Complaint — United States v. Daniel Maleus (Dkt. 1-3, D. Mass.)

Summary

An affidavit of FBI Special Agent Michael Livingood filed April 8, 2021 as Document 1-3 in Case 1:21-mj-02142-MBB in the U.S. District Court for the District of Massachusetts, supporting a criminal complaint, arrest warrant and search warrants for Daniel Maleus. It cites wire fraud, conspiracy to commit wire fraud and aggravated identity theft under Title 18, United States Code, Sections 1343, 1349, and 1028A. The affidavit alleges that Maleus and an acquaintance submitted fraudulent Pandemic Unemployment Assistance claims to the Massachusetts DUA in the names and PII of third parties. It states that between April 30, 2020 and May 14, 2020 a Maleus phone number was used on approximately 65 PUA claims that paid out approximately $308,762, and that approximately $49,000 was withdrawn in cash. It also describes text messages between the two about the claims.

Summary drafted by a model from the text of the original file linked on this page and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“Complaint — United States v. Daniel Maleus (Dkt. 1-3, D. Mass.).” Original at archive.org. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/complaint-united-states-v-daniel-maleus-dkt-1-3-d-mass-ace15f7f4b/, SHA-256 58739e0d7d2d2b2abd6aae892e01e4d9d9d14e420f6618e9182bb54a6549a534.

Full text

Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 1 of 27

AFFIDAVIT

I, Michael Livingood, being first duly sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND

1. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) and have

been so employed since June 2016. I am assigned to the Economic Crimes Squad in the FBI’s

Boston, Massachusetts Field Office. My duties include investigating money laundering, wire

fraud, and internet fraud. I have participated in the execution of warrants involving the search

and seizure of computers, computer equipment, and electronically stored information. Before

becoming a Special Agent, I was an Intelligence Analyst for the FBI and supported investigative

work on a variety of federal crimes including crimes against children, transnational organized

crime, and money laundering. I have received specialized training in investigating financial

frauds and money laundering. I hold a master’s degree in human services.

2. As a federal agent, I am authorized to investigate violations of United States laws

and to execute warrants issued under the authority of the United States.

3. I am currently investigating DANIEL MALEUS (“MALEUS”) for his involvement

in various federal crimes, including wire fraud, conspiracy to commit wire fraud, and aggravated

identity theft, in violation of Title 18, United States Code, Sections 1343, 1349, and 1028A,

respectively (collectively the “TARGET OFFENSES”).

4. I make this affidavit in support of applications for a criminal complaint, a warrant

for MALEUS’s arrest, and search warrants for MALEUS’s person and the property located at

, Stoneham, Massachusetts 02180 (“the SUBJECT

PREMISES”).
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 2 of 27

5. Based on the facts as set forth in this affidavit, there is probable cause to believe

that MALEUS has committed the TARGET OFFENSES, and that he and the SUBJECT

PREMISES possess or contain, respectively, evidence, fruits, and instrumentalities of the

TARGET OFFENSES as described in Attachment B to the proposed warrants.

6. The facts set forth in this affidavit are based upon my personal observations, my

training and experience, and information obtained from various law enforcement personnel and

witnesses. This affidavit is intended to show merely that there is sufficient probable cause to

support the requested complaint, arrest warrant, and search warrants. It does not purport to set

forth all of my knowledge of or investigation into this matter. Unless indicated otherwise, all

conversations and statements described in this affidavit are related in substance and in part.

PROBABLE CAUSE

The Pandemic Unemployment Assistance Program

7. On March 27, 2020, the Coronavirus Aid, Relief, and Economic Security Act

(“CARES Act”) was signed into law. The CARES Act created a new temporary federal

unemployment insurance program called Pandemic Unemployment Assistance (“PUA”). PUA

provides unemployment insurance benefits for individuals who are not eligible for other types of

unemployment benefits (e.g., the self-employed, independent contractors, or gig economy

workers). PUA provided payments for these benefits beginning on or after January 27, 2020 and

ending before December 31, 2020, for a maximum period of 39 weeks. On or about December

27, 2020, recipients of PUA were granted 13 weeks of extended benefits. The American Rescue

Plan Act has now further extended PUA benefits through September 4, 2021.

