Application for a Warrant by Telephone or Other Reliable Electronic Means
- Date
- 2023-03-30
Summary
An application for a search warrant by telephone on form AO 106A, with a supporting affidavit by an FBI Special Agent, filed March 30, 2023 in the U.S. District Court for the Southern District of California, Case No. 23MJ1154 (Case 3:23-mj-01154-BLM, Document 1). It seeks to search an Apple iPhone identified as the Target Device for evidence of violations of 18 U.S.C. Section 1349 (conspiracy to commit wire fraud) and Section 1956(h) (conspiracy to commit money laundering), and was attested before Magistrate Judge Barbara L. Major. The affidavit states that the device was seized after an arrest on March 1, 2023 of a person with charges pending in Case No. 23-CR-0386-LAB. It describes California EDD unemployment benefits under the CARES Act and alleges fraudulent benefit applications. Attachment B lists data to be seized for July 1, 2020 up to and including August 31, 2022.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Application for a Warrant by Telephone or Other Reliable Electronic Means.”
Original at www.courtlistener.com, dated 2023-03-30. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2023-03-30-kyc-company-litigation/
, SHA-256 5b745adba7b63e844c4d3f39e07480e016120e3a5e7c3c700fb4bbb44f7b3946.Full text
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.1 Page 1 of 21
AO 106A (08/18) Application for a Warrant by Telephone or Other Reliable Electronic Means
UNITED STATES DISTRICT COURT
for the
Southern District
__________ DistrictofofCalifornia
__________
In the Matter of the Search of )
(Briefly describe the property to be searched )
or identify the person by name and address) ) Case No. 23MJ1154
Apple iPhone, IMEI 356715110833004 )
("Target Device") )
)
APPLICATION FOR A WARRANT BY TELEPHONE OR OTHER RELIABLE ELECTRONIC MEANS
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):
See Attachment A, incorporated herein by reference.
located in the Southern District of California , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B, incorporated herein by reference.
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
✔ evidence of a crime;
u
u contraband, fruits of crime, or other items illegally possessed;
u property designed for use, intended for use, or used in committing a crime;
u a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
Title 18 U.S.C. Section 1349 Conspiracy to Commit Wire Fraud
Title 18 U.S.C. Section 1956(h) Conspiracy to Commit Money Laundering
The application is based on these facts:
See Attached Affidavit, incorporated herein by reference.
✔ Continued on the attached sheet.
u
u Delayed notice of days (give exact ending date if more than 30 days: ) is requested under
18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.
Courtney M. McGuire
Applicant’s signature
Courtney M. McGuire, FBI Special Agent
Printed name and title
Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1 by
telephone (specify reliable electronic means).
Date: March 30, 2023
Judge’s signature
Barbara L. Major
City and state: San Diego, California Hon. , United States Magistrate Judge
Printed name and title
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.2 Page 2 of 21
1 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH
2 WARRANT
3 I, Courtney M. McGuire, Special Agent with the Federal Bureau of
4 Investigation (FBI), being duly sworn, hereby state as follows:
5 INTRODUCTION
6 1. I make this affidavit in support of an application for a search warrant
7 to search the following electronic devices, as described in Attachment A, and seize
8 evidence of crimes, specifically, violations of Title 18, United States Code,
9 Sections 1349 and 1956(h), as more particularly described in Attachment B:
10 a. Apple iPhone, IMEI 356715110833004 (Target Device).
11 This search supports an investigation conducted by the FBI into Constantin Bobi
12 SANDU who is suspected of committing one or more of the crimes mentioned
13 above. A factual explanation supporting probable cause follows.
14 2. The Target Device was one of four cell phones along with an
15 envelope of cash seized following the arrest of SANDU for wire fraud conspiracy
16 on March 1, 2023. SANDU identified one of the phones, Target Device, as his
17 own cell phone. SANDU is currently pending charges in the Southern District of
18 California in Case No. 23-CR-0386-LAB. The Target Device is currently in the
19 possession of the San Diego Police Department at 1401 Broadway, San Diego, CA
20 92101.
21 3. Based on the information below, there is probable cause to believe
22 that a search of the Target Device will produce evidence of the aforementioned
23 crimes, as described in Attachment B.
