Criminal Complaint — United States v. Andrea M. Gervais (No. 2:20-mj-00189, E.D. Cal.)
Summary
A sealed criminal complaint (AO 91) filed December 11, 2020 as Document 1 in United States v. Andrea M. Gervais, aka Andrea M. Dangerfield, Case No. 2:20-mj-0189 AC, in the U.S. District Court for the Eastern District of California, charging mail fraud under 18 U.S.C. § 1341 from March 18, 2020 through October 15, 2020. It is signed by Special Agent John C. Collins of the Department of Labor Office of Inspector General before U.S. Magistrate Judge Allison Claire. The affidavit states that the investigation of Gervais, a former Employment Development Department employee, began after Bank of America found an unemployment claim in the name of a sitting United States Senator. It states that approximately 100 suspicious UI claims were filed with the home address, that EDD paid approximately $216,000 on about twelve of them, and that the intended loss is at least $2.1 million.
Summary drafted by a model from the text of the original file linked on this page and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Criminal Complaint — United States v. Andrea M. Gervais (No. 2:20-mj-00189, E.D. Cal.).”
Original at www.justice.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/complaint-no-2-20-mj-00189-dkt-1-e-d-cal-dc8a2ca22e/
, SHA-256 1c9f83fd6a06cc09c3c56ddd6fb144c1fdfd288fe05282c395bce2ffb5718d91.Full text
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 1 of 30
AO 91 (Rev. 11/11) Criminal Complaint
UNITED STATES DISTRICT COURT
for the FILED
Eastern District of California Dec 11, 2020
CLERK, U.S. DISTRICT COURT
EASTERN DISTRICT OF CALIFORNIA
United States of America )
v. )
) Case No. 2:20-mj-0189 AC
)
ANDREA M. GERVAIS
)
aka ANDREA M. DANGERFIELD
Defendant(s)
)
) SEALED
CRIMINAL COMPLAINT
I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
March 18, 2020 through
On or about the date(s) of in the county of Placer in the
October 15, 2020
Eastern District of California , the defendant(s) violated:
Code Section Offense Description
18 U.S.C. § 1341 Mail Fraud
This criminal complaint is based on these facts:
(see attachment)
܈Continued on the attached sheet.
/s/ John C. Collins
Complainant’s signature
Special Agent John C. Collins
Printed name and title
Sworn to before me and signed telephonically.
Date: December 11, 2020
Judge’s signature
City and state: Sacramento, California Allison Claire, U.S. Magistrate Judge
Printed name and title
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 2 of 30
1 AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A CRIMINAL COMPLAINT AND
SEARCH WARRANTS
2
3 I, Special Agent John Collins, being duly sworn, depose and state the following:
4 PURPOSE
5 1. I make this affidavit in support of an application under Rule 41 of the Federal Rules of
6 Criminal Procedure for a warrant to search and seize evidence, fruit, and/or instrumentalities of certain
7 offenses as described in Attachment B, at the following locations, vehicles, and persons in the Eastern
8 District of California, as more fully described in Attachment A-1 through A-4:
9 a. 2012 Rebecca Ct., Roseville, CA 95661, as further described in Attachment A-1
10 b. A blue Toyota sedan with California license plate 6KZR879 as further described in
11 Attachment A-2;
12 (hereinafter, the “Premises”);
13 c. ANDREA M. GERVAIS aka ANDREA M. DANGERFIELD 1, as further described in
14 Attachment A-3;
15 (hereinafter, the “Subject”).
16 2. I also make this affidavit in support of a criminal complaint and arrest warrant for
17 ANDREA M. GERVAIS aka ANDREA M. DANGERFIELD for a violation of 18 U.S.C. § 1341 – Mail
18 Fraud.
19 INTRODUCTION AND AGENT BACKGROUND
20 3. I am a Special Agent (“SA”) with the United States Department of Labor (“DOL”),
21 Office of Inspector General (“OIG”), Office of Investigations-Labor Racketeering & Fraud in San
22 Francisco, California, and have been so employed since September 2011. In May 2009, I earned a
23 Masters of Public Administration from the Robert F. Wagner Graduate School of Public Service at New
24 York University in New York, NY. I am a graduate of the Federal Law Enforcement Training Center in
25 Glynco, Georgia. As a DOL SA, my duties include investigating fraud, waste and abuse of various DOL
26
1
The investigation learned that Gervais is the subject’s maiden name and Dangerfield is her
27 married name. Gervais is believed to be divorced and that she has since changed her name back to
Gervais. The names Gervais and Dangerfield are used interchangeably throughout this affidavit,
28 depending on how she was identified in the source documents referenced in this investigation.
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 3 of 30
1 programs. During my tenure as a SA, I have participated and conducted investigations of criminal
2 activity including labor union investigations, theft of government funds, healthcare fraud and other
3 related financial crimes. I have participated in the execution of search and arrest warrants and have
4 seized evidence of violations of federal law.
5 4. Based on my training and experience and the facts as set forth in this affidavit, there is
6 probable cause to believe that Gervais violated or aided and abetted violations of at least 18 U.S.C.
7 § 1341 (mail fraud) and 18 U.S.C. § 1028A (aggravated identity theft). Further, there is probable cause
8 to believe that evidence, fruit, and/or instrumentalities of these violations are currently to be found at the
9 locations in Attachments A-1 through A-3.
10 5. The DOL-OIG is conducting a joint investigation of former Employment Development
11 Department (“EDD”) employee Andrea M. Gervais. The investigation was initiated after a Bank of
12 America fraud investigator discovered that an unemployment insurance claim in the name of a sitting
13 United States Senator in the amount of approximately $21,000. Further investigation by Bank of
14 America, the EDD, and DOL-OIG discovered that this claim, and others, are linked to Gervais and her
15 home located in Roseville, CA. The investigation has so far discovered approximately 100 suspicious UI
16 claims filed with Gervais’ home address, and that EDD paid approximately $216,000 on approximately
17 twelve of these filed claims. The intended dollar loss for the known claims at this time is at least $2.1
18 million.