8. The Massachusetts Department of Unemployment Assistance (“DUA”)

administers the PUA program in the Commonwealth of Massachusetts. Massachusetts residents

2
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 3 of 27

may apply to DUA for PUA benefits through an online portal over which they submit certain

personally identifiable information (“PII”).

9. The PUA claims submitted to DUA are processed on a server in Colorado. I

understand that PUA claims cause wires to be transmitted to and/or from this Colorado-based

server.

10. As part of the PUA application process, a claimant provides their first and last

name, Social Security number (“SSN”), date of birth, and a residential and mailing address. In

addition, the claimant selects a preferred payment method: direct deposit or payment of their

benefit on to a debit card. The claimant also provides a phone number and an email address to be

used by DUA to provide updates, contact the claimant, and for authentication purposes. The email

address can also be used by the claimant to access their PUA claim account and, if necessary, to

reset their claim account password. A claimant can choose one of three ways to meet DUA’s two-

factor authentication requirement: authentication app, text message, or email.

11. DUA communications with PUA claimants are ongoing. For example, I am aware

that in or about February 2021, DUA mailed 1099-G tax forms to the addresses on file for PUA

claimants, and that, as recently as March 2021, it sent “Notice[s] of Monetary Redetermination”

when it extended PUA benefits. DUA sent these communications to the email address and/or

mailing address on file for each PUA claim.

3
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 4 of 27

MALEUS

12. I interviewed MALEUS on October 8, 2020 at his residence in Medford,

Massachusetts. Sometime after that interview, MALEUS moved to the SUBJECT PREMISES.1

13. Based on records obtained from Apple, the Apple ID

@wheelock.edu) was created on September 23, 2014. That account is

registered to “Daniel Maleus” and lists MALEUS’s previous Medford address.

14. MALEUS has opened bank accounts at several financial institutions, including

Bank of America, Citizens Bank, Chase Bank, and Santander Bank.

15. MALEUS has multiple phone numbers, including:

a. XXX-XXX-0673. This number was used to file a PUA claim in MALEUS’s

name. This number was also used to open bank accounts in MALEUS’s name

at different banks, including Santander, Citizens Bank, and Chase Bank.

MALEUS’s Apple ID is also registered with this phone number. While this

phone number is used by MALEUS, T-Mobile records reflect that the

“subscriber name” is “Rondo Wade”.

b. XXX-XXX-2579. On June 2, 2020, I interviewed Lilly Nguyen, an

acquaintance of MALEUS who is a proposed defendant in a separate

complaint arising out of the FBI’s investigation. Nguyen provided this phone

number for Maleus. T-Mobile records indicate that the “subscriber name” on

this phone number is also “Rondo Wade”.

1
MALEUS signed a lease of the SUBJECT PREMISES on September 1, 2020 for a
period of October 5, 2020 to October 4, 2021. I confirmed with the management group of the
SUBJECT PREMISES on April 5, 2021 that MALEUS currently resides there.

4
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 5 of 27

16. Maleus’s phone number (XXX-XXX-0673) has been used to subscribe to

multiple yahoo.com email addresses in the names of third parties, including

19@yahoo.com and 19@yahoo.com. As described below, these email

addresses have been used to file fraudulent PUA claims.

Nguyen

17. Nguyen previously lived in Medford, Massachusetts. In or about September

2020, Nguyen moved to the same apartment complex as the SUBJECT PREMISES, where she

currently resides.

18. Based on multiple sources, including an interview of Nguyen on June 2, 2020, I

have confirmed that Nguyen’s cellphone number is XXX-XXX-5864. In addition to that

cellphone number, records from T-Mobile reflect that, between May 1 and November 30, 2020,

Nguyen has subscribed to and activated seven other T-Mobile numbers.2

19. The investigation has also identified multiple email addresses associated with

Nguyen, including @gmail.com and @newbury.edu. Based on

records obtained from Apple Inc., each of those email addresses is also an Apple ID associated

with a corresponding Apple account:

a. The first Apple ID @newbury.edu) was created on January 10, 2015.

