Anda di halaman 1dari 50

ORIGIN

UNI TED STATES OF AME R I C A


V. CRIMINALCOMPLAINT
G A Y L A SHEI LA ST. J UL I AN nee O' NE AL C AS E NUMB E R : l:13-mj-1290
I, A L E X A N D R E HE RRE RA, the undersigned complainant being duly swom state the following is true and
correct to the best of my knowledge and belief. From i n or about 2010 to date, i n Fulton County, elsewhere
i n the Northem District of Georgia, the defendant(s) did, Track Statutory Language of Offense)
knowingly and wi l f ul l y execute and attempt to execute a scheme to defraud federally insured financial
institutions by depositing stolen and fraudulently obtained checks and fraudulently obtained auto loan proceeds
into bank accounts opened in the stolen identities of real persons, and launder scheme proceeds through other
accounts also opened i n stolen identities of real persons, often using the mails, other interstate carriers, and
interstate wire communications to obtain the stolen names and personal identifiers used to execute said scheme
to defraud; and conspire with others to do so; and
knowingly convert to her use and the use of others over half a mi l l i on dollars i n stolen and fraudulently
obtained United States Treasury Checks,
in violation of Title 18 United States Code, Sectionfs) 641.1028 (A). 1341.1343.1344.1349.. 1956. and 1957.
I further state that I am a(n) Special Agent of the United States Secret Service and that this complaint is based
on the following facts:
SEE A T T A C H E D AFFI DAVI T
Continued on the attached sheet and made a part hereof. ( X) Yes ( ) No
Signature of Complainant
Alexandre Herrera
Based upon this complaint, this Court finds that there is probable cause to believe that an offense has been
committed and that the defendant has committed it. Swom to before me, and subscribed i n my presence
September 10.2013 at Atlanta. G A
Date City and State
Russell G. Vineyard
United States Magistrate Judge
Name and Title of Judicial Offi cer
AUS A Gale McKenzi e
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l of 50
AFFIDAVIT
I, Alexandre Herrera, being first duly swom, hereby depose and state as
follows:
INTRODUCTION AND AGENT BACKGROUND
1. I make this affidavit in support of an application under Rule 41 of the
Federal Rules of Criminal Procedure for a warrant authorizing United States Secret
Service and other federal agents to search the premises known as 7900 RI VERTOWN
ROAD, FAI RBURN, GA which includes: (a) a two-story, brick residence with a two-car
garage as a part of the first floor; (b) a two-story, wooden storage building; (c) a one-
story, wooden storage shed; and (d) a white enclosed trailer parked beside the house
(hereinafter, collectively the " SUBJ ECT PREMI SES") , which is ftirther described i n
Attachment A l , for the things described i n Attachment B. This affidavit is also made i n
support of an application for a warrant for the arrest of Gayla St. Julien nee O' Neal
(hereinafter "ST. J ULI EN") . Finally, this affidavit is made i n support of an application to
search two vehicles recently used by ST. J ULI EN, being a 2010 black Chevy Silverado
Truck, GA tag number PHF3074, and a 2013 white Chevy Mal i bu with temporary paper
tag number 11955591 (hereinafter " SUBJ ECT VEHI CLES" ) , which are ftirther
described in Attachment A2, for the things described in Attachment B.
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 2 of 50
2. The facts set forth in the Affi davi t are based on (a) my personal
observations; (b) my training and experience; (c) information obtained from other federal
and state agents, and witnesses including bank investigators, identity theft victims, UPS
store operators, and other persons; and (d) documents and records obtained from these
persons, and from public and other sources. Because your affiant submits this Affi davi t
for the limited purpose of showing probable cause, I have not included each and every
fact that I have leamed in this investigation in this Affi davi t. Additionally, unless
indicated otherwise, all statements and conversations described herein are related in
substance and part only rather than verbatim.