19 STATEMENT OF PROBABLE CAUSE
20 Unemployment Insurance and Pandemic Unemployment Assistance Programs
21 6. Unemployment Insurance (“UI”) is a state-federal program that provides monetary
22 benefits to eligible lawful workers. Although state workforce agencies (“SWAs”) administer their
23 respective UI programs, they must do so in accordance with federal laws and regulations. UI payments
24 (“benefits”) are intended to provide temporary financial assistance to lawful workers who are
25 unemployed through no fault of their own. Each state sets its own additional requirements for eligibility,
26 benefit amounts, and length of time benefits can be paid. Generally, UI weekly benefit amounts are
27 based on a percentage of your earnings over a base period. In the State of California the Employment
28 Development Department (“EDD”) administers the UI program.
AFFIDAVIT 2
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 4 of 30
1 7. On March 13, 2020, the President declared the ongoing Coronavirus Disease 2019
2 (“COVID-19”) pandemic of sufficient severity and magnitude to warrant an emergency declaration for
3 all states, tribes, territories, and the District of Columbia pursuant to section 501 (b) of the Robert T.
4 Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. 5121-5207 (the “Stafford Act”).
5 8. On March 18, 2020, the President signed the Families First Coronavirus Response Act
6 (“FFCRA”) into law. The FFCRA provides additional flexibility for state UI agencies and additional
7 administrative funding to respond to the COVID-19 pandemic. The Coronavirus Aid, Relief, and
8 Economic Security (“CARES”) Act was signed into law on March 27, 2020. It expands states’ ability to
9 provide UI for many workers impacted by COVID-19, including for workers who are not ordinarily
10 eligible for UI benefits. The CARES Act provided for three new UI programs: Pandemic
11 Unemployment Assistance (“PUA”); Federal Pandemic Unemployment Compensation (“FPUC”); and
12 Pandemic Emergency Unemployment Compensation (“PEUC”).
13 9. The first program, PUA, provides for up to 39 weeks of benefits to individuals who are
14 self-employed, seeking part-time employment, or otherwise would not qualify for regular UI or
15 extended benefits under state or federal law or PEUC under section 2107 of the CARES Act. Coverage
16 includes individuals who have exhausted all rights to regular UC or extended benefits under state or
17 federal law or PEUC. Under the PUA provisions of the CARES Act, a person who is a business owner,
18 self-employed worker, independent contractor, or gig worker can qualify for PUA benefits administered
19 by EDD if he/she previously performed such work in California and is unemployed, partially
20 unemployed, unable to work, or unavailable to work due to a COVID-19 related reason. A PUA
21 claimant must answer various questions to establish his/her eligibility for PUA benefits. The claimant
22 must provide his/her name, Social Security Number (“SSN”), and mailing address. The claimant must
23 also identify a qualifying occupational status and COVID-19 related reason for being out of work. The
24 eligible timeframe to receive PUA is from weeks of unemployment beginning on or after January 27,
25 2020 through December 31, 2020.
26 10. The second program, PEUC, provides for up to 13 weeks of benefits to individuals who
27 have exhausted regular UI under state or federal law, have no rights to regular UI under any other state
28 or federal law, are not receiving UI under the UI laws of Canada, and are able to work, available for
AFFIDAVIT 3
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 5 of 30
1 work, and actively seeking work. However, states must offer flexibility in meeting the “actively seeking
2 work” requirement if individuals are unable to search for work because of COVID-19, including
3 because of illness, quarantine, or movement restriction. The eligible timeframe to receive PEUC is from
4 weeks of unemployment beginning after the respective state has an established agreement with the
5 federal government through December 31, 2020. The earliest being April 5, 2020.
6 11. The third program, FPUC, provides individuals who are collecting regular UI, PEUC,
7 PUA, and several other forms of UC with an additional $600 per week. The eligible timeframe to
8 receive PEUC was from weeks of unemployment beginning after the respective state had an established
9 agreement with the federal government through July 31, 2020. The earliest being April 5, 2020.
10 12. On August 8, 2020, after FPUC expired, the President signed a Presidential
11 Memorandum authorizing FEMA to use disaster relief funds pursuant to Section 408 Other Needs
12 Assistance of the Stafford Act to provide supplemental payments for lost wages to help ease the
13 financial burden on individuals who were unemployed as a result of COVID-19. The “Lost Wages
14 Assistance Program” (“LWAP”) served as a temporary measure to provide an additional $300 per week
15 via a total of $44 billion in FEMA funds. The period of assistance for LWAP is August 1, 2020 to
16 December 27, 2020, or termination of the program, whichever is sooner.
17 13. In total, more than $300 billion in additional federal funds for UI have been appropriated
18 in 2020.
19 14. In California, a UI claim can be filed online on the EDD website. When an individual
20 files a UI claim, the EDD automatically maintains certain information regarding the filing of the claim.
21 This information includes the date and time the claim was submitted, the name of the person for whom
22 the claim was filed, and the IP address of the computer, or ISP account, that was used to file the claim.
23 15. UI claimants must answer various questions to establish their eligibility for UI benefits.
24 Claimants must provide their name, Social Security Number, and mailing address. The claimants must
25 also identify a qualifying occupational status and/or COVID-19 related reason for being out of work.
26 16. After EDD accepts a UI claim, EDD typically deposits UI funds every two weeks to an
27 Electronic Bill Payment (“EBP”) debit card administered by Bank of America, which claimants can use
28 to pay for their expenses. The EBP card is sent via the U.S. Postal Service to the claimant at the address
AFFIDAVIT 4
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 6 of 30
1 the claimant provides in their UI claim. Claimants can activate their debit card over the phone or online.
2 To activate a card, a claimant must create a Bank of America unemployment user profile, which
3 captures certain data including, but not limited to, the EDD claim number, claimant SSN, address where
4 card was mailed. Each debit card includes the name of the beneficiary embossed or printed on the card’s
5 face.
6 17. When receiving regular UI benefits, claimants must complete a Continued Claim Form
7 (DE 4581) and certify every two weeks, under penalty of perjury, that they remain unemployed and
8 eligible to receive UI benefits. EDD authorizes and deposits payment to the EBP debit card after it
9 receives the Continued Claim Form. On or about April 23, 2020, California Secretary of Labor Julie Su
10 directed the EDD to temporarily suspend the requirement for UI claimants to provide unemployment
11 certifications (Continued Claim Forms) in order to prevent any unnecessary delays in dispensing benefit
12 payments.