24 4. The information set forth in this affidavit is based on my own personal
25 knowledge, knowledge obtained from other individuals during my participation in
26 this investigation, including other law enforcement officers, my review of
27 documents and computer records related to this investigation, communications
28 1
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.3 Page 3 of 21
1 with others who have personal knowledge of the events and circumstances
2 described herein, and information gained through my training and experience.
3 Because this affidavit is submitted for the limited purpose of obtaining a search
4 warrant for the Target Device, it does not set forth each and every fact that I or
5 others have learned during the course of this investigation, but only contains those
6 facts believed to be necessary to establish probable cause.
7 EXPERIENCE AND TRAINING
8 5. I am an investigative or law enforcement officer within the meaning
9 of Title 18, United States Code, Section 2510(7); that is, an officer of the United
10 States, who is empowered by law to conduct investigations of and to make arrests
11 for offenses enumerated in Title 18, United States Code, Section 2516. I have been
12 employed as a Special Agent with the Federal Bureau of Investigation (FBI) since
13 December of 2021. I am presently assigned to the FBI San Diego’s Transnational
14 Organized Crime – Global squad (TOC-G). This squad investigates money
15 laundering and other derivative financial crimes committed by criminal
16 organizations. Prior to my assignment with the TOC-G squad, I completed the 17-
17 week FBI Academy in Quantico, Virginia and was trained in investigative
18 techniques, procedures and strategies. Prior to my appointment as a Special Agent,
19 I worked for the FBI as a Tactical Specialist and administrative support employee
20 for four years. As a Tactical Specialist, I conducted research and analyzed data in
21 support of federal criminal and national security investigations. Prior to my
22 appointment to the FBI, I served as a Jailer for the Laguna Beach Police
23 Department in Laguna Beach, California. I have a Bachelor of Science degree in
24 Biology from Boise State University.
25 6. As both a Tactical Specialist and a Special Agent with the FBI, I have
26 participated in numerous investigations involving individuals of criminal
27 organizations engaged in money laundering, drug trafficking, human trafficking
28 2
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.4 Page 4 of 21
1 and robbery. Through my investigations, my training and experience, and
2 discussions with other law enforcement personnel, I have become familiar with the
3 tactics and methods used by criminal enterprises to collect and launder the
4 proceeds from specified unlawful activity to include drug trafficking, interstate
5 transportation of stolen goods, wire fraud and mail fraud.
6 FACTS IN SUPPORT OF PROBABLE CAUSE
7 7. Based on the facts of this case, I believe that evidence of wire fraud
8 and money laundering conspiracies may be found on the Target Device.
9 Additionally, the search of the Target Device may also identify other individuals
10 engaged in these crimes.
11 Background on Romanian Organized Crime Group
12 8. In September 2021, Romanian law enforcement provided information
13 to the FBI regarding various organized crime groups coming to the United States
14 from Romania to commit various frauds, swindles, and schemes, to obtain as much
15 money as possible and then launder the funds back to Romania. In November 2021,
16 the San Diego Police Department (SDPD) became aware of a series of felony theft
17 related crimes targeting the elderly population in San Diego, believed to have been
18 committed by Romanian organized crime groups.
19 9. Through a series of custodial interviews and search warrants for
20 Facebook accounts used by members of the Romanian organized crime groups,
21 investigators discovered a separate but overlapping wide-spread conspiracy to
22 conduct wire fraud and fraudulently obtain unemployment benefits in California.
23 This conspiracy was perpetrated by hundreds of members of Romanian organized
24 crime groups, and was facilitated by SANDU.
25 Background on California EDD
26 10. The Unemployment Insurance (“UI”) Program is a joint federal-state
27 partnership administered on behalf of the U.S. Department of Labor by agencies
28 3
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.5 Page 5 of 21
1 in each state. In the State of California, the UI Program is administered by
2 California’s Employment Development Department (“California EDD”).
3 11. On March 13, 2020, President Trump declared a nationwide
4 emergency due to COVID-19, and in March 2020, the Families First Coronavirus
5 Response Act (FFCRA) and the Coronavirus Aid, Relief, and Economic Security
6 (CARES) Act provided additional funding for state UI agencies to respond to the
7 COVID-19 pandemic. The CARES Act allowed states to expand the scope of
8 workers who were eligible to receive state UI benefits, to extend the period of time
9 for which workers could be eligible for UI benefits, and to allow workers who may
10 have exhausted UI benefits under traditional programs to receive benefits.