3. Your affiant is a Special Agent with the United States Secret Service
(USSS), and have been since Apr i l of 2011. Your affiant is presently assigned to the
Atlanta Fi el d Office, where I am part of the Counterfeit Squad. You affiant specializes in
the investigation of various financial crimes, including bank fraud, identity theft,
counterfeit currency, and other offenses. Your affiant is a graduate of Pepperdine
University where I received a Bachelor' s Degree. You affiant is also a graduate of the
Federal Law Enforcement Training Center i n Glynco, GA and the United States Secret
Service's James J. Rowley Training Center i n Beltsville, MD. At these facilities, your
affiant underwent a seven month training program that addressed investigation techniques
and other matters.
2
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 3 of 50
4. In connection witii official duties, your affiant investigates criminal
violations of various federal fraud and financial related offenses, including violations of
Title 18, United States Code, Sections 641, 1028A, 1341, 1343, 1344, 1349, 1956, and
1957. I have received training, both formal and informal on-the-job, in the enforcement
of the theft of and fraud laws related to the illegal possession, forgery, and negotiation of
U. S. Treasury Checks, identity theft, counterfeiting, undercover operations, interviewing
techniques, and the use of surveillance. I am familiar with and have used many of the
traditional methods of investigation, including, without limitation, visual surveillance,
electronic surveillance, informant and witness interviews, consensually recorded
telephone conversations, defendant debriefings, the use of confidential sources,
undercover operations, examination of bank and financial documents, execution of search
warrants, the seizure of U. S. Treasury Check fraud evidence, and controlled purchases of
fraudulently obtained U. S. Treasury Checks and counterfeit currency.
5. Your affiant has investigated more than thirty (30) U. S. Treasury Check
cases and participated in many more i n which traditional methods of investigation were
used to identify suspects and gather evidence for crimes connected with the forgery, theft,
possession, negotiation, and laundering of the illegally obtained funds. Your affiant has
also been involved in at least one investigation in which the criminal quickly destroyed,
concealed, and/or disposed of the items used to further the fraudulent scheme when it was
3
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 4 of 50
believed by the criminal their actions had attracted the attention of law enforcement
organizations.
FACTUAL PATTERN OF SIMILAR FRAUD SCHEMES
6. Based upon training and experience, your affiant is familiar with the ways in
which criminals involved in U. S. Treasury Check and other check frauds conduct their
business, including the various ways they obtain stolen and fraudulent U. S. Treasury
Checks, distribute the U. S. Treasury Checks, negotiate the U. S. Treasury Checks, and
use cellular telephones and computer devices to facilitate their criminal activity. For
instance, I know that criminals involved in the negotiation of stolen U. S. Treasury
Checks and other stolen checks often use a stolen identity of a victim to set up false
company names by fi l i ng with the GA Secretary of State, to appear that the company
name is a legitimate operating business. They wi l l often use the stolen identity to pose as
the owner of the "shell" companies they set up, which in fact does not conduct legitimate
business, and then they wi l l open a bank account i n the false company name with the
stolen identity. Often they wi l l use a manufactured counterfeit driver's license with the
stolen identity infonnation and a picture of themselves to set up the false business and
open the fraudulent bank account. Once the fraudulent bank account is opened, they wi l l
negotiate the stolen U. S. Treasury Check or other stolen and fraudulent checks through
the account. Once the funds are available, they wi l l withdraw the fiinds directly from the
4
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 5 of 50
account, or often wire transfer tiie fimds to anotiier fraudulent bank account to later be
withdrawn.
7. Often the criminals wi l l open and use UPS mailboxes, or the like, i n the
name of a stolen identity with a counterfeit or fraudulently obtained driver's license to
receive mail related to the bank and stolen check fraud. Many times the mailbox is used
as the address for the fraudulent bank account they set up to commit the check fraud.
They wi l l use the fraudulent mailbox in the stolen identity name to fiirther the scheme
and to avoid detection of their tme identity by law enforcement.