13 18. When the EDD needs to verify the identity of the claimant, an “ID Alert” is issued on a
14 UI claim. When an ID Alert has been issued, the EDD sends the claimant a Request for Information
15 (Form DE 1326E). The claimant must provide one of the following examples to prove identity
16 verification: clear copy of a government-issued ID and social security verification. With this
17 information, the EDD will determine the claimant’s eligibility for UI benefits. The reasons why the
18 claimant may be ineligible for UI benefits due to one of the following: (a) Claimant did not respond to
19 the DE 1326E; or (b) Documents provided were not clear to make an eligible determination; or (c)
20 Documents provided were insufficient and did not prove the claimant’s identity.
21 19. At present, weekly UI benefits typically range from $40 to $450, not including federal
22 CARES Act funding. In order to receive the maximum weekly benefit of $450, a claimant must have
23 earned $11,674.01 or more in the highest quarter of the claimant’s base employment period.
24 20. Based on my training and experience, I know that criminal actors:
25 a. Defraud the UI program by using stolen personally identifiable information (“PII”) to
26 file UI claims.
27 b. Conspire with other criminal actors to obtain stolen identities or to file fraudulent UI
28 claims.
AFFIDAVIT 5
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 7 of 30
1 c. Mask the Internet Protocol (“IP”) address, or file fraudulent UI claims at various
2 physical locations in order to conceal their identity.
3 Bank of America Investigation
4 21. On December 1, 2020, Bank of America, NA, Fraud Investigations Group contacted the
5 DOL-OIG to notify that they discovered that a California unemployment profile was opened in the name
6 of a United States Senator. The Bank of America investigation revealed that 17 California
7 unemployment profiles and one Maryland unemployment profile were established with Bank of
8 America. Bank of America issued a total of 21 prepaid UI-PUA debit cards in the names of those
9 profiles. This grouping was linked by a single residential address or email address listed in the Bank of
10 America unemployment profiles.
11 22. The California Bank of America UI profiles all linked to the Premises address, in the
12 Eastern District of California. According to Bank of America records, between August 31, 2020, and
13 September 26, 2020, phone number 916-337-2710 called Bank of America approximately 16 times
14 related to four Bank of America profiles, including the profile in Gervais’ name. The three other Bank of
15 America UI profiles that this phone number called about are suspected to have been opened in the names
16 of identity theft victims L.E., R.R., and T.H. According to a law enforcement database, L.E. lives in
17 Alabama, R.R. lives in Illinois, and T.H. lives in Illinois. Per information available in the law
18 enforcement database, none of these individuals have a history of living in California.
19 23. Bank of America further analyzed the suspicious UI-PUA debit cards associated with the
20 Premises. The cards were funded by EDD between March 31, 2020, and October 15, 2020, with a total
21 of approximately $216,028 in ACH credit loads. The California cards received approximately $215,676,
22 and the Maryland card received $352. Bank of America mailed at least 15 EDD UI-PUA debit cards to
23 the Premises. According to Bank of America transaction records, a portion of the funds were depleted
24 between April 23, 2020, and September 25, 2020, with purchases, transfers, and cash withdrawals.
25 Identification of Gervais
26 24. On or around March 18, 2020 an UI claim (eApply number 25766885) in the name of
27 Andrea M. Gervais was submitted to the EDD. The claim listed Gervais’s mailing address of the
28 / / /
AFFIDAVIT 6
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 8 of 30
1 Premises 2 and her cell phone number as 916-337-2710. The claimant stated that she had been working
2 for Goodwill Industries as a shelf stocker, but that her hours had been reduced. The claimant also stated
3 that she worked for EDD from 2010 to October 5, 2018. After receiving the UI claim, the EDD issue an
4 ID Alert. In response, the EDD received a photograph (shown below partially redacted) of the
5 claimant’s driver’s license and a bill State Farm Insurance, both confirming the mailing address of
6 Gervais.
7
8
9
10
11
12
13
14
15
16
17
18
19
20 25. As a result of this claim, the EDD paid approximately $13,800 in benefits. The
21 investigation has no information to suggest that this UI claim was made under false pretenses. 3
22 26. According to public records and law enforcement databases, it appears that Andrea M.
23 Gervais is a resident of the Premises. Furthermore, according to California DMV, Gervais’ address of
24
2
Agent note: The UI claim address was briefly changed to 740 47th St., San Diego, CA 92102,
25 an address associated with approximately 60 other EDD UI claims. After several days, the claim address
was changed back to 2012 Rebecca Court. The investigation has not drawn a conclusion about this fact.
26
3
Agent note: The investigation also found that on or around 08/31/2020 another UI claim was
27 made in the name and address of Gervais, but with a different SSN and DOB. A law enforcement
database indicated that the SSN is registered to an Andrea Gervais in the state of Maine. This particular
28 UI claim was not paid by the EDD due to the failure to respond to an ID Alert.
AFFIDAVIT 7
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 9 of 30
1 record has been the Premises, for at least all of 2020. On December 3, 2020, a DOL-OIG Special Agent
2 saw a blue Toyota Camry with California license plate 6KZR879 parked in the driveway of this home.
3 According to California DMV, this license plate is registered to Gervais at the Premises. On December
4 10, 2020, with the blue Camry with license plate 6KZR879 in the driveway, FBI agents saw Gervais exit
5 the residence at the Premises, check her mailbox, and return inside the home.
6 27. In her driver’s license photo, Gervais is listed as a white female, 5’01’’ tall and 228
7 pounds. In her photo she has shoulder-length brown hair and a pea-sized growth on the low portion of
8 her forehead in between her eyes. Below is Gervais’s California driver’s license photo of record that was
9 taken in May 2019:
10
11
12
13
14
15
16
17
18
19
20
21
22 28. On December 3, 2020, I reviewed a Facebook profile in the name of
23 “andrea.dangerfield.1”. During the course of my review, I noted that there were several photos posted
24 matching Gervais’s driver’s license photo and description. The public Facebook profile states that
25 Gervais lives in Roseville, California, and formerly worked at the Employment Development
26 Department.
27 / / /
28 / / /
AFFIDAVIT 8
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 10 of 30
1 Previous Investigations of Gervais
2 EDD Investigation
3 29. In April 2018, the EDD Investigations Division received an allegation of theft from the
4 EDD mailroom by EDD Office Assistant Andrea Dangerfield of the Tax Branch. The investigation
5 found that a money order, originally made payable to the EDD, had been altered such that it was made
6 payable to Andrea Dangerfield prior to being cashed in March 2018.
7 30. EDD investigators reviewed Dangerfield’s EDD personnel file and observed that
8 Dangerfield’s signature appeared to be nearly identical to the signature on the negotiated money order.
9 31. On October 12, 2018, EDD terminated Gervais based on at least the result of its
10 investigation into this money order fraud.