11 12. The CARES Act further expanded the ability of states to provide
12 benefits to unemployed workers by creating three new unemployment programs,
13 namely, the Pandemic Unemployment Assistance (PUA) program, which
14 permitted states to provide benefits to individuals who were self-employed,
15 seeking part-time employment, or otherwise would not qualify for regular
16 unemployment benefits, the Federal Pandemic Unemployment Compensation
17 (FPUC) Program, which provided an additional amount in federal benefits to
18 individuals collecting traditional UI program benefits, and the Pandemic
19 Emergency Unemployment Compensation (PEUC) program, which provided
20 additional weeks of benefits for individuals who had otherwise exhausted their
21 entitlement to regular UI benefits (collectively referred to herein as “expanded
22 pandemic UI benefits”) PUA and FPUC benefits were 100% federally funded
23 benefits paid through state UI agencies. To receive UI, PUA, PEUC, and FPUC
24 benefits from a state UI agency, an applicant could file a claim, via the internet,
25 with the state UI agency from which he was eligible to seek benefits.
26 13. California EDD provided unemployment insurance benefits for
27 regular UI and expanded UI pandemic benefits to individuals whom California
28 4
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.6 Page 6 of 21
1 EDD determined were entitled to receive such benefits through debit cards, which
2 were funded by California EDD and issued by Bank of America N.A.
3 14. California EDD’s determination of whether the individuals were
4 entitled to receive unemployment insurance benefits relied, in part, on
5 confirmations from the employer (from which the individual has been recently
6 unemployed) that the employee had worked with the employer.
7 15. Once a debit card for unemployment insurance benefits was issued,
8 California EDD funded those debit cards by having funds drawn from the United
9 States federal treasury in Washington, D.C., and wired those funds to Bank of
10 America N.A.
11 16. Bank of America N.A. utilized debit processing services located in
12 Colorado and Virginia to create accounts, load funds, and post payments for
13 unemployment insurance debit cards. When a withdrawal was made from an
14 account using a debit card, information was sent electronically to servers in
15 Colorado and Virginia to post a debit to the account.
16 17. Between March and October 2020, over 8 million Californians filed
17 for unemployment benefits. In light of the high volume of applications, on October
18 5, 2020, California implemented a new verification process for EDD through
19 ID.me, which provided an automated process with a virtual in-person session with
20 an ID.me representative, known as a “trusted referee,” to quickly verify the identity
21 of the applicant through a multi-step process using Artificial Intelligence and
22 Human Intelligence together.
23 18. With the addition of ID.me, each applicant needed to complete a
24 verification process before applying for benefits. Once the verification process was
25 completed, they could re-enter the EDD portal and apply for benefits. The
26 applicant would be given a “Confirmation Number” connected to their application
27 for future reference.
28 5
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.7 Page 7 of 21
1 19. Once approved for pandemic benefits, the recipient of the benefits
2 would be required to periodically recertify under the penalties of perjury that,
3 among other things, the recipient was unemployed due to the COVID-19 pandemic
4 and therefore remained eligible to receive pandemic benefits.
5 SANDU’s Role In The Wire Fraud Conspiracy
6 20. Based on an interview with a cooperating witness, and the review of
7 social media search warrant returns, EDD applications and ID.me records,
8 Investigators determined that SANDU developed a process to receive the most
9 benefits possible by using fraudulent identifications, falsified utility bills, falsified
10 earnings statements, falsified W2s, and fraudulent Health Insurance cards. He
11 would also “backdate” or modify an EDD application with an earlier
12 unemployment start date to generate additional fraudulent income.