8. You affiant also knows that criminals wi l l often store bank documents, false
company and fraudulent bank account records, stolen U. S. Treasury Checks, other stolen
and fraudulently obtained checks, and counterfeit and fraudulently obtained driver's
licenses and other fraudulent identification documents at their residence, as hard copies
and/or on computer storage devices including computer hard drives, smart phones, and
media storage devices. Your affiant also knows that criminals involved with stolen
identities and stolen and fraudulently obtained U. S. Treasury Checks and other stolen
items ordinarily have scheme documentation in their vehicles as they travel to offsite
locations: to meet with purchasers and providers of the stolen and fraudulently obtained
U. S. Treasury Checks, stolen identities, and counterfeit driver's licenses; and to execute
the fraud at various financial institutions. I know that criminals that set up fraudulent
5
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 6 of 50
bank accounts to negotiate fraudulent and stolen checks, ordinarily drive to the financial
institutions to deposit the stolen items and to withdraw the illicit funds i n cash or other
form of payment. I know that when the criminals drive to the financial institution to
conduct their fraudulent bank activities they ordinarily have the counterfeit driver's
license on them i n a typical place like a wallet or a purse that someone would keep their
genuine driver's license; in order to appear more legitimate and ordinary when they
present the counterfeit driver's license to the financial institution or mailbox provider.
9. Criminals also use cellular phones regularly to make deals while obtaining
stolen checks and identities. Your affiant knows criminals wi l l often possess multiple
cellular phones with false information i n order to distance themselves from one specific
number that may be traced to their true identity or location, i n an attempt to avoid
detection from law enforcement. Criminals wi l l also use multiple cell phones to further
their fraud scheme so that, for instance, when a bank calls the phone number listed on a
fraudulent bank account the criminal wi l l know which identity they are supposed to
impersonate when answering that particular phone. In at least one instance in a similar
investigation, the criminal wi l l actually tape the name of the stolen identity to the back of
the cell phone so that they remember what identity they are supposed to impersonate
when answering it.
6
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 7 of 50
10. The U. S. Treasury distributes hinds to payees for many agencies and
departments including checks for IRS tax retums, Veterans Affai rs, Social Security
payments, HUD payments, and federal retirement savings checks (TSP). When these
payments are mailed i n the form of U. S. Treasury Checks, which they often are, the
checks are distributed through the U. S. Postal Service. In some cases, the U. S. Treasury
Checks are intercepted i n the mail and subsequently distributed to other criminals who
attempt to negotiate them for illicit profit. The criminals often times negotiate the stolen
checks at financial institutions into bank accounts they open i n the name of a stolen
identity and victim. The criminals are often times successfiil i n depositing the U. S.
Treasury Checks, and also successfial in withdrawing the fiinds from the fraudulent bank
accounts before the financial institution is aware that fraud has been committed. When a
payee does not receive their rightfiil U. S. Treasury Check in the mail, they submit a
request for a replacement check to the U. S. Govemment. And after some time, possibly
several months, reclamation to recover the funds from the negotiated stolen U. S.
Treasury Check is sent from the U. S. Treasury to the victim financial institution. The
financial institution is often first aware that the U. S. Treasury Check was stolen and
fraudulently negotiated when the reclamation is received by them from the U. S. Treasury,
or i f law enforcement advises that the bank account is fraudulent and opened with a
stolen identity.
7
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 8 of 50
THE PREDICATE OFFENSES
11. Chiefly, your affiant is seeking fruits, evidence and instrumentalities of
violations of federal criminal offenses, as further described below, including: Title 18,
United States Code, Section 641 (embezzlement, theft and conversion of public money);
Title 18, United States Code, Section 1028(A) (aggravated identity theft); Title 18,
United States Code, Section 1341 (mail fraud); Title 18, United States Code, Section
1343( wire fraud); Title 18, United States Code, Section 1344 (bank fraud); Title 18,
United States Code, Section 1349 (conspiracy); and Title 18, United States Code,
Sections 1956 and 1957 (money laundering).