11 32. On October 24, 2018, Gervais issued a Notice of Appeal for her dismissal. On the State
12 Personnel Board Appeal Form, Gervais, as Andrea Dangerfield, listed her address as the Premises and
13 her phone number 916-337-2710.
14 Roseville Police Department Investigation
15 33. On December 3, 2020, I reviewed a Roseville Police Department (RPD) police report and
16 learned the following:
17 a. RPD arrested Gervais on approximately January 7, 2020, for a violation of California
18 Penal Code § 530.5(a), which states that every person who “willfully obtains personal
19 identifying information of another person, and uses that information for any unlawful
20 purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or
21 medical information without the consent of that person, is guilty of a public offense.”
22 b. RPD records show that Gervais was identified as part of the RPD criminal investigation
23 in which an alleged identity theft victim received a Discover business card (delivered by
24 mail) in her name, as well as in the name of Dangerfield. The victim reported to RPD that
25 she had never applied for a Discover business card, and that she did not know Andrea
26 Dangerfield. The victim stated that she was contacted by Discover’s fraud division and
27 was told that Dangerfield had contacted the United States Postal Service (USPS) to have
28 the card sent to the Premises address.
AFFIDAVIT 9
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 11 of 30
1 c. The victim further provided that on January 7, 2020, while she was taking out the trash, a
2 female, who identified herself as “Andrea” approached her and asked if she had received
3 a credit card in the mail that did not belong to her. The victim said that the female was
4 short, had dark hair and was “very heavy.”
5 34. According to Gervais’s RAP sheet, those charges were dropped in February 2020 due to
6 a lack of sufficient evidence.
7 Current Gervais Investigation
8 35. According to the EDD, approximately 100 UI-PUA claims have been filed in which the
9 claimant’s street address was listed as the Premises. EDD has paid out at least twelve of those claims in
10 the amount of approximately $216,876 – including the claim that was filed under the name and SSN of a
11 sitting U.S. Senator – with an attempted dollar loss of approximately $2.1 million. Of the 100 claims
12 that were not paid by the EDD, the claimant either did not respond to an ID Alert, or the identity
13 documents provided were not sufficient to proceed with adjudicating the UI claim.
14 36. Bank of America provided the DOL-OIG a sampling of ATM photos related to seven of
15 the EDD UI debit cards mailed to the Premises address, including the ATM debit card in the name of
16 the sitting U.S. Senator. In approximately 44 ATM surveillance photos taken from July 3, 2020 to
17 September 25, 2020 at the main Roseville bank branch, a female matching the description of Gervais
18 was seen withdrawing money from the cards. 4 Below are examples of these photos and an identification
19 of the corresponding dates, locations, victims, and PUA debit card numbers:
20 [CONTINUED ON NEXT PAGE]
21
22
23
24
25
26
27
4
Agent note: ATM photos for more suspicious EDD UI debit cards have been requested, but
28 have not yet been received at the time that this affidavit was written.
AFFIDAVIT 10
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 12 of 30
1
2
3
4
5
6
7
8
9
10
11
12
13 Photo #1 – September 6, 2020, BofA ATM transaction at Roseville Square involving Victim T.H.
and PUA debit card ending x5086
14
15
16
17
18
19
20
21
22
23
24
25
26
Photo #2 (partially redacted) – September 21, 2020, BofA ATM transaction at Roseville Square
27 involving Victim J.H. and PUA debit card ending x1685
28 / / /
AFFIDAVIT 11
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 13 of 30
1 ID Theft Victim: J.M.
2 37. On or around August 25, 2020, a UI-PUA claim was filed in the name of victim J.M. The
3 claimant’s street address was listed as the Premises. On December 3, 2020, I spoke to J.M. who stated
4 that he/she has worked continuously for U.S. Customs and Immigration Services throughout the
5 pandemic and has never filed for unemployment insurance. Furthermore, he/she did not authorize
6 anyone to file a UI-PUA claim in his/her name.
7 38. EDD paid approximately $21,900 in UI-PUA benefits in the name of J.M. On August 28,
8 2020, Bank of America mailed a UI-PUA debit card to the Premises address.
9 According to Bank of America, between September 14 and September 18, 2020, $4,500 was withdrawn
10 from this card from the Bank of America main branch in Roseville, CA. At the time that this affidavit
11 was written, ATM photos of cash withdrawals from the main Roseville bank branch were not yet
12 available. As of November 2, 2020, the card had a balance of $17,400.00.
13 ID Alert Analysis
14 39. On or around September 6, 2020, a UI-PUA claim was filed in the name of potential ID
15 theft victim S.D. The claimant’s street address was listed as Premises. The EDD issued an ID Alert for
16 this claim. Thereafter, the EDD received a photograph of a California driver’s license (shown below
17 redacted):
18
19
20
21
22
23
24
25
26
27
28
AFFIDAVIT 12
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 14 of 30
1 40. I reviewed this driver’s license photo and believe, based on my training and experience,
2 that it is fake based on the following abnormalities:
3 a. There is no California state seal hologram visible over the headshot, as seen in the
4 Gervais’s driver’s license photo;
5 b. The driver’s license ID number is one digit off from that of Gervais’s;
6 c. The driver’s license number, name, and address appear to be clearer and less blurry than
7 the other parts of the driver’s license, which indicates that it had been altered; and
8 d. The DOB in the center in red letters does not match the DOB in black letters printed above
9 the eye color.
10 41. I also noticed that the fake driver’s license appears to have been placed on a surface that
11 includes the same woodgrain texture and color seen in the photograph of Gervais’s driver’s license.
12 Based on my training and experience, I believe the photographs of these driver’s licenses were likely
13 taken in the same location and/or by the same person. I attempted to uncover the geolocation of the
14 original photographs, but that information was not available.
15 IP Addresses Associated with Filed Claims
16 42. More than 50 IP addresses were used to file the suspicious UI claims linked to the
17 Premises. The investigation has not yet obtained subscriber records for any IP addresses.
18 43. The IP address used to file the March 2020 UI claim in the name of Gervais was filed
19 from 135.26.149.98. Only 3 other claims were filed using this IP address, one of which was filed in the
20 name of J.S., who—according to a law enforcement database—lives in West Virginia. An ID alert was
21 issued for the J.S. claim. As a result, a driver’s license was submitted that showed that J.S. lives on
22 Clinton Ave in Roseville, CA. The driver’s license submitted for the ID alert appears to be authentic.
23 The investigation has not yet determined if the UI claim filed in the name of J.S. is fraudulent.
24 Other Investigative Steps and Knowledge
25 44. Based upon my training and experience in mail fraud and identity theft investigations, I
26 know that suspects often take the mail and bankcards that they obtained illegally to their residences so
27 they can open, examine, and exploit them in private. I also know that these same suspects often store the
28 / / /
AFFIDAVIT 13
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 15 of 30
1 contents of illegally obtained mail at their residences and in their vehicles until they are ready or while
2 they are continuing to use them.