13 21. In June 2022, cooperating witness F.T.1 identified SANDU via his
14 Facebook profile as the individual who assisted with F.T.’s fraudulent EDD
15 application. Facebook returns associated with SANDU later confirmed for
16 Investigators that SANDU had conspiratorial conversations on Facebook with
17 individuals looking to fraudulently apply for EDD benefits or “backdate” their
18 EDD applications.
19 22. SANDU applied for EDD four separate times, on September 18,
20 2020, July 10, 2021, July 13, 2021, and June 5, 2022. For the application submitted
21 on September 18, 2020, which was submitted prior to the implementation of the
22 ID.me verification process, SANDU received $3,600.00. On this application,
23
24 1
F,T. was detained in June of 2022 for suspicion of California Penal Code (PC) 186.10 (a) money
25 laundering, PC 182(a)(1) conspiracy and PC 532(a) obtain money under false pretenses. F.T.
waived his/her Miranda rights and provided a voluntary statement to law enforcement. F.T. was
26 not promised anything in return for his/her cooperation and was ultimately released. F.T. has
prior arrests for alien inadmissibility and driving without a license. Additionally, as of March
27 28, 2023 F.T. had an active arrest warrant out of Georgia for a failure to appear in May of 2022.
28 6
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.8 Page 8 of 21
1 SANDU listed his true social security number (SSN). SANDU used different, and
2 fraudulent2, SSNs in each subsequent application.
3 23. In the application submitted on July 10, 2021, SANDU submitted a
4 photograph of himself, a Maryland ID, and a W-2 showing he worked for
5 Kraftsman Construction Co. According to California Franchise Tax Board records,
6 Kraftsman Construction Co. does not exist. Despite this, SANDU’s W-2 indicates
7 payment of California State income tax using a fraudulent California State
8 Identification Number for Kraftsman Construction Co. In support of this fraudulent
9 application, SANDU participated in an ID.me verification session where he
10 confirmed he was applying for California EDD benefits. SANDU received
11 $24,600.00 for this application.
12 24. In the application submitted on July 13, 2021, which SANDU submitted
13 under the alias Ionut Mihai, SANDU submitted a photograph of himself, a
14 Washington state ID, a California state ID, and another W-2 from Kraftsman
15 Construction Co. Investigators compared the supporting documents and
16 photographs for “Ionut Mihai’s” application to confirm the applicant’s true identity
17 to be SANDU. Additionally, SANDU participated in an ID.me verification session
18 where he confirmed he was applying for California EDD benefits and received
19 $26,250.00 for this application. In the application submitted on June 5, 2022,
20 SANDU again used a different SSN, submitted another W-2 from Kraftsman
21 Construction Co., and a Maryland ID. He did not receive benefits from this
22 application.
23
24
2
25 In my training and experience, I know that a Social Security Number (SSN) is a nine-digit,
unique identifier issued by the Social Security Administration to U.S. citizens, permanent
26 residents, and temporary (working) residents. It is needed to work and is used to determine an
individual’s eligibility for Social Security benefits and certain government services. Most
27 individuals have only one SSN.
28 7
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.9 Page 9 of 21
1 25. Beginning in July 2021, SANDU and another individual sent public
2 announcements via social media to a large network of co-conspirators, offering
3 services or meetings to conduct the fraud. Co-conspirators communicated with
4 SANDU via Facebook messaging or other electronic means, and/or met with him
5 in person to provide their personal identifying information (PII). SANDU used PII
6 provided by co-conspirators to create or have others create the fraudulent
7 documents listed above, which SANDU then submitted in support of fraudulent
8 EDD applications.
9 26. Beginning in October 2020, EDD contracted with ID.me to assist in the
10 identity verification of applicants. ID.me developed a process to verify supporting
11 documents submitted by EDD applicants. As a result, applicants were required to
12 participate in a recorded ID.me video verification session. Investigators reviewed
13 many EDD applications using the ID.me verification process. A review of ID.me
14 records identified four devices with specific device fingerprints3 that were used to
15 create and/or modify ID.me profiles that facilitated the verification of at least 137
16 fraudulent EDD applications for 137 different individuals. Investigators traced
17 each of the four devices to SANDU and/or his assistant through conversations and
18 EDD applications they created. Investigators also reviewed hundreds of ID.me
19 verification sessions for SANDU’s co-conspirators. On several occasions,
20 SANDU and his assistant, were seen in the background of recorded ID.me video
21 sessions for various co-conspirator EDD applications.
22 27. Hundreds of EDD applications were reviewed by Investigators. They
23 identified a significant number of consistencies across numerous supporting
24 documents provided by applicants that reflected SANDU’s reuse of resources in
25 3
A device fingerprint is a unique identifier (aggregated hash value) associated with a user’s
26 device, from the hardware, operating system, audio stack, and its configuration. Browser
fingerprinting refers to the process of collecting information through java script to create a
27 fingerprint of a device.