THE SUBJECT PREMISES
12. The SUBJ ECT PREMI SES comprises of a two-story, single-family brick
house located at 7900 Rivertown Road, Fairbum, GA 30213. The house has a driveway
on the right side of the house from the street view that leads to a two-car garage located
i n the residence on the first floor. The front door is at the center of the house. Al so on
the SUBJ ECT PREMI SES is a two-story, detached wooden storage building to the rear
comer of the house on the property at this same address. In addition, there is one-story,
wooden storage shed building toward the rear of the house on the property at this same
address. Finally, a white enclosed trailer has been observed by law enforcement to be
parked on this property beside the house on most occasions since Apr i l 2013, when
8
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 9 of 50
surveillance was conducted. An undeveloped wooded lot is directly to the left of the
house (when facing the house from the street). The mailbox at the street in front of the
driveway that leads to the house is marked with the numbers 7900. The publically filed
property records show that this property was purchased i n January 2012 by Jeremy St.
Julien, who married ST. J ULI EN in about May 2013. See also. Attachment AI ,
incorporated herein by reference.
PROBABLE CAUSE
FINANCIAL FRAUD, IDENTITY THEFT & MONEY LAUNDERING
13. Al l of the financial institution listed and discussed below, were federally
insured during the time of the frauds detailed herein.
14. In Febmary of 2012, your affiant became involved with the ST. J ULI EN
investigation when an investigator with JP Morgan Chase Bank (JPMC) advised that they
were investigating an unknown black female suspect i n the Atlanta area that used four (4)
bank accounts, opened with two (2) stolen identities of real persons, to coriimit bank and
check fraud. The J PMC bank investigator asked for assistance from the United States
Secret Service-Atlanta Fi el d Office (USSS) to identify the suspect and investigate the
fraudulent activity. Bel ow is a brief summary of the information I received from J PMC
of four (4) of the fraudulent bank accounts:
9
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l0 of 50
15. Two (2) J PMC bank accounts in the name Bobbie L. Cochran were opened
on 10/04/11 in Atlanta, GA by an unknown black female suspect (later identified as ST.
JULI EN) , using the stolen identity of Bobbie L. Cochran. The J PMC bank investigator
provided copies of four (4) fraudulently obtained Texas Comptroller of Public Accounts
checks that were fraudulently negotiated through one of the accounts.
16. Two (2) J PMC bank accounts named North Point Vol vo Inc. were opened
on 02/10/11 i n Orlando, F L by an unknown subject (later identified as ST. JULI EN) ,
using the stolen identity of Li nda G. Smith-Kyle. J PMC provided me with copies of
Twenty-two (22) stolen U. S. Treasury checks, issued to different payees, which were
fraudulently negotiated through the accounts. Although the North Point Vol vo Inc. bank
accounts were opened in Orlando, FL, most of the deposit and withdrawal transactions
were made i n the Atlanta, GA area.
17. The J PMC investigator also provide the supporting bank documents for each
of the four fraudulent accounts opened i n the names of stolen identities including video
surveillance photos of the then unknown suspect who was operating the fraudulent bank
accounts in J PMC bank branches. The unknown suspect in the surveillance photos
appeared to be a middle-aged black female, and was later identified as ST. J ULI EN, as
detailed below.
10
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page ll of 50
18. The J PMC investigator advised that State of Texas investigators were
investigating the same unknown suspect for the negotiation of the fraudulently obtained
Texas Comptroller of Public Accounts checks. J PMC also advised that they had
contacted the real Bobbie L. Cochran and verified that her identity, including her name,
date of birth, and social security number were stolen and used to open the two (2)
fraudulent bank accounts titled in that name. J PMC advised that the unknown suspect
used a T N driver's license with Bobbie L. Cochran's identifiers to open the two accounts,
but the photo was of the unknown black female suspect (later identified as ST. JULI EN) ,
rather than the real Bobbie L. Cochran, a white female living in Montana with a MT
driver's license.