That account was created using the name “Lilly Nguyen” and was registered

2
T-Mobile records show that “Lilly M. Nguyen” is the subscriber for two T-Mobile
numbers that were activated in May 2020: (1) XXX-XXX-5638, and (2) XXX-XXX-4143.
“Lilly M. Nguyen” is also the subscriber for five T-Mobile numbers that were activated between
August and November 2020: (1) XXX-XXX-8906, (2) XXX-XXX-1092, (3) XXX-XXX-6060,
(4) XXX-XXX-5026, and (5) XXX-XXX-3654.

5
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 6 of 27

using Nguyen’s cellphone number (XXX-XXX-5864) and Nguyen’s former

Medford address.

b. The second Apple ID @gmail.com) was created on April 4, 2020.

While the account was created using the name “iloveluxury”, it was registered

using Nguyen’s cellphone number (XXX-XXX-5864) and Nguyen’s former

Medford address.

20. Nguyen has opened bank accounts at several financial institutions, including

Wells Fargo, Chase Bank, TD Bank, and Citizens Bank.

Overview of the MALEUS and Nguyen Conspiracy

21. As a result of information obtained from DUA, telecommunications and bank

records, and my interview of Nguyen, there is probable cause to believe that Nguyen and

MALEUS have worked together to submit fraudulent PUA claims in the names and PII of third

parties. The two used phone numbers, mailing addresses, email addresses, and bank accounts that

they control to file the fraudulent claims, communicate with DUA, and receive the fraudulent

payments.

22. Between April 30, 2020 and May 14, 2020, MALEUS’s phone number (XXX-

XXX-2579) has been used on submissions of approximately 65 PUA claims that have paid out

approximately $308,762 in PUA funds. Records from Bank of America, Citizens Bank, Chase

Bank, and Santander Bank reflect that MALEUS’s accounts have received PUA payments in the

names of third parties, and that approximately $49,000 in PUA funds were withdrawn in cash

from these accounts.

23. Between April 25, 2020 and December 24, 2020, Nguyen’s cellphone number

(XXX-XXX-5864) has been used to submit approximately 15 fraudulent PUA claims that have

6
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 7 of 27

paid out approximately $125,268.00 in PUA funds. Records from Wells Fargo, Chase Bank, TD

Bank, and Citizen’s Bank show that Nguyen’s accounts have received PUA payments in the

names of third parties, and that approximately $52,000 in PUA funds were withdrawn in cash

from these accounts.

24. Records from DUA and Apple, and text messages between MALEUS and

Nguyen, indicate that MALEUS and Nguyen were coordinating to submit PUA claims from IP

Address 71.192.201.124 (“the 124 IP Address”).

25. Between April 25, 2020 and May 11, 2020, the 124 IP Address was used to

submit approximately 36 PUA claims that used either MALEUS’s phone number (XXX-XXX-

2579) or Nguyen’s phone number (XXX-XXX-5864). Those claims have paid out

approximately $251,364 in PUA funds.

26. Some of these PUA claims used MALEUS’s phone number and former Medford

address but used Nguyen’s bank accounts to receive the PUA funds. For example, on May 4,

2020, PUA Claim A00-000-0180-6470 was submitted in the name and PII of Victim 1. The

claim was submitted using the 124 IP Address, MALEUS’s phone number (XXX-XXX-2579),

and MALEUS’s Medford address, and Nguyen’s Wells Fargo account (XXXXXX6914) to

receive benefits. On March 3, 2021, I interviewed Victim 1 who lives in Michigan, has never

lived in Massachusetts, and has not filed for unemployment benefits here.

27. Some PUA claims that used Nguyen’s bank accounts to receive PUA funds were

later changed to direct the funds to MALEUS’s bank accounts. For example, on May 3, 2020,

PUA claim A00-000-0179-9519 was submitted in the name of on Victim 2 using the 124 IP

Address, MALEUS’s phone number (XXX-XXX-2579), and MALEUS’s former Medford

7
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 8 of 27
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 9 of 27
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 10 of 27
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 11 of 27
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 12 of 27

PUA Payments into NGUYEN’s Wells Fargo Accounts

31. Nguyen has three bank accounts at Wells Fargo: (1) XXXXXXX0513,

(2) XXXXXXX4109, and (3) XXXXXXX6914. Between April 25, 2020 and May 10, 2020,

these accounts received $68,000 in DUA payments on PUA claims submitted in the names and

PII of eight people other than Nguyen or MALEUS.