28 8
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.10 Page 10 of 21
1 support of the scheme. For example, documents submitted in support of co-
2 conspirators’ applications listed the same names of businesses, Employer
3 Identification Numbers (EINs), California State Identification Numbers, Blue
4 Cross/Blue Shield member identification numbers, account numbers for Southern
5 California Edison utility bills and passwords (“Romania221$”) for almost all email
6 addresses used to submit EDD applications. According to the California Franchise
7 Tax Board, none of the companies in the various W-2’s submitted for conspirators’
8 EDD applications were established companies in the State of California. Despite
9 this, all W-2’s submitted for conspirators’ EDD applications indicate California
10 State Income Tax withholdings by companies with fraudulent California State
11 Identification Numbers. According to Blue Cross/Blue Shield and Southern
12 California Edison, none of the member identification numbers or account numbers
13 submitted in support of co-conspirators EDD applications were real.
14 28. In total, SANDU is believed to have conspired with at least 214
15 unnamed co-conspirators to fraudulently obtain no less than $5,207,687.00 in
16 California Unemployment Insurance benefits. For his services, Investigators have
17 determined that SANDU was then paid a fee by the individual co-conspirator, often
18 ranging between $250.00 and $1,000.00.
19 a. For example, social media returns showed that on July 14, 2021, A.G.
20 communicated with SANDU via Facebook regarding EDD for his
21 wife, T.G. On July 14, 2021, T.G. participated in a recorded video
22 interview with ID.me, in which she identified herself by name and
23 date of birth, and confirmed that she was applying for California
24 EDD. A fraudulent Anthem Blue Cross/Blue Shield member ID was
25 added to her ID.me account. On July 15, 2021, A.G. sent SANDU a
26 Facebook message with the phone number 669-239-5640. Following
27 this, SANDU sent A.G. a screenshot via Facebook message of an
28 9
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.11 Page 11 of 21
1 EDD application confirmation screen for T.G. with confirmation
2 number 38022946. SANDU also sent A.G. via Facebook message the
3 email address marta22121m@gmail.com and the password
4 Romania221$. Also on July 15, 2021, SANDU received via Facebook
5 message a falsified W-2 for T.G. from another individual. According
6 to California Franchise Tax Board, the company listed does not exist
7 in the State of California.
8 b. According to EDD records, an application was submitted for T.G. on
9 July 15, 2021, under the email address of marta22121m@gmail.com.
10 The phone number connected to the application was 669-239-5640,
11 the same as the number provided by A.G via Facebook message.
12 c. On July 25, 2021, T.G. began receiving EDD benefits, ultimately
13 totaling $27,000.00.
14 d. In October 2021, A.G. told SANDU he would be in San Diego, and
15 they discussed money. Bank of America records show the money
16 fraudulently obtained by A.G. and T.G. was withdrawn at ATMs in
17 the Southern District of California, as well as in Oregon and other
18 parts of California, including a $400.00 ATM withdrawal in
19 Escondido, CA on August 4, 2021. Specifically, Bank of America
20 ATM footage revealed A.G. withdrawing money from T.G.’s EDD
21 account in California both by himself and with T.G.
22 e. In another example, on July 14, 2021, C.G. participated in a recorded
23 video interview with ID.me, during which he confirmed that he was
24 applying for California EDD benefits, and presented a fraudulent
25 California driver’s license. According to the California DMV, this
26 drivers license number belongs to someone else. On July 15, 2021,
27 SANDU sent C.G. a Facebook message indicating that he “needed a
28 10
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.12 Page 12 of 21
1 W-2”. That same day, C.G. responded with a W-2 for his son,
2 providing a SSN and photograph with the email address
3 gioninebunuo@gmail.com, the password Romania221$, and the
4 phone number 714-837-3249. An application for unemployment
5 benefits was submitted to EDD for this individual, claiming to be a
6 US Citizen, and being employed by Kraftsman Construction, on the
7 same day.