19. Your affiant then contacted Investigator Mark Kubeczka, Texas Comptroller
of Public Accounts, who advised that they have not been able to identify the suspect who
negotiated their stolen checks into the account of Bobbie L. Cochran at J PMC. Inv.
Kubeczka also advised that he contacted the real Bobbie L. Cochran and verified that her
identity was stolen. Inv. Kubeczka advised that the four (4) Texas Comptroller checks
were fraudulently issued checks that were fraudulently negotiated.
20. Your affiant then examined the video surveillance photos provided by J PMC
of the unknown suspect making bank transactions, on different days and bank branches.
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l2 of 50
utilizing the above four (4) accounts. It appeared that all of the photos were of the same
unlmown black female suspect (later identified as ST. JULI EN) .
21. Your affiant then contacted Linda Smith-Kyle, who confirmed her identity
was stolen last year, in 2011. Smith-Kyle advised that she filed a fraud alert with the
three (3) credit bureaus. She also sent me copies of the documents she filed to the credit
bureaus, along with a police report.
22. On 02/21/12, Special Agent Mark Lewis ( USSS/ ATL) and your affiant went
to the address listed on the Bobbie L. Cochran J PMC fraudulent bank accounts, 541 10*
St. NW Ste. 451, Atlanta, GA. The address was a UPS store location. The UPS store
owner advised that they had a mailbox, #451, in that store that was rented in the name
Bobbie L. Cochran. The store owner provided me with the account application
documents for the subject mailbox. The account documents included a photo copy of a
T N driver's license i n the name of Bobbie L. Cochran, including her date of birth and
social security number. The photo on the driver's license (later identified as ST.
JULI EN) matched the appearance of the same black female suspect that was captured in
the video surveillance photos of the above four (4) J PMC fraudulent bank accounts. Al so
included was a photo copy of a GA Motor Vehicle Registration i n the name of Bobbie
Cochran. The store owner advised that Bobbie Cochran was supposed to pick up a
package that was mailed to her mailbox #451 that day. The store owner showed Special
12
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l3 of 50
Agent Lewis and your affiant tlie package. The sender information on the outside of the
package was "State of N. J. Dept. of Treasury, P. O. Box 450, Trenton, NJ 08625". The
package was sealed, however, by exterior observance appeared to contain a stack of
paperwork approximately two (2) inches thick that was paper clipped together.
23. Continuing on 02/21/12, Special Agent Lewis and your affiant observed an
individual enter the UPS store and pick up the package that was mailed to mailbox #451.
The appearance of the individual appeared to be the same unknown black female suspect
i n the video surveillance photos from the aforementioned fraudulent J PMC bank
accounts, and the photo on the T N driver's license copy provided by the UPS store owner
(all soon to be identified as ST. JULI EN) .
24. Continuing on 02/21/12, Special Agent Lewis and your affiant observed the
suspect enter a blue Mercedes-Benz automobile with GA plate CR3919. We followed
the suspect to a Kroger grocery store located at 1160 Moreiand Ave. , Atlanta, GA. We
observed the suspect enter the store and make a purchase at a self-serve automated
register of various grocery items including diapers and food. You affiant used the same
register to make a transaction immediately after the suspect's transaction. Special Agent
Lewis and your affiant then spoke with the Kroger store manager and provided him with
a copy of the receipt from my transaction. The store manager was able to pinpoint the
transaction of the then unknown suspect by utilizing the information on my receipt, and
13
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l4 of 50
we were able to obtain a copy of the transaction details made by the unknown suspect.
The items in the transaction of the suspect were purchased with an EBT Food Stamp
card.
25. On 02/27/12, your affiant contacted Special Agent Robin Wi l cox, United
States Department of Agriculture-OIG, and requested her to provide the account
information of the owner of the EBT card used in the purchase made by the suspect at
Kroger that Special Agent Lewis and your affiant observed on 02/21/12. SA Wi l cox
advised that he EBT card used by the subject at Kroger belonged to:
Gayla O' Neal with date of birth 04/30/1970, and social security number x2532.
