Affidavit State of Wisconsin Dane County — No. 3:19-cr-00147 (Dkt. 1-1, W.D. Wis.)

Summary

An affidavit of Dorinda M. Freymiller, a Special Agent with the State of Wisconsin Department of Justice, Division of Criminal Investigation, filed September 19, 2019 as Document 1-1 in Case 3:19-cr-00147-wmc. The affiant states there is probable cause to believe that Ahmad Kanan committed and attempted access device fraud in violation of 18 U.S.C. §§ 1029(a)(2) and (b)(1) by using bank account information of the Embassy of Libya-Military Attache without permission, including an $83,783.41 payment on July 21, 2017 toward sales tax owed by a gas station business. It states that case agents learned on September 18, 2019 that he was booked on a one-way flight to Dubai.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

      Case: 3:19-cr-00147-wmc Document #: 1-1 Filed: 09/19/19 Page 1 of 7




                                         AFFIDAVIT
STATE OF WISCONSIN             )
                               ) ss.
DANE COUNTY                    )

     I, Dorinda M. Freymiller, having been duly sworn, depose and state as follows:

     1.       I am employed as a Special Agent with the State of Wisconsin, Department

of Justice, Division of Criminal Investigation, Madison, Wisconsin, and have been

employed in that capacity since 1994.        I have attended several trainings regarding

financial crime investigations and have instructed hundreds of students on how to

conduct criminal financial crime investigations. I have led numerous investigations

which were then prosecuted in either the State or Federal court system. I also have

training and experience in several other areas such as computer crimes.

     2.       The information contained in this affidavit is based primarily on

information I learned during the course of my investigation into the alleged criminal

behavior of the Ahmad Kanan. I have also reviewed reports from this investigation

prepared by other law enforcement officers including agents from the United States

Department of Homeland Security.           As the reports were prepared by other law

enforcement officers during the course of their official duties, I believe them to be reliable.

                                        SUMMARY

     3.       The purpose of this affidavit is to provide information to show that there is

probable cause to believe that Ahmad Kanan committed access device fraud and

attempted to commit access device fraud in violation of 18 U.S.C. §§ 1029(a)(2) & (b)(l).

He did so by using the Embassy of Libya-Military Attache' s bank account information
      Case: 3:19-cr-00147-wmc Document #: 1-1 Filed: 09/19/19 Page 2 of 7




(without permission) to pay the sales and use taxes and to attempt to pay the electric bill

of a gas station he owned (through his wife).

     4.       On September 18, 2019, at approximately 8:45 p.m. case agents learned that

Ahmad Kanan was booked on a one-way flight from Chicago to Dubai, United Arab

Emirates leaving on September 21, 2019.

                                    BACKGROUND

     5.       Ahmad Kanan and his wife Ghufran Kanan live in Madison, Wisconsin.

Ahmad was born in Egypt, but naturalized as a United States citizen on January 31, 2000.

     6.       Ghufran owns 52% of Kanaan Petroleum Group, Inc. ("Kanaan Group").

The remaining shares are owned by two individuals who reside in Massachusetts.

Kanaan Group owns a British Petroleum gas station located in Janesville, Wisconsin.

     7.       Ghufran owns 80% of Petro Madison, Inc. The remaining shares are owned

by two individuals who reside in Massachusetts. Petro Madison, Inc. owns a Clark gas

station in Janesville, Wisconsin. This gas station has an attached office where Ahmad

runs the business of both gas stations.

     8.       The Embassy of Libya-Military Attache bank account was funded solely by

the Libyan government and is used to fund educational expenses for Libyan students

furthering their education in the United States. Individuals from the Embassy of Libya

issue checks for tuition and school fees directly to educational institutions. They also

issue monthly stipends to students. At no point did anyone authorize a payment related

to Ahmad's gas stations.