8 f. SANDU sent the ID.me verification codes for both C.G. and his son
9 to C.G., and on July 15, 2021 sent a facebook message to C.G. with a
10 confirmation screen from EDD, confirmation number 38029477. On
11 August 9, 2021, C.G.’s son began receiving $6,000.00 in EDD
12 benefits. On August 29, 2021, C.G. began receiving $27,000.00 in
13 EDD benefits.
14 g. Bank of America records confirm C.G. withdrew $26,950 from
15 ATMs in the Southern District of California, including $900 in
16 Escondido, CA on September 23, 2021, as well as other parts of
17 California. As of December 29, 2022, the account had a balance of
18 $8.27.
19 29. Ultimately, Investigators have determined, based on cooperating witness
20 interviews, financial records, social media search warrant returns, and the review
21 of EDD applications and ID.me records, that between September 2020 and August
22 2022, SANDU conspired with over 214 individuals known and unknown to
23 commit this wire fraud.
24 SANDU’s Laundering of the Money Obtained
25 30. According to a review of Facebook messages between SANDU and co-
26 conspirators, SANDU charged a fee between $250.00 and $1,000.00 for assisting
27 individuals with submitting fraudulent EDD applications online. Based on
28 11
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.13 Page 13 of 21
1 Facebook messages, SANDU received payment for his services via counter
2 deposit4 and Zelle transfers. On multiple occasions via Facebook message,
3 SANDU sent his Bank of America account and routing numbers to co-conspirators
4 to conduct counter deposits into SANDU’s bank account following an EDD
5 payout. The following are examples of SANDU’s means and methods for receiving
6 funds obtained via EDD fraud from his co-conspirators.
7 a. I.C. communicated directly with SANDU via Facebook message
8 regarding EDD applications for himself and his wife, L.D. On July
9 10, 2021, L.D. fraudulently applied for EDD, and ultimately received
10 $27,000.00. On September 2, 2020, SANDU sent his account and
11 routing information to I.C. via Facebook message. I.C. responded to
12 SANDU via Facebook message with a receipt for a $300.00 deposit.
13 According to SANDU’s bank account records, a $300.00 counter
14 deposit was conducted on September 2, 2020.
15 b. On September 2, 2020, F.R. applied online for EDD benefits. F.R.
16 received his/her first EDD payment on October 23, 2020 and received
17 a large payment on November 4, 2020. A few days after the large
18 payment, on November 11, 2020, SANDU sent F.R. his account and
19 routing information. The following day, a $250 transfer was made
20 into SANDU’s account.
21 c. C.S. communicated directly with SANDU via Facebook message
22 about EDD for himself and his wife, R.M. On July 31, 2020, C.S.
23 applied online for EDD benefits. On December 26, 2020, R.M.
24 applied online for EDD benefits. C.S. received an EDD payout on
25 August 7, 2020 and R.M. received an EDD payout on December 30,
26
4
A counter deposit is referred to as a financial transaction at a bank branch in which an individual
27 deposits money in person into a bank account.
28 12
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.14 Page 14 of 21
1 2020. On December 10, 2020, SANDU sent C.S his account and
2 routing information via Facebook message. C.S. responded the same
3 day with a photo of a Bank of America receipt confirming a $900.00
4 deposit. According to records for SANDU’s bank account, a $900.00
5 counter deposit was conducted on December 10, 2020.
6 d. R.D. communicated directly with SANDU via Facebook message
7 regarding EDD fraud on behalf of himself and four other individuals:
8 M.D., A.M., A.D., and M.C.. In July 2021, three of the individuals
9 fraudulently applied for and received EDD benefits. On September
10 29, 2021, M.C. received the group’s final EDD payout. On the same
11 day, R.D. sent SANDU five $500.00 Zelle transfers.
12 31. A review of records associated with SANDU’s Bank of America
13 account revealed numerous payments to a Remitly account5. Separately, a review
14 of SANDU’s Facebook messages revealed conversations with I.T. regarding
15 construction work on a house in Romania. I.T. sent SANDU numerous photos of
16 a house in Romania, construction materials, invoices, and receipts from a
17 Romanian home supply store. In response to the receipts, and invoices, SANDU
18 responded with a screenshot of a Remitly transfer confirmation showing funds
19 were sent from SANDU to I.T. According to records received from Remitly,
20 between May 19, 2021 and August 14, 2022, SANDU sent 20 transactions to I.T.