26. Continuing on 02/27/12, Criminal Research Specialist (CRS) Joan Kaiser
(USSS) provided your affiant with a copy of the GA driver's license information of
Gayla O' Neal from the GA Department of Driver Services. The photo of Gayla O' Neal
on the GA driver's license matched the suspect in the video surveillance photos from the
aforementioned fraudulent J PMC bank accounts, the photo on the T N driver's license
copy provided by the UPS store owner i n the name of Bobbie Cochran, and the suspect
that Special Agent Lewi s and your affiant observed during our surveillance on 02/21/12.
Records recovered at a later time reveal that Gayla O' Neal married Jeremy St. Julien in
2013. Therefore, she is referred to herein as ST. J ULI EN.
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l5 of 50
FURTHER INVESTIGATION OF ST. JULIEN
27. On 03/30/12, Special Agent Davi d Coffey (USSS) and your affiant went to
the UPS store located at 2897 N. Druid Hi l ls Rd. , Atlanta, GA. The UPS store manager
advised that mailbox #283 was rented by someone using the name Angie Rickman-
Crossan, but it was not in use anymore. The manager also advised that an investigator
named Monty Mohr was investigating the same subject and others last year, and he had
requested mailbox account information. The UPS manager provided your affiant with
mailbox account information of mailbox #283 at 2897 N. Drui d Hi l l s Rd. for Rickman-
Crossan. The information included a copy of a Tennessee driver's license i n the name of
Angie Lee Rickman-Crossan bearing the photo of the suspect now known to be ST.
J ULI EN. The photo on the copy of the T N driver's license matched the same photo on
an AT &T employee ID i n the name of Candace Owens that ST. J ULI EN had provided to
JP Morgan Chase Bank as identification to open fraudulent bank accounts i n the name of
a shell company, Goodwin Automall Inc., using the stolen identity of Candace Owens.
Investigation revealed that both the Rickman-Crossan and the Owens names and personal
identifiers were stolen from real persons.
IDENTITIES STOLEN FROM EQUIFAX AND LEXISNEXIS
28. On 04/04/12, your affiant contacted Monty Mohr. Mohr advised that he was
a criminal investigator with the GA Govemor' s Office of Consumer Protection (GOCP),
15
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l6 of 50
and was actively investigating the same female suspect (now know to be ST. JULI EN)
who had rented the UPS mailbox #283 at 2897 N. Druid Hi l l s Rd. , Atlanta, GA, for
identity theft and fraud involving fraudulently obtaining access to both Equifax and
LexisNexis databases to steal the identities of real persons used by ST. J ULI EN in the
bank fraud schemes described i n this affidavit.
29. In early 2011, Equifax had discovered fraud and closed an account which
had been opened with them in September 2009, in the name of shell company Onyx
Collections & Locator Service and stolen identity Robert Watkins, using UPS box #248
at 931 Monroe Drive as the forwarding address for receipt of Onyx mail. ST. J ULI EN
had previously opened UPS box #248 in the name of Onyx Collections & Locator
Service using the stolen identity of Candace Owens, as detailed below. Before Equifax
discovered the fraud, their database had been accessed by Onyx vi a the intemet to obtain
personal identifiers of hundreds of individuals, including Candace Owens and most of the
stolen identities used by ST. J ULI EN to execute the bank fraud detailed in this affidavit.
The intemet was also used by ST. J ULI EN to apply for fraudulent vehicle loans from
intemet lenders.
30. During this same time period, the LexisNexis database had also been
fraudulently accessed via the intemet, and personal identifiers were received by Onyx on
approximately 300 occasions with Onyx using the same Watkins stolen identity and UPS
16
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l7 of 50
mailbox rented to ST. J ULI EN in the Owens stolen identity. The names with personal
identifiers fraudulently obtained from LexisNexis were also used by ST. J ULI EN and her
conspirators to commit bank and other loan fraud as described herein.