3 45. I am also aware that individuals involved in mail fraud, access device fraud, aggravated
4 identity theft, and conspiracy to commit such offenses (including schemes to acquire and to use federally
5 insured bank credit cards assigned to others), obtain access devices, PIN numbers, financial information,
6 identity information, checks and other personal and financial information of victims via fraud and theft.
7 I am also aware that in mail fraud and identity theft schemes, perpetrators will keep tools, implements,
8 financial statements, access devices, and stolen items close to themselves (especially in vehicles they
9 use, or their person, in their residences, in the residences of extended family members, and in storage
10 units) or in areas to which they have access in order to ensure custody and control of the items and for
11 easy access for use or disposal.
12 Use of Electronic Devices for Criminal Activity and Forensic Analysis
13 46. Based on the above-described evidence, there is probable cause to believe that the
14 Subject used electronic devices—such as smart phones, cell phones, tablets, and computers as
15 instrumentalities of their scheme and used the devices to store evidence and fruits of their crimes.
16 47. As described above, many of the fraudulent access devices were registered via the
17 internet, and, in some instances, a phone number or email address was provided. These actions typically
18 require the use of electronic devices.
19 48. Additionally, the stored communications and files connected to an electronic device may
20 provide direct evidence of the offenses under investigation. Based on my training and experience, instant
21 messages, emails, voicemails, photos, videos, and documents are often created and used in furtherance
22 of criminal activity, including to communicate and facilitate the offenses under investigation. There is
23 probable cause to believe the stored communications and files within electronic devices contain
24 communications and other files and data that are evidence of the offenses described in this affidavit.
25 49. In my training and experience, evidence of who was using an electronic device and from
26 where, and evidence related to criminal activity of the kind described above, may be found in the
27 various files and records described in this affidavit. This evidence may establish the “who, what, why,
28 when, where, and how” of the criminal conduct under investigation, thus enabling the United States to
AFFIDAVIT 14
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 16 of 30
1 establish and prove each element or, alternatively, to exclude the innocent from further suspicion.
2 50. Additionally, the electronic device user’s account activity, logs, stored electronic
3 communications, and other data can indicate who has used or controlled the device. This “user
4 attribution” evidence is analogous to the search for “indicia of occupancy” while executing a search
5 warrant at a residence. For example, subscriber information, email and messaging logs, documents, and
6 photos and videos (and the data associated with the foregoing, such as geo-location, date and time) may
7 be evidence of who used or controlled the account at a relevant time. As an example, because every
8 device has unique hardware and software identifiers, and because every device that connects to the
9 Internet must use an IP address, IP address and device identifier information can help to identify which
10 computers or other devices were used to access the account. Such information also allows investigators
11 to understand the geographic and chronological context of access, use, and events relating to the crime
12 under investigation.
13 51. There is probable cause to believe that electronic device activity will also provide
14 relevant insight into the owner’s state of mind as it relates to the offenses under investigation. For
15 example, information on the device may indicate the owner’s motive and intent to commit a crime (e.g.,
16 information indicating a plan to commit a crime), or consciousness of guilt (e.g., deleting account
17 information in an effort to conceal evidence from law enforcement).
18 52. Additionally, as described in this affidavit, there is probable cause to believe the offenses
19 may involve one or more coconspirators in locations scattered around the U.S. Based on my training and
20 experience, such conspirators must use electronic means to communicate about the scheme and to share
21 large amounts of data related to the scheme such as the personally identifiable information of victims.
22 Based upon my training and experience, my conversations with other law enforcement personnel
23 assisting in this case, and my investigation in this case, I am also aware that persons involved in identity
24 theft, mail theft, access device fraud, and bank fraud, along with their conspirators/accomplices use
25 smart phones, cell phones, tablets, and computer laptops to communicate with one another, either by
26 voice calls, emails, or text messages regarding their fraud and theft activities. I know that perpetrators
27 who use such devices commonly exchange real time information about theft and fraud activity and other
28 information regarding execution of theft or fraudulent transactions. Such information can be found
AFFIDAVIT 15
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 17 of 30
1 stored in the text/email messages and images on such devices. Such persons also use the devices to link
2 with the internet to obtain addresses and maps and locations/addresses of victims, including but not
3 limited to merchants, banks, and individual identity theft victims. Such devices can also be used to:
4 remotely make online fraudulent purchases, perform false or fraudulent mobile banking operations and
5 checks (verifications), and distribute the proceeds of fraudulent activities to co-conspirators via banking
6 and money-transfer applications.
7 53. Based upon my training and experience, my conversations with other law enforcement
8 personnel assisting in this case, and my investigation in this case, I am aware that the complete contents
9 of text messages, image files, and emails may be important to establishing the actual user who has
10 dominion and control of a particular phone or computer at a given time. Cell phones may be subscribed
11 to under false names with little to no verification by the service provider. Cell phones and computers
12 may also be used by multiple people. Given the ease with which such items may be obtained and used,
13 and the rarity with which law enforcement has eyewitness testimony about a defendant’s use of a
14 particular cell phone or device that was used to send a particular text or email message, investigators
15 often have to rely on circumstantial evidence to show that an individual was the actual user of a
16 particular cell phone or device. Often, by piecing together information contained in the contents of the
17 device (cell phone or computer or storage device) an investigator can establish the identity of the actual
18 user. Often, those pieces will come from a time period before the device was used in criminal activity.
19 Limiting the scope of the search for information showing the actual user of the device would, in some
20 instances, prevent the government from identifying the user of the device and, in other instances, allow a
21 defendant to possibly suggest that someone else was responsible. Therefore, the entire content of a
22 communication device often provides important evidence regarding the actual user’s dominion and
23 control of the device. Moreover, review of the contents of communications of electronic storage devices,
24 including text and email messages sent or received by the subject device assist in determining whether
25 other individuals had access to the device.