21 totaling more than $16,000.00. In September 2022, Investigators learned SANDU
22 returned to Romania. On October 25, 2022 and December 6, 2022, SANDU posted
23
24 5
Open source research identified Remitly as a financial institution known for sending money
25 abroad. As of March 28, 2023, Remitly marketed their business as “Remit Money Abroad –
Remit Quickly”. Based on my training and experience, individuals who have obtained money
26 fraudulently, through illicit means and/or otherwise specified unlawful activity will often attempt
to repatriate those funds to another country for the purposes of concealing the source and nature
27 of the funds or to further promote specified unlawful activity.
28 13
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.15 Page 15 of 21
1 photos of himself and his family members in the vicinity of the aforementioned
2 house in Romania. Additionally, Facebook comments indicated the house was
3 owned or occupied by SANDU.
4 SANDU’s Statement of the Offense and Criminal Proceedings
5 32. On February 27, 2023, SANDU, along with his wife and four
6 children, was encountered by Border Patrol entering the United States illegally,
7 approximately one mile west of the San Ysidro, California Port of Entry and
8 approximately 100 yards north of the United States/Mexico International
9 Boundary. SANDU was detained by Border Patrol and then arrested by the FBI on
10 March 1, 2023. On March 1, 2023, he agreed to waive his rights and speak to
11 investigators. Among other things, he admitted to applying for EDD benefits,
12 assisting family in applying for EDD benefits, and sending approximately
13 $24,000.00 to a contractor in Romania to renovate his house. SANDU further
14 admitted that he used a friend to obtain fraudulent W-2s, false identifications,
15 fraudulent utility bills and fraudulent insurance cards for the purposes of applying
16 for EDD benefits. Additionally, SANDU identified the Target Device as being his
17 cellular phone.
18 33. On March 2, 2023, a federal complaint was filed in the Southern
19 District of California charging SANDU with Conspiracy to Commit Wire Fraud,
20 in violation of 18 U.S.C. § 1349. On March 28, 2023, SANDU was arraigned on
21 an information charging him with Conspiracy to Commit Wire Fraud, in violation
22 of 18 U.S.C. § 1349 and Conspiracy to Launder Monetary Instruments, in violation
23 of 18 U.S.C. § 1956(h). He is currently pending those charges in Case No. 23-CR-
24 0386-LAB.
25 METHODOLOGY
26 34. It is not possible to determine, merely by knowing the mobile
27 electronic device’s make, model and serial number, the nature and types of services
28 14
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.16 Page 16 of 21
1 to which the device is subscribed and the nature of the data stored on the device.
2 Mobile electronic devices, including cellular telephones and tablets, can be simple
3 cellular telephones and text message devices, can include cameras, can serve as
4 personal digital assistants and have functions such as calendars and full address
5 books and can be mini-computers allowing for electronic mail services, web
6 services and rudimentary word processing. An increasing number of cellular
7 service providers and installable software now allow for their subscribers and users
8 to access their device over the internet and remotely destroy all of the data
9 contained on the device. For that reason, the device may only be powered in a
10 secure environment or, if possible, started in “flight mode” which disables access
11 to the network. Unlike typical computers, many mobile electronic devices do not
12 have hard drives or hard drive equivalents and store information in volatile
13 memory within the device or in memory cards inserted into the device. Current
14 technology provides some solutions for acquiring some of the data stored in some
15 mobile electronic device models using forensic hardware and software. Even if
16 some of the stored information on the device may be acquired forensically, not all
17 of the data subject to seizure may be so acquired. For devices that are not subject
18 to forensic data acquisition or that have potentially relevant data stored that is not
19 subject to such acquisition, the examiner must inspect the device manually and
20 record the process and the results using digital photography. This process is time
21 and labor intensive and may take weeks or longer.
22 35. Following the issuance of this warrant, I will collect the Target
23 Device and subject it to analysis. All forensic analysis of the data contained within
24 the Target Device and its memory card(s) will employ search protocols directed
25 exclusively to the identification and extraction of data within the scope of this
26 warrant.
27
28 15
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.17 Page 17 of 21
1 36. Based on the foregoing, identifying and extracting data subject to
2 seizure pursuant to this warrant may require a range of data analysis techniques,
3 including manual review, and, consequently, may take weeks or months. The
4 personnel conducting the identification and extraction of data will complete the
5 analysis within ninety (90) days, absent further application to this court.