31. In June 2011, after both Equifax and LexisNexis had terminated Onyx' s
access to their databases, Inv. Mohr advised that his agency conducted an undercover
operation on a new shell company named Reliance Recovery and Collections Group Inc.,
which appeared to have been set up to pose as a debt collection type company to again
gain access to Equifax files, and thereby obtain reports which include personal identifiers,
including names, addresses, DOBs, SSNs, employment, and credit histories, and to use
the same to commit fraud.
32. Inv. Mohr advised that, during the undercover operation, one of his
investigators acting as an undercover employee of a vetting company, met with applicant
"Reliance Recovery and Collections Group Inc." owner "Mol l y Prentice" (now identified
as ST. JULI EN) to conduct a site visit. A site visit was required as an Equifax due
diligence measure before Reliance Recovery could be approved to gain access to Equifax
data. The UC agent recorded the site visit with an audio-video device. The female
suspect posing as Mol l y Prentice met with the UC agent for several minutes and signed
documents as Mol l y Prentice i n his presence as he conducted the site visit of her office.
This office space was apparently rented for the Equifax fraud.
17
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l8 of 50
33. The GOCP also took surveillance photos of the female suspect using the
stolen name and personal identifiers of the real Mol l y Prentice, but was then unable to
discover her true identity. Mohr provided your affiant with photos taken during the
undercover operation including face close-up photos and photos of the vehicle driven by
the female suspect. The vehicle was the same Mercedes-Benz car your affiant identified
ST. J ULI EN driving on 02/21/12, with GA plate number CR3919. Your affiant also
identified the GOCP photos and Mohr UC video of their subject as ST. J ULI EN.
34. In May of 2013, Inv. Mohr (GOCP) advised that during an examination of
documents recovered by retrieving abandoned trash from a garbage bin at the street at
7900 Rivertown Rd. (the present residence of ST. JULI EN) , they found paperwork
indicating that Gayla O' Neal was married to Jeremy St. Julien earlier that month and was
now going by the name Gayla Sheila St. Julien.
BANK ACCOUNTS USED FOR FRAUD AND MONEY LAUNDERING
35. During the investigation of ST. J ULI EN from February of 2012 to present,
your affiant has obtained records of many bank accounts operated by ST. J ULI EN as part
of her fraud scheme. ST. J ULI EN used a conspirator as an authorized signor on two of
her bank accounts, although ST. J ULI EN conducted most of the transactions on those
two accounts. Below, i n chronological order, is a list of those accounts with the dates,
bank, shell company name and stolen identities of real persons used to open accounts
18
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l9 of 50
(often obtained from the fraudulent access of Equifax and/or LexisNexis databases,
detailed above), and usually a surveillance photo of ST. J ULI EN conducting one or more
transactions. Your affiant has obtained copies of the bank surveillance photos closely
matching the appearance of ST. J ULI EN for the listed accounts, along with the other
bank records. The stolen names and personal identifiers used by ST. J ULI EN have been
confirmed to belong to real persons by either interviews and/or law enforcement
databases. Multiple bank accounts i n the same stolen identity are listed because ST.
J ULI EN operated more than one account in the same name at the same bank. The total
deposits for each account primarily include stolen U. S. Treasury Checks, stolen corporate
checks, and fraudulently obtained state govemment checks, as well as transfers of scheme
proceeds from the original shell company accounts Opened by ST. J ULI EN i n a stolen
identity to other similar accounts. This list is not comprehensive, and there are more
fraudulent bank accounts that appear to be part of ST. J ULI EN' s fraud scheme.
Dates/Bank/Acct/Stolen ID/Deposits/ Connection to ST. JULIEN
1. 01/12/10 - 06/30/10 / BOA / Bynum Financial Inc. / Tricia A. Dew /
$173,999.89 / bank surveillance photos.
2. 01/12/10 - 06/30/10 / BOA / Bynum Financial Inc. / Tricia A. Dew /
$121,853.59 / bank surveillance photos.