32. Of those eight claims, three used Nguyen’s cellphone number (XXX-XXX-5864):

a. On April 25, 2020 at approximately 3:55 p.m., PUA Claim A00-000-

0036-2285 was submitted in the name and PII of Victim 3, discussed above.

b. On April 26, 2020 at approximately 12:42 a.m., PUA Claim A00-000-

0096-8263 was submitted in the name and PII of Victim 5. The claim was

submitted using the 124 IP Address. Records from Apple reflect that

Nguyen’s Apple ID @newbury.edu) used the 124 IP Address

to receive “AMS Updates” less than an hour later, at approximately 1:37 a.m.,

which causes me to believe that Nguyen’s cell phone (and not simply her cell

phone number) was used to file the fraudulent claim. Further, the street

address provided to DUA for this claim is the street address where Nguyen

resided at the time the PUA claim was submitted (her former Medford

residence). On January 4, 2021, I interviewed Victim 5, a resident of Jamaica

Plain, Massachusetts. Victim 5 verified that her PII had been used to file the

claim but stated that she did not file the claim and has no affiliation with the

phone number, address, or email address used.

c. On April 29, 2020, PUA Claim A00-000-0070-4213 was submitted in the

name and PII of Vicitm 6 with the listed street address of Nguyen’s

12
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 13 of 27
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 14 of 27

Nguyen spoke by phone to a Wells Fargo “loss prevention” representative. I have listened to

Wells Fargo’s recording of this call, which includes, in part, the following back-and-forth:

a. Nguyen identified herself by her name and the last four digits of her Social

Security number.

b. The representative told Nguyen that the funds in her accounts could not be

released because the funds were the result of “unauthorized electric [sic]

transfers”.

c. Nguyen responded that “the electronic was from my family cause they don’t have

a bank account so they had to use mine”. Nguyen also stated, “I had to file for

them [her family] and with them not having an account I had to put them in my

account”.

d. The representative reiterated that the “MA DUA Cares” funds were “confirmed to

be unauthorized”. The representative then asked Nguyen to confirm that “the

DUA . . . was from your family” and that Nguyen had “used those funds”, to

which Nguyen responded “yes”. The representative then repeated that “those

funds were unauthorized” and declined to release them to Nguyen.

37. As noted above, none of the eight PUA claims resulting in deposits to Nguyen’s

Wells Fargo accounts appear to have been made in the names or PII of Nguyen’s or MAELUS’

family members.

Interview of Nguyen

38. On or about June 2, 2020, I interviewed Nguyen at her former Medford residence.

I asked Nguyen about unemployment funds that had been transferred into her bank accounts,

including her Wells Fargo accounts. I warned Nguyen about the importance of being truthful

14
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 15 of 27

during the interview and that lying could constitute a federal crime. Nguyen acknowledged that

she understood.

39. Nguyen claimed that she had never received unemployment benefits on behalf of

anyone else. Nguyen also claimed that she did not closely monitor her Wells Fargo account and

was unsure where any incoming funds had come from. I told Nguyen that her Wells Fargo

account had received over $35,000 in DUA payments in the names of other individuals. Nguyen

stated that she had no knowledge of these funds being in her account.

40. Nguyen told me that she had opened Wells Fargo accounts in approximately

March 2020 on behalf of her friend, MALEUS. Nguyen told me that she had given MALEUS

her account information, and that on various occasions Nguyen had withdrawn cash from those

accounts for MALEUS. When asked for MALEUS’s telephone number, Nguyen provided it

from memory (XXX-XXX-2579).

41. Nguyen also stated that she had also opened a TD Bank account in approximately

March 2020 and given the bank account information to MALEUS. When I told Nguyen that her

TD Bank account had also received unemployment funds, Nguyen claimed to have no

knowledge of any funds in the account.

