
20 (“MSISDN”); International Mobile Subscriber Identity Identifiers
21 (“IMSI”), or International Mobile Equipment Identities (“IMEI”);
vii. Other subscriber numbers or identities; and
22 viii. Means and source of payment (including any credit card or bank
23 account number) and billing records.
24 b. Records and other information about past wire or electronic communications
25 sent or received by the subject account, including:
i. the date and time of the communication;
26 ii. the method of the communication;
27 iii. the source and destination of the communication, such as the source and
destination telephone numbers (call detail records), email addresses, or
28 IP addresses; [and]
16
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.18 Page 18 of 19
iv. Cell site locations and sectors for all outgoing and incoming voice,
1
SMS, MMS, and Data communications;
2
3
Which are evidence of violations of Title 18, United States Code, Sections 1349 and
4
1956(h).
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
17
Case 3:23-mj-01164-BLM Document 1 Filed 03/31/23 PageID.19 Page 19 of 19
CERTIFICATE OF AUTHENTICITY OF DOMESTIC RECORDS
1 PURSUANT TO FEDERAL RULES OF EVIDENCE 902(11) AND 902(13)
2
3 I, _________________________________, attest, under penalties of perjury by the laws of the
4 United States of America pursuant to 28 U.S.C. § 1746, that the information contained in this certification
5 is true and correct. I am employed by AT&T, and my title is _____________________________. I am
6 qualified to authenticate the records attached hereto because I am familiar with how the records were
7
created, managed, stored, and retrieved. I state that the records attached hereto are true duplicates of the
8
original records in the custody of AT&T. The attached records consist of ______________
9
[GENERALLY DESCRIBE RECORDS (pages/CDs/megabytes)]. I further state that:
10
11 a. all records attached to this certificate were made at or near the time of the occurrence of
the matter set forth by, or from information transmitted by, a person with knowledge of those matters,
12
they were kept in the ordinary course of the regularly conducted business activity of AT&T, and they
13
were made by AT&T as a regular practice; and
14 b. such records were generated by AT&T’s electronic process or system that produces an
15 accurate result, to wit:
16 1. the records were copied from electronic device(s), storage medium(s), or file(s) in
17 the custody of AT&T in a manner to ensure that they are true duplicates of the original records; and
2. the process or system is regularly verified by AT&T, and at all times pertinent to
18
the records certified here the process and system functioned properly and normally.
19
I further state that this certification is intended to satisfy Rules 902(11) and 902(13) of the Federal
20
Rules of Evidence.
21
22
23 Date Signature
24
25
26
27
28
18
File and source
- File
- gov.uscourts.casd.755805.1.0.pdf
- Size
- 494,461 bytes
- SHA-256
- 7cd9de6fdb923c9d4a8f1c9b17f5fed661e273a5ad90cdeba107da7784a839a7
- Our copy
- gov.uscourts.casd.755805.1.0.pdf
- Original
- www.courtlistener.com