     9.      Businesses and third-party preparers in Wisconsin can register and use a


                                            2
       Case: 3:19-cr-00147-wmc Document #: 1-1 Filed: 09/19/19 Page 3 of 7




web-based portal called My Tax Account to pay Sales and Use taxes to the Wisconsin

Department of Revenue ("DOR"). In order to make a direct-deposit payment through

the website, a user could simply enter the routing and account number on the website

and process the payment. A name or business associated with the account was not

needed.

       ACCESS DEVICE FRAUD AND ATTEMPTED ACCESS DEVICE FRAUD

          A.   July 21, 2017 DOR Payment

    10.        On November 15, 2014, Kanaan Group opened a Wisconsin DOR My Tax

Account under Ghufran Kanan' s name with the username Kpetro. On June 15, 2017, the

Wisconsin DOR emailed Ghufran about her account and she forwarded the email (on

June 21, 2017) to Ahmad, stating "please take care of this."

    11.        On July 21, 2017, username Kpetro caused an unauthorized payment for

$83,783.41 from the Libyan Military Attache account to pay the sales tax, penalties, and

interest owed by Kanaan Group. The payment was processed, and credited to the

account. Kpetro logged into the website at 12:04:06 a.m. from IP address 66.188.117.29.

IP address 66.188.117.29 was assigned to the Clark Gas station.

    12.        At the following dates/times, Ghufran's cell phone pinged off a cell tower

near the Kanan residence in Madison while Ahmad's pinged off a cell tower close to the

Clark Gas station in Janesville:

   •   July 20, 2017 at 10:59:04 p.m.
   •   July 21, 2017 at 2:40:28 a.m.




                                            3
        Case: 3:19-cr-00147-wmc Document #: 1-1 Filed: 09/19/19 Page 4 of 7




     13.          On December 20, 2018, case agents executed search warrants at the Kanan' s

residence and their businesses. At the Kanan residence, case agents seized an iPhone that

was labeled Ahmed's iPhone. They then discovered a picture of a final notice of a

payment due to Fiserv that contains metadata, which shows that the picture was taken

on July 21, 2017, at 12:10:19 a.m. at the Clark Gas station. Another picture was taken of

the same notice 16 seconds later also from the Clark Gas station.

     14.          Case agents also recovered a different iPhone labeled as Ahmed's iPhone

that had a picture of two checks from the Embassy of Libya Military Attache Account.

As all checks do, this check contained the account number and routing number. A

Lenovo laptop that agents seized also contained these check images. 1

     15.          On December 20, 2018, case agents interviewed Ahmad, who stated that

only he and his employees Kim and Will have access to the computer at the Clark gas

station, but neither Kim nor Will have used it to make payment towards taxes.

     16.         On the same day, case agents also interviewed Ghufran who stated that she

did not use the computer located at the Clark Gas station and did not have knowledge of

sales and use tax or how to file these reports with the State of Wisconsin.


           B.    December 21, 2017, DOR Payment

     17.         On December 21, 2017, at 8:16 p.m. username Kpetro logged into the MTA

account for Kanaan Group and paid $108,053.02 from the Libyan Embassy Military

Attache account for sales and use tax even though the balance was only $87,875.14. The



1 This paragraph and the two following paragraphs provide evidence that corroborates all three payments.




                                                        4
      Case: 3:19-cr-00147-wmc Document #: 1-1 Filed: 09/19/19 Page 5 of 7




payment was processed, and credited to the account. Kpetro made this payment from IP

address 66.188.117.29.

    18.         On December 21, 2017, from 3:10 to 3:24 p.m. the Kanaan Group U.S. Bank

bank account was electronically accessed from IP address 66.188.117.29. The account

balance that day was $6,994.97.


          C.    December 21, 2017, Payment

    19.         Kanan Petroleum, Inc.' s Alliant Energy account was established on January

16, 2014.      The customer name associated with this account is Ahmed Kanan.         On

December 21, 2017, Kanaan Group's Alliant Energy bill of $35,370 was paid in full from

the Libyan Embassy Military Attache account. The payment was processed, but never

credited to the account. This payment, and several previous payments on Kanaan Group

accounts, were made from IP address 66.188.117.29.