42. Nguyen also claimed that MALEUS directed her in approximately March 2020 to

purchase a reloadable pre-paid debit card at a CVS Pharmacy, which Nguyen believed to be a

Green Dot card. Nguyen told me she activated the card and gave MALEUS information about it.

43. At the end of the interview, I gave Nguyen an FBI Money Mule Warning Letter,

which she read, acknowledged understanding, and signed. The letter advised Nguyen that she

“may have been a party to a financial transaction that involved the proceeds of criminal activity”

and stated:

15
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 16 of 27

Under certain circumstances, knowingly engaging in a financial transaction that
involves funds derived from illegal activity may violate the federal money
laundering laws, even if you had no involvement in the underlying criminal
activity. Under certain circumstances, you may also have a legal obligation to
inquire about the source of the funds and may not avoid legal responsibility by
being willfully blind to the source of the funds. A knowing and intentional
violation of the money laundering laws may result in criminal prosecution and the
seizure of property that is found to be tainted by illegal funds. By agreeing to
engage in such transactions, you may be also be facilitating a fraudulent scheme
and assisting the perpetrators of the scheme.

44. I also verbally advised Nguyen about the nature of money laundering and that

opening accounts of behalf of others and/or moving funds of unknown origin could violate

federal money laundering laws. Nguyen acknowledged to me that she understood.

MALEUS’s Continued Involvement in PUA Fraud

45. In or about September 2020, MALEUS and Nguyen moved to the same apartment

complex (the location of the SUBJECT PREMISES). While Nguyen kept the cellphone number

she had used in furtherance of the fraud (XXX-XXX-5864), Nguyen also activated five other T-

Mobile cell phone accounts between August and November 2020.

46. DUA records reflect that, in certain instances, the phones that Nguyen activated

were used to submit PUA claims. For example, on October 27, 2020, Nguyen’s T-Mobile

number (XXX-XXX-8906) and the email address @gmail.com3 were used to file

PUA claim A00-000-1306-1650 in the name and PII of Victim 11. The claim was submitted

using IP Address 66.30.86.128, which Comcast records reflect is assigned to Nguyen at her

current address (in the same apartment complex as the SUBJECT PREMISES).

47. Nguyen has also continued to file PUA claims using her cellphone number (XXX-

XXX-5864). For example, on December 24, 2020, Nguyen’s cellphone number and the email

3
This email address is similar to the name NGUYEN used to create one of her Apple IDs
(“ ”).

16
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 17 of 27
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 18 of 27

MALEUS AND THE SUBJECT PREMISES WILL CONTAIN OR POSSESS
EVIDENCE, FRUITS, AND INSTRUMENTALITIES OF THE TARGET OFFENSES

51. For the reasons stated below, there is also probable cause to believe that the

SUBJECT PREMISES and MALEUS’s person, each as described in Attachment A to the proposed

warrants, will contain or possess, respectively, fruits, evidence, and instrumentalities of the

TARGET OFFENSES as described in Attachment B to the proposed warrants.

52. The management group of the SUBJECT PREMISES has confirmed that the

SUBJECT PREMISES includes (1) Apartment , a two-bedroom, two-bathroom apartment on

the fourth floor of the building at in Stoneham and (2) Garage , located in

the adjacent building, which is a garage unit and storage space currently assigned for the use of

Apartment and MALEUS.

53. As described above, I am aware that in or about February 2021, DUA mailed 1099-

G tax forms to the addresses on file for PUA claimants, and that, as recently as March 2021, it sent

“Notice[s] of Monetary Redetermination” when it extended PUA benefits. Multiple fraudulent

claims were submitted using MALEUS’s previous address, email addresses under his control,

and/or his phone number. There is accordingly probable cause that communications regarding

fraudulent PUA claims will be found in the SUBJECT PREMISES or on MALEUS’s person on

his cell phone.

54. Similarly, as noted above, DUA records regarding fraudulent claims connected to

MALEUS and Nguyen were accessed as recently as March 10, 2021. Given MALEUS’s

involvement in the filing of these claims, there is probable cause to believe that he recently

accessed these records using a device on his person or in the SUBJECT PREMISES.