26 54. Based upon my training and experience, my conversations with other law enforcement
27 personnel assisting in this case, and my investigation in this case, I am aware that criminals discussing
28 their criminal activity via electronic communication devices (email and text messaging) may use images,
AFFIDAVIT 16
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 18 of 30
1 slang, short forms (abbreviated words or phrases such as “lol” to express “laugh out loud”), or code
2 words (which require entire strings or series of text message conversations to determine their true
3 meaning) when discussing their crimes. They can also discuss aspects of the crime without specifically
4 mentioning the crime involved. It is even possible to use pictures, images and emoticons (images used to
5 express a concept or idea such as a happy face inserted into the content of a text message or the
6 manipulation and combination of keys on the computer keyboard to convey an idea, such as the use of a
7 colon and paren :) to convey a smile or agreement) to discuss matters. “Keyword searches” or other
8 automated methods of review of the text messages sent to and from the subject device would not
9 account for any of these possibilities, so actual review of the text and email messages by law
10 enforcement personnel with information regarding the identified criminal activity is necessary to find all
11 relevant evidence.
12 55. Based upon my training and experience, my conversations with other law enforcement
13 personnel assisting in this case, and my investigation in this case, I have learned the following additional
14 information:
15 a. Individuals who steal, misdirect, take, unlawfully possess, or by fraud or deception
16 obtain, U.S. Mail often maintain the U.S. Mail, and its contents – including access
17 devices, bankcards, and gift cards – for long periods of time to exceed months. Such
18 individuals will also scan onto computers, cell phones, and computer storage devices
19 stolen mail or fraudulently obtained mail (and its contents) and maintain on computers,
20 cell phones, and storage devices co-conspirators names, victim’s names, addresses (of
21 victims, associates, accomplices), and stolen means of identification, to include images of
22 such, thereby reducing such items’ exposure to law enforcement and the community.
23 Individuals use their cell phones and personal computers to make online purchases using
24 gift cards to order items that will be shipped to their residences.
25 b. I am aware that even if a perpetrator deletes evidence of criminal activity (such as
26 identity theft, and fraudulent use of financial information in U.S. Mail) from electronic
27 storage devices, the evidence often can be recovered from the devices, including
28 computers or other forms of electronic storage media.
AFFIDAVIT 17
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 19 of 30
1 56. Based on my knowledge, training, and experience, I know that electronic devices can
2 store information for long periods of time. Similarly, things that have been viewed via the Internet are
3 typically stored for some period of time on the device. This information can sometimes be recovered
4 with forensics tools.
5 57. As described above and in Attachment B, this application seeks permission to search for
6 records that might be found on the PREMISES, in whatever form they are found. One form in which
7 the records might be found is data stored on an electronic device’s hard drive or other storage media.
8 Thus, the warrant applied for would authorize the seizure of electronic devices and storage media or,
9 potentially, the copying of electronically stored information, all under Rule 41(e)(2)(B).
10 58. There is probable cause to believe that things that were once stored on any electronic
11 devices located at any of the PREMISES may still be stored there, for at least the following reasons:
12 a. Based on my knowledge, training, and experience, I know that computer files or
13 remnants of such files can be recovered months or even years after they have been
14 downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic files
15 downloaded to a storage medium can be stored for years at little or no cost. Even when
16 files have been deleted, they can be recovered months or years later using forensic tools.
17 This is so because when a person “deletes” a file on a computer, the data contained in the
18 file does not actually disappear; rather, that data remains on the storage medium until it is
19 overwritten by new data.
20 b. Therefore, deleted files, or remnants of deleted files, may reside in free space or slack
21 space-that is, in space on the storage medium that is not currently being used by an active
22 file-for long periods of time before they are overwritten. In addition, a computer's
23 operating system may also keep a record of deleted data in a “swap” or “recovery” file.
24 c. Wholly apart from user-generated files, computer storage media-in particular, computers'
25 internal hard drives-contain electronic evidence of how a computer has been used, what it
26 has been used for, and who has used it. To give a few examples, this forensic evidence
27 can take the form of operating system configurations, artifacts from operating system or
28 application operation, file system data structures, and virtual memory “swap” or paging
AFFIDAVIT 18
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 20 of 30
1 files. Computer users typically do not erase or delete this evidence, because special
2 software is typically required for that task. However, it is technically possible to delete
3 this information.
4 d. Similarly, files that have been viewed via the Internet are sometimes automatically
5 downloaded into a temporary Internet directory or “cache.”
6 59. Forensic evidence. As further described in Attachment B, this application seeks
7 permission to locate not only electronically stored information that might serve as direct evidence of the
8 crimes described on the warrant, but also forensic evidence that establishes how electronic devices were
9 used, the purpose of their use, who used them, and when. There is probable cause to believe that this
10 forensic electronic evidence might be on the electronic devices found because:
11 a. Data on the storage medium can provide evidence of a file that was once on the storage
12 medium but has since been deleted or edited, or of a deleted portion of a file (such as a
13 paragraph that has been deleted from a word processing file). Virtual memory paging
14 systems can leave traces of information on the storage medium that show what tasks and
15 processes were recently active. Web browsers, e-mail programs, and chat programs store
16 configuration information on the storage medium that can reveal information such as
17 online nicknames and passwords. Operating systems can record additional information,
18 such as the attachment of peripherals, the attachment of USB flash storage devices or
19 other external storage media, and the times the computer was in use. Computer file
20 systems can record information about the dates files were created and the sequence in
21 which they were created.
22 b. Forensic evidence on a device can also indicate who has used or controlled the device.
23 This “user attribution” evidence is analogous to the search for “indicia of occupancy”
24 while executing a search warrant at a residence.
25 c. A person with appropriate familiarity with how an electronic device works may, after
26 examining this forensic evidence in its proper context, be able to draw conclusions about
27 how electronic devices were used, the purpose of their use, who used them, and when.
28 d. The process of identifying the exact electronically stored information on a storage
AFFIDAVIT 19
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 21 of 30
1 medium that are necessary to draw an accurate conclusion is a dynamic process.
2 Electronic evidence is not always data that can be merely reviewed by a review team and
3 passed along to investigators. Whether data stored on a computer is evidence may depend
4 on other information stored on the computer and the application of knowledge about how
5 a computer behaves. Therefore, contextual information necessary to understand other
6 evidence also falls within the scope of the warrant.
7 e. Further, in finding evidence of how a device was used, the purpose of its use, who used
8 it, and when, sometimes it is necessary to establish that a particular thing is not present on
9 a storage medium.