    20.         On December 21, 2017, from 3:10 to 3:24 p.m. the Kanaan Group U.S. Bank

bank account was electronically accessed from IP address 66.188.117.29. The account

balance that day was $6,994.97.

   21.          On December 20, 2018, case agents interviewed Ahmad and he indicated

that he was the only individual who had access to the Alliant Energy online bill payment

system.

          D.    Facts Relevant to All Counts

                (1)   Financial Motive




                                               5
      Case: 3:19-cr-00147-wmc Document #: 1-1 Filed: 09/19/19 Page 6 of 7




    22.         Case agents identified two bank accounts for the Kanaan Group: the

account at U.S. Bank had an ending balance of $13,682.34 in July 2017 and $3,062.30 in

December 2017. The account at First National Bank & Trust account had an ending

balance of $1,954.49 in July 2017 and $4,802.03 in December 2017.

    23.         Gas station employees indicated during interviews that vendors were

constantly attempting to locate "Adam" aka Ahmad due to outstanding bills.

                (2)    Attempted Destruction of Electronic Evidence

          24.   On December 20, 2018, at 2:50:15 p.m. (the same day the search warrants

were executed) "Username akanan@yahoo.com initiated a wipe on device Ahmed's

iPhone .... " In other words, username akanan@yahoo.com tried to remotely wipe

Ahmed's iPhone after it was taken in the search warrant.

                (3)  Ahmad, not Ghufran ran the businesses; only Ahmad had access to the
Clark gas station computer.

          25.   Case agents have interviewed employees of the gas station and they

describe Ahmad as the owner of the gas station and noted that his wife worked at the gas

station periodically. They stated that Ahmad completed day-to-day business operations,

and he was the only person with access to the computer at the Clark gas station.

          26.   On March 8, 2017, customer service logs show that Ahmad Kanan (not

Ghufran) contacted Wisconsin DOR regarding his lottery license being revoked due to

owing back-taxes. On April 16, 2018, Ahmad Kanan (not Ghufran) contacted DOR

regarding missing sales tax filings.

                (4) Interstate Nexus


                                               6
      Case: 3:19-cr-00147-wmc Document #: 1-1 Filed: 09/19/19 Page 7 of 7




        27.     According to Bank of America, the servers that were used to process the

transfer of money from Libyan Embassy Military Attache account were located in Texas.

                                 RELEVENT STATUTES

        28.     18 U.S.C. § 1029(a)(2) makes it a crime to "knowingly and with intent to

defraud traffic in or use one or more unauthorized access devices during any one-year

period, and by such conduct obtains anything of value aggregating $1,000 or more during

that period;"

       29.      18 U.S.C. § 1029(b)(l) states "[w]hoever attempts to commit an offense

under subsection (a) of this section shall be subject to the same penalties as those

prescribed for the offense attempted."

       30.      18 U.S.C. § 1029(e)(l) defines access device as "any card, plate, code,

account number ... that can be used, alone or in conjunction with another access device,

to obtain money, goods, service, or any other thing of value, or that can be used to initiate

a transfer of funds (other than a transfer originating solely by paper instrument)."

       31.      18 U.S.C. § 1029(e)(3) defines unauthorized access device as "any access

device that is lost, stolen, expired, revoked, canceled, or obtained with intent to defraud."

       Dated this 19th day of September 2019.




                                          State of Wisconsin, Department of Justice,
                                          Division of Criminal Investigation


File and source

File

1-att1.pdf

Size

253,494 bytes

SHA-256

fd944717429da10f7cb66846c951ee81b30cebb5fc0d74d341b4bf322bca7369

Our copy

1-att1.pdf

Original

No public link identified.