55. There is also probable cause to believe that MALEUS possesses information, either

on his person or at the SUBJECT PREMISES, used to submit fraudulent PUA claims. Based on

18
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 19 of 27

my training and experience as a fraud investigator, submitting a PUA claim requires a substantial

amount of PII, including a first and last name, date of birth, phone number, residential and mailing

address, email address, SSN, and bank account information. Because of the number of false PUA

claims connected to MALEUS and Nguyen’s activity, there is probable cause to believe that

MALEUS and Nguyen likely wrote down or preserved at least some of this information. The

email address used to submit the claims, for example, would have to be retained in order to login

later to DUA’s PUA web portal. Further, based on my training and experience, there is probable

cause to believe that MALEUS has kept at least some of the PII used to submit fraudulent PUA

claims because that information retains value for other criminal schemes. In addition to

MALEUS’s unemployment fraud scheme described above, PII can be sold or used for identity

fraud, fraudulent loans or money transfers, counterfeit credit cards, and/or blackmail and extortion.

Based on my training and experience, individuals tend to store valuable information, including PII,

in a private location, such as their residence, personal storage space, and/or on their smartphone.

Seizure of Computer Equipment and Data

56. As noted above, the investigation has determined that fraudulent unemployment

claims were submitted online to DUA using email addresses and mobile phones (or other

electronic devices) as recently as December 2020. Logins to DUA’s PUA web portal have

occurred on some of these fraudulent claims as recently as March 10, 2021. As such, there is

probable cause to believe that MALEUS’s cellular phones (and other electronic devices) were used

in connection with the fraudulent claims and will contain evidence of the TARGET OFFENSES,

including recent communications from DUA regarding the claims.

57. Additionally, from my training, experience, and information provided to me by

other agents, I am aware that individuals frequently also use computers to create and store records

19
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 20 of 27

of their actions by communicating about them through email, instant messages, and updates to

online social networking websites; drafting letters; keeping their calendars; arranging for travel;

storing pictures; researching topics of interest; buying and selling items online; and accessing their

bank, financial, investment, utility, and other accounts online. Many cell phones, such as the Apple

iPhone, now function essentially as small computers. Phones have capabilities that include serving

as a wireless telephone to make audio calls, digital camera, portable media player, GPS navigation

device, sending and receiving text messages and emails, and storing a range and amount of

electronic data. Examining data stored on devices of this type can uncover, among other things,

evidence of communications and evidence that reveals or suggests who possessed or used the

device. For example, MALEUS’s cellular phone was used to facilitate the submission of

fraudulent PUA claims, including by receiving communications from DUA.

58. Information stored within a computer and other electronic storage media may also

provide crucial additional evidence of the “who, what, why, when, where, and how” of the

TARGET OFFENSES, thus enabling the United States to establish and prove each element of the

TARGET OFFENSES, or alternatively, to exclude the innocent from further suspicion.

Information stored within a computer or storage media (e.g., registry information,

communications, images and movies, transactional information, records of session times and

durations, internet history, and anti-virus, spyware, and malware detection programs) can provide,

for example:

a. Evidence of who has used or controlled the computer or storage media and what

computer or storage media. This “user attribution” evidence is analogous to the

search for “indicia of occupancy” while executing a search warrant at a residence.

The existence or absence of anti-virus, spyware, and malware detection programs

20
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 21 of 27

may also indicate whether the computer was remotely accessed, thus inculpating or

exculpating the computer owner.

b. Evidence of how and when the computer or storage media was accessed or used.

Computers typically contain information that log: computer user account session

times and durations, computer activity associated with user accounts, electronic

storage media that connected with the computer, and the IP addresses through

which the computer accessed networks and the internet. Such information allows

investigators to understand the chronological context of computer or electronic

storage media access, use, and events relating to the crime under investigation.

c. Evidence relating to the physical location of other evidence and the suspect. Images

stored on a computer may both show a particular location and have geolocation

information incorporated into its file data. Such file data typically also contains

information indicating when the file or image was created. The existence of such

image files, along with external device connection logs, may also indicate the

presence of additional electronic storage media (e.g., a digital camera or cellular

phone with an incorporated camera).

d. Information within the computer may indicate the owner’s motive and intent to

commit a crime (e.g., internet searches indicating criminal planning), or

consciousness of guilt (e.g., running a “wiping” program to destroy evidence on the

computer or password protecting/encrypting such evidence in an effort to conceal

it from law enforcement).