10 f. I know that when an individual uses an electronic device, the individual's electronic
11 device will generally serve both as an instrumentality for committing the crime, and also
12 as a storage medium for evidence of the crime. The electronic device is an
13 instrumentality of the crime because it is used as a means of committing the criminal
14 offense. The electronic device is also likely to be a storage medium for evidence of
15 crime. From my training and experience, I believe that an electronic device used to
16 commit a crime of this type may contain: data that is evidence of how the electronic
17 device was used; data that was sent or received; and other records that indicate the nature
18 of the offense.
19 60. Necessity of seizing or copying entire computers or storage media. In most cases, a
20 thorough search of a premises for information that might be stored on storage media often requires the
21 seizure of the physical storage media and later off-site review consistent with the warrant. In lieu of
22 removing storage media from the premises, it is sometimes possible to make an image copy of storage
23 media. Generally speaking, imaging is the taking of a complete electronic picture of the computer’s data,
24 including all hidden sectors and deleted files. Either seizure or imaging is often necessary to ensure the
25 accuracy and completeness of data recorded on the storage media, and to prevent the loss of the data
26 either from accidental or intentional destruction. This is true because of the following:
27 a. The time required for an examination. As noted above, not all evidence takes the form of
28 documents and files that can be easily viewed on site. Analyzing evidence of how a
AFFIDAVIT 20
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 22 of 30
1 computer has been used, what it has been used for, and who has used it requires
2 considerable time, and taking that much time on premises could be unreasonable. As
3 explained above, because the warrant calls for forensic electronic evidence, it is
4 exceedingly likely that it will be necessary to thoroughly examine storage media to obtain
5 evidence. Storage media can store a large volume of information. Reviewing that
6 information for things described in the warrant can take weeks or months, depending on
7 the volume of data stored, and would be impractical and invasive to attempt on-site.
8 b. Technical requirements. Computers can be configured in several different ways,
9 featuring a variety of different operating systems, application software, and
10 configurations. Therefore, searching them sometimes requires tools or knowledge that
11 might not be present on the search site. The vast array of computer hardware and
12 software available makes it difficult to know before a search what tools or knowledge
13 will be required to analyze the system and its data on the premises. However, taking the
14 storage media off-site and reviewing it in a controlled environment will allow its
15 examination with the proper tools and knowledge.
16 c. Variety of forms of electronic media. Records sought under this warrant could be stored
17 in a variety of storage media formats that may require off-site reviewing with specialized
18 forensic tools.
19 61. Nature of examination. Based on the foregoing, and consistent with Rule 41(e)(2)(B), the
20 warrant I am applying for would permit the examination of electronic devices consistent with the
21 warrant. The examination may require authorities to employ techniques, including but not limited to
22 computer-assisted scans of the entire medium, that might expose many parts of a device to human
23 inspection in order to determine whether it is evidence described by the warrant.
24 62. Manner of execution. Because this portion of the warrant—seeking forensic examination
25 of electronic devices found—seeks only permission to examine device(s) that would be already in law
26 enforcement’s possession, the execution of the forensic examination would not involve the physical
27 intrusion onto a premises. Consequently, I submit there is reasonable cause for the Court to authorize
28 execution of such examination at any time in the day or night following the seizure of the device.
AFFIDAVIT 21
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 23 of 30
1 63. Because several people may share the addresses listed in Attachment A-1 as a residence,
2 it is possible that the location will contain electronic devices and storage media that are predominantly
3 used, and perhaps owned, by persons who are not suspected of a crime. If it is nonetheless determined
4 that it is probable that the things described in this warrant could be found on any of those devices or
5 storage media, the warrant applied for would permit the seizure and review of those items as well.
6 CONCLUSION
7 64. For the reasons stated above, there is probable cause to believe that Andrea M. Gervais
8 committed the offense of mail fraud in violation of 18 U.S.C. § 1341, on or about the dates of March 18,
9 2020, and October 15, 2020.
10 65. For the reasons stated above, there is also probable cause to believe that evidence, fruits,
11 and instrumentalities of violations of 18 U.S.C. § 341 (mail fraud) and § 1028A (aggravated identity
12 theft), as more fully described in Attachment B, hereby fully incorporated herein, may be found at the
13 Premises or on the Subject identified in Attachments A-1 through A-3, attached and fully incorporated
14 herein.
15 [CONTINUED ON NEXT PAGE]
16
17
18
19
20
21
22
23
24
25
26
27
28
AFFIDAVIT 22
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 24 of 30
1 REQUEST TO SEAL
2 This case is the product of a covert investigation. Based on my training and experience in
3 investigations such as this one, I believe that public disclosure of the existence of this affidavit,
4 complaint, arrest warrants and/or search warrants may have a significant and negative impact on the
5 continuing investigation and may severely jeopardize law enforcement efforts to execute the warrants.
6 Also, premature disclosure may pose a risk to executing law enforcement. It is respectfully requested
7 that this Court issue an order sealing, until further order of the Court, all papers submitted in support of
8 this affidavit, the accompanying search warrant, and application.
9 Respectfully submitted,
10
11
/s/ John C. Collins
12 John C. Collins
Special Agent
13
U.S. Department of Labor
14
15
Subscribed and sworn to before me telephonically on: December 11, 2020
16
17
18
19 Hon. Allison Claire
U.S. MAGISTRATE JUDGE
20
21
22
23 Approved as to form by SAUSA ROBERT J. ARTUZ
24
25
26
27
28
AFFIDAVIT 23
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 25 of 30
ATTACHMENT A-1
The place to be searched: 2012 Rebecca Ct., Roseville, CA, including the garage and all
storage sheds and containers at or associated with the residence and residence yard. The
residence is shown in the photographs below and is further described as follows: 2012 Rebecca
Ct., Roseville, CA, is a duplex home.
This warrant authorizes the on- or off-site forensic examination of electronic devices found at the
searched location for the purpose of identifying the electronically stored information described in
Attachment B.
Attachment A-1 Page 1
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 26 of 30
ATTACHMENT A-2
The place to be searched is a blue Toyota Camry with California license plate 6KZR879
registered to Andrea M. GERVAIS, which is depicted parked in the driveway of 2012 Rebecca
Ct., Roseville, CA, in the below photograph:
This warrant authorizes the on- or off-site forensic examination of electronic devices found at the
searched location, for the purpose of identifying the electronically stored information described
in Attachment B.
Attachment A-2 Page 1
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 27 of 30
ATTACHMENT A-3
Person to be searched
The person to be searched is Andrea Marie GERVAIS. GERVAIS is a white female,
approximately 5’1”, with brown hair and brown eyes. GERVAIS’s date of birth is XX/XX/1977.