6 GENUINE RISK OF DESTRUCTION OF DATA
7 37. Based upon my experience and training, and the experience and
8 training of other law enforcement agents with whom I have communicated,
9 electronically stored data may be permanently deleted or modified by users
10 possessing basic computer skills. In this case, no genuine risk of destruction exists
11 as the property to be searched is already in the custody of law enforcement
12 personnel.
13 PRIOR ATTEMPTS TO OBTAIN DATA
14 38. No prior attempts have been made by law enforcement to attempt to
15 obtain data from the Target Device.
16 //
17 //
18 //
19 //
20 //
21 //
22 //
23 //
24 //
25 //
26 //
27 //
28 16
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.18 Page 18 of 21
1 CONCLUSION
2 39. Based on the foregoing, I believe there is probable cause to believe
3 items that constitute evidence, fruits, and instrumentalities of violations of federal
4 criminal law, namely, 18 U.S.C. §§ 1349 and 1956(h) as described in Attachment
5 B will be found in the properties to be searched, as provided in Attachment A.
6
7 Courtney M. McGuire
__________________________
Courtney M. McGuire
8
Special Agent
9 Federal Bureau of Investigation
10
11
Attested to by the applicant in accordance with the requirements of Fed. R.
12
Crim. P. 4.1 by telephone on this 30th day of March, 2023.
13
14
15
________________________________
16
HONORABLE Barbara L. Major
17 United States Magistrate Judge
18
19
20
21
22
23
24
25
26
27
28 17
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.19 Page 19 of 21
1
2 ATTACHMENT A
3 ITEMS TO BE SEARCHED
4 The property/items to be searched is/are described as follows:
5 1. Apple iPhone, IMEI 356715110833004 (Target Device)
6
7 Target Device is currently being held at the San Diego Police Department, 1401
8 Broadway, San Diego, CA 92101.
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28 18
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.20 Page 20 of 21
1 ATTACHMENT B
2 ITEMS TO BE SEIZED
3 Authorization to search the cellular telephone described in Attachment A includes
4 the search of disks, memory cards, deleted data, remnant data, slack space, and
5 temporary or permanent files contained on or in the cellular telephones. The
6 seizure and search of the cellular telephone will be conducted in accordance with
7 the affidavit submitted in support of the warrant.
8 The evidence to be seized from the cellular telephones will be electronic records,
9 communications, and data such as emails, text messages, photographs, audio files,
10 video, telephone numbers, contact information, web browsing history, documents,
11 data stored within applications, and location data, for the period of July 1, 2020 up
12 to and including and August 31, 2022:
13 a. tending to identify travel to or presence at locations involved in wire
14 fraud or money laundering;
15 b. tending to identify accounts, facilities, storage devices, and/or services—
16 such as email addresses, IP addresses, and phone numbers—used to
17 facilitate wire fraud and/or money laundering;
18 c. tending to identify co-conspirators, criminal associates, or others
19 involved in wire fraud and/or money laundering;
20 d. tending to identify funding sources, bank accounts, and financing
21 methods involved in wire fraud and/or money laundering;
22 e. tending to identify the user of, or persons with control over or access to,
23 the subject phone; and/or
24 f. tending to place in context, identify the creator or recipient of, or
25 establish the time of creation or receipt of communications, records, or
26 data involved in the activities described above.
27
28 19
29
30
Case 3:23-mj-01154-BLM Document 1 Filed 03/30/23 PageID.21 Page 21 of 21
1 which are evidence of violations of Title 18, United States Code, Sections 1349
2 and 1956(h).
3 The seizure and search of the cellular phones shall follow the procedures outlined
4 in the methodology section in the supporting affidavit. Deleted data, remnant data,
5 slack space, and temporary and permanent files on the cellular phones may be
6 searched for the evidence above.
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28 20
29
30
File and source
- File
- gov.uscourts.casd.755758.1.0.pdf
- Size
- 579,636 bytes
- SHA-256
- 5b745adba7b63e844c4d3f39e07480e016120e3a5e7c3c700fb4bbb44f7b3946
- Our copy
- gov.uscourts.casd.755758.1.0.pdf
- Original
- www.courtlistener.com