59. From my training, experience, and information provided to me by other agents, I

am aware that individuals commonly store records of the type described in Attachment B to the

21
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 22 of 27

proposed warrant in computer hardware, computer software, smartphones, and storage media.

Further, computer files or remnants of such files can be recovered months or years after they have

been written, downloaded, saved, deleted, or viewed locally or over the Internet. This is true

because:

a. Electronic files that have been downloaded to a storage medium can be stored for

years at little or no cost. When users replace their computers, they can easily

transfer the data from their old computer to their new computer.

b. Even after files have been deleted, they can be recovered months or years later

using forensic tools. This is so because when a person “deletes” a file on a

computer, the data contained in the file does not actually disappear; rather, that data

remains on the storage medium until it is overwritten by new data, which might not

occur for long periods of time. In addition, a computer’s operating system may

also keep a record of deleted data in a “swap” or “recovery” file.

c. Wholly apart from user-generated files, computer storage media contain electronic

evidence of how the computer has been used, what it has been used for, and who

has used it. This evidence can take the form of operating system configurations,

artifacts from operating system or application operation, file system data structures,

and virtual memory “swap” or paging files. It is technically possible to delete this

information, but computer users typically do not erase or delete this evidence

because special software is typically required for that task.

d. Similarly, files that have been viewed over the Internet are sometimes automatically

downloaded into a temporary Internet directory or “cache.” The browser often

maintains a fixed amount of hard drive space devoted to these files, and the files

22
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 23 of 27

are overwritten only as they are replaced with more recently viewed Internet pages

or if a user takes steps to delete them.

e. Data on a storage medium can provide evidence of a file that was once on the

storage medium but has since been deleted or edited, or of a deleted portion of a

file (such as a paragraph that has been deleted from a word processing file). Virtual

memory paging systems can leave traces of information on the storage medium that

show what tasks and processes were recently active. Web browsers, email

programs, and chat programs store configuration information on the storage

medium that can reveal information such as online nicknames and passwords.

Operating systems can record additional information, such as the attachment of

peripherals, the attachment of USB flash storage devices or other external storage

media, and the times the computer was in use. Computer file systems can record

information about the dates files were created and the sequence in which they were

created, although this information can later be falsified.

60. A person with appropriate familiarity with how a computer works can, after

examining this forensic evidence in its proper context, draw conclusions about how computers

were used, the purpose of their use, who used them, and when.

61. The law enforcement agents will endeavor to search and seize only the computer

equipment which, upon reasonable inspection and/or investigation conducted during the execution

of the search, reasonably appear to contain the evidence in Attachment B to the proposed warrant

because they are associated with (i.e., used by or belong to) MALEUS or Nguyen. However, there

may be computer equipment identified during the search whose association with MALEUS and/or

Nguyen is not possible to determine at the scene. Computer equipment and data can be disguised,

23
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 24 of 27

mislabeled, or used without the owner’s knowledge. In addition, technical, time, safety, or other

constraints can prevent definitive determination of their ownership at the premises during the

execution of the proposed warrant. Therefore, if the law enforcement agents cannot make a

determination as to use or ownership regarding any particular device, this application seeks

permission to search and seize all electronic devices if the things described in Attachment B to the

proposed warrant are of the type that might be found on those devices.