GERVAIS’s photograph appears below.
The search of GERVAIS shall include her person, clothing, and personal belongings, including
backpacks, briefcases and bags, that are within the immediate vicinity and control at the location
where the search warrant is executed and that may contain the items called for by Attachment B
to this warrant. This warrant authorizes the on- or off-site forensic examination of only electronic
devices found in the possession of or determined to be under the control of Andrea M. Gervais,
for the purpose of identifying the electronically stored information described in Attachment B.
Attachment A-3 Page 1
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 28 of 30
ATTACHMENT B
The evidence to be searched for and seized concerns violations of 18 U.S.C. § 1341 (mail fraud) and 18
U.S.C. § 1028A (aggravated identity theft) whether physical, digital, electronic, or otherwise, occurring
on after March 18, 2020, and is described in the enumerated list below:
1. Items and information tending to identify persons exercising dominion and control over the
location or particular areas within the location, including correspondence, papers, photos, videos,
bank statements, credit card statements, receipts, utility bills, emails, internet transaction records,
parcels, mail, and clothing;
2. United States mail, identification documents, and access devices bearing the names of, or
otherwise tending to pertain to, persons who do not live at or control the location;
3. Documents, records, and information relating to the contents of mail or property in the names of
persons who do not live in or control the location, together with indicia of possession, control,
ownership or use of such mail or property;
4. Documents, records, and information tending to show how money associated with the theft or
possession of U.S. Mail was obtained, secreted, transferred, and/or spent, including online
purchases and electronic transfer of funds;
5. U.S. Currency over $5,000;
6. Documents, records, and information containing, referencing, or listing the following types of
personally identifying information for individuals, businesses or merchants: names, dates of
birth, Social Security Numbers, email addresses, telephone numbers, passwords, bank account
numbers, credit card numbers, charge card numbers, credit card images, PIN numbers;
7. Credit cards, debit cards, and documents, records, and information pertaining to the possession,
control, ownership, or use of credit cards, and debit cards, including items obtained through
transactions involving credit cards and debit cards;
8. Financial instruments, documents, and information for all cards and/or accounts in the names of
suspected victims and other persons who do not live at 2012 Rebecca Ct., Roseville, CA,
including the following: credit applications, account applications, account numbers, credit cards,
charge cards, store specific account cards, prepaid debit cards, business and personal checks,
receipts, account statements, account related correspondence, records of goods and services
obtained, electronic books, money drafts, letters of credit, money orders, cashier’s checks and
receipts, deposits and withdrawal slips, and passbooks;
9. Documents, records, and information pertaining to unemployment insurance an pandemic
unemployment assistant benefits (whether or not attempted or successfully) in the name of
Andrea Gervais and for names other than Andrea Gervais;
10. All bank records, checks, credit card bills, account information, and other financial records;
11. Documents, records and information constituting, discussing, establishing or tending to
constitute, discuss or establish: (a) fraudulent or unauthorized activity involving personally
Attachment B Page 1
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 29 of 30
identifying information, and (b) the theft and trafficking of personally identifying information;
12. Tools and materials usable to make identification documents, check, or financial documents,
including: templates and software for making identifications, checks, or credit cards; laminating
machines, printers, electronic reader writers, label makers, heat sealers, embossers, and
identification imprinters, and access devices; and check washing materials, paper stock,
chemicals such as acetone to remove ink, and magnetic ink;
13. Records and information relating to the internet service provider and Internet Protocol address
assigned to the premises;
14. Evidence that may identify any coconspirators, coschemers, or aiders and abettors, including
records that help reveal their whereabouts;
15. Communications between coconspirators, coschemers, and aiders and abettors;
16. Evidence indicating the subjects’ state of mind as it relates to the crimes under investigation;
17. Historical location information, including GPS data, historical cell-site data, and precise location
information;
18. Photographs, images, and communications regarding any information responsive to any of the
above Paragraphs; and
19. With respect to “digital devices,” in addition to all of the categories described in the preceding
Paragraphs, items and information to be seized include any electronic records, including e-mail
messages, text messages, videos, electronic documents, images, and/or data:
a. tending to identify persons exercising dominion and control over each digital device
searched; and
b. tending to place in context, identify the creator or recipient of, or establish the time of
creation or receipt of any electronic information responsive to any of the above
Paragraphs.
As used above, the terms “records” and “information” includes all forms of creation or storage,
including any form of computer or electronic storage (such as hard disks or other media that can store
data); any handmade form (such as writing); any mechanical form (such as printing or typing); and any
photographic form (such as microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures,
or photocopies).
The term “storage medium” includes any physical object upon which computer data can be
recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and other
magnetic or optical media.
The terms “digital devices” and “electronic devices” mean computers, computer tablets (e.g.,
iPads), electronic storage devices (e.g., hard drives, thumb drives), smart phones, mobile phones,
cellular phones, and POS terminals. The seizure and search of digital devices shall follow the procedures
Attachment B Page 2
Case 2:20-mj-00189-AC Document 1 Filed 12/11/20 Page 30 of 30
outlined in the supporting affidavit. Deleted data, remnant data, slack space, and temporary and
permanent files on the digital devices may be searched for the evidence above.
The term “computer” includes all types of electronic, magnetic, optical, electrochemical, or other
high speed data processing devices performing logical, arithmetic, or storage functions.
The term “IP address” or “Internet Protocol address” means a unique numeric address used by
computers on the Internet. An IP address looks like a series of four numbers, each in the range 0-255,
separated by periods (e.g., 121.56.97.178). Every computer attached to the Internet must be assigned an
IP address so that Internet traffic sent from and directed to that computer may be directed properly from
its source to its destination. Most Internet service providers control a range of IP addresses. Some
computers have static—that is, long-term—IP addresses, while other computers have dynamic—that is,
frequently changed—IP addresses.
The term “Internet” means a global network of computers and other electronic devices that
communicate with each other. Due to the structure of the Internet, connections between devices on the
Internet often cross state and international borders, even when the devices communicating with each
other are in the same state.
Attachment B Page 3
File and source
- File
- 1-complaint.pdf
- Size
- 486,570 bytes
- SHA-256
- 1c9f83fd6a06cc09c3c56ddd6fb144c1fdfd288fe05282c395bce2ffb5718d91
- Our copy
- 1-complaint.pdf
- Original
- www.justice.gov