62. This application further seeks to conduct the search and seizure onsite or off-site in

order to determine their true use or contents, regardless of how the contents or ownership appear

or are described by people at the scene of the search. Based on my knowledge and training and

the experience of other agents with whom I have spoken, I am aware that in order to completely

and accurately retrieve data maintained in computer hardware, computer software or storage

media, to ensure the accuracy and completeness of such data, and to prevent the loss of the data

either from accidental or programmed destruction, it is often necessary that computer hardware,

computer software, and storage media be seized and subsequently processed by a computer

specialist in a laboratory setting rather than in the location where it is seized. This is true because:

a. The volume of evidence storage media such as hard disks, flash drives, CDs, and

DVDs can store the equivalent of thousands or, in some instances, millions of pages

of information. Additionally, a user may seek to conceal evidence by storing it in

random order or with deceptive file names. Searching authorities may need to

examine all the stored data to determine which particular files are evidence, fruits,

or instrumentalities of criminal activity. This process can take weeks or months,

depending on the volume of data stored, and it would be impractical to attempt this

analysis on-site.

24
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 25 of 27

b. Technical requirements analyzing computer hardware, computer software or

storage media for criminal evidence is a highly technical process requiring expertise

and a properly controlled environment. The vast array of computer hardware and

software available requires even computer experts to specialize in some systems

and applications. Thus, it is difficult to know, before the search, which expert

possesses sufficient specialized skill to best analyze the system and its data.

Furthermore, data analysis protocols are exacting procedures, designed to protect

the integrity of the evidence and to recover even "hidden," deleted, compressed, or

encrypted files. Many commercial computer software programs also save data in

unique formats that are not conducive to standard data searches. Additionally,

computer evidence is extremely vulnerable to tampering or destruction, both from

external sources and destructive code imbedded in the system as a "booby trap."

Consequently, law enforcement agents may either copy the data at the premises to be searched or

seize the computer equipment for subsequent processing off-site.

63. Off-site processing may also be necessary because the process of identifying the

exact files, blocks, registry entries, logs, or other forms of forensic evidence on a storage medium

that are necessary to draw an accurate conclusion is a dynamic process. While it is possible to

specify in advance the records to be sought, computer evidence is not always data that can be

merely reviewed by a review team and passed along to investigators. Whether data stored on a

computer is evidence may depend on other information stored on the computer and the application

of knowledge about how a computer behaves. Therefore, contextual information necessary to

understand other evidence also falls within the scope of the proposed warrant.

25
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 26 of 27

Unlocking a Device Using Biometric Features

64. I know from my training and experience, as well as from information found in

publicly available materials, that some models of cellphones made by Apple and other

manufacturers, offer their users the ability to unlock a device via the use of a fingerprint or through

facial recognition, in lieu of a numeric or alphanumeric passcode or password.

65. On the Apple devices that have this feature, the fingerprint unlocking feature is

called Touch ID. If a user enables Touch ID on a given Apple device, he or she can register up to

5 fingerprints that can be used to unlock that device. The user can then use any of the registered

fingerprints to unlock the device by pressing the relevant finger(s) to the device’s Touch ID sensor.

In some circumstances, a fingerprint cannot be used to unlock a device that has Touch ID enabled,

and a passcode must be used instead, such as: (1) when more than 48 hours has passed since the

last time the device was unlocked and (2) when the device has not been unlocked via Touch ID in

8 hours and the passcode or password has not been entered in the last 6 days. Thus, in the event

law enforcement encounters a locked Apple device, the opportunity to unlock the device via Touch

ID exists only for a short time. Touch ID also will not work to unlock the device if (1) the device

has been turned off or restarted; (2) the device has received a remote lock command; or (3) five

unsuccessful attempts to unlock the device via Touch ID are made.

66. The passcode that would unlock any of MALEUS’s devices found during the search

of the SUBJECT PREMISES is not currently known to law enforcement. Thus, it may be useful

to press MALEUS’s finger(s) to the device’s fingerprint sensor or to hold the device up to

MALEUS’s face in an attempt to unlock the device for the purpose of executing the search

authorized by this warrant. The government may not otherwise be able to access the data contained

on those devices for the purpose of executing the search authorized by the proposed warrant.

26
Case 1:21-mj-02142-MBB Document 1-3 Filed 04/08/21 Page 27 of 27

File and source

File: 1-att3-complaint.pdf
Size: 1,326,492 bytes
SHA-256: 58739e0d7d2d2b2abd6aae892e01e4d9d9d14e420f6618e9182bb54a6549a534
Our copy: 1-att3-complaint.pdf
Original: archive.org