3. 01/12/10 - 12/22/10 / J PMC / Bynum Financial Inc. / Tricia A. Dew /
$140,673.75 / bank surveillance photos from same account with B of A.
19
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 20 of 50
4. 01/12/10 - 12/22/10 / J PMC / Bynum Financial Inc. / Tricia A. Dew /
$198,800.25 / bank surveillance photos from same account with B of A.
5.02/24/10 - 07/12/10 / BOA / Reliance Financial Tax Group Inc. / Kel l y
Willingham / $122,647.86 / bank surveillance photos from same account
with J PMC.
6. 02/24/10 - 07/12/10 / BOA / Reliance Financial Tax Group Inc. / Kel l y
Willingham / $78,015.61 / bank surveillance photos from same account
with J PMC.
7. 02/24/10 - 12/31/10 / J PMC / ReHance Financial Tax Group Inc. / Kel l y
Willingham / $422,200.12 / bank surveillance photos.
8. 02/24/10 - 12/31/10 / J PMC / Reliance Financial Tax Group Inc. / Kel l y
Willingham / $209,660.66 / bank surveillance photos.
9. 07/01/10 - 12/31/10 / J PMC / Goodwin Automall Inc. / Candace Owens /
$99,116.00 / bank surveillance photos from same account with B of A.
10. 07/01/10 - 12/31/10 / J PMC / Goodwin Automall Inc. / Candace Owens /
$69,500.00 / bank surveillance photos from same account with B of A.
11. 07/07/10 - 11/07/11 / BOA / Goodwin AutomaU Inc. / Candace Owens /
$386,110.00 / bank surveillance photos.
12. 07/07/10 - 12/31/10 / BOA / Goodwin Automall Inc. / Candace Owens /
$63,050.00 / bank surveiUance photos.
13. 11/23/10 - 02/05/11 / J PMC / Universal Tax Group Inc. / Angie L.
Rickman-Crossan / $54,510.29 / bank surveillance photos.
14. 02/10/11 - 01/31/12 / J PMC / North Point Vol vo Inc. / Lynda G. Smith-
Kyl e / $238,070.78 / bank surveillance photos.
15. 02/10/11 - 01/31/12 / J PMC / North Point Vol vo Inc. / Lynda G. Smith-
Kyl e / $115,636.89 / bank surveillance photos.
20
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 2l of 50
16. 10/04/11 - 12/13/11 / J PMC / Bobbie L. Cochran / Bobbie L. Cochran /
$30,560.84 / bank surveihance photos.
17. 12/03/11 - 12/30/11 / J PMC / Annie L. Cochran / Capital Tax Strategies
Inc. / $21,050.00 / bank surveillance photos.
18. 01/13/12 - 02/22/12 / J PMC / Mol l y Prentice / Mol l y Prentice / $25.00 /
bank surveillance photos.
19. 01/13/12 - 02/29/12 / J PMC / Reliance Recovery & Collections Group Inc.
/ Mol l y Prentice / $464.13 / bank surveillance photos.
20. 10/18/12 - 04/16/13 / BOA / Signature Tax Collections Inc. / Vanessa
Jackson / $54,250.00 / bank surveillance photos.
21. 05/21/13 - current / SunTrust / Signature Tax Collections Inc. / Vanessa
Jackson / bank surveillance photos.
36. Bel ow is a list of other fraudulent bank accounts that have been identified by
this investigation related to ST. J ULI EN' s fraud scheme. These accounts were also
opened using stolen identities of real persons and shell company names. The primary
factor connecting the below accounts are the checks and wire transfers made between
these accounts and the above listed fraudulent accounts with the ST. J ULI EN
surveillance photos.
22. 12/23/08 - 06/25/12 / J PMC / Jean C. Al l en / Jean C. AUen / $250,200.00 /
Funds moved from this account via checks to other ST. J ULI EN fraud
accounts.
21
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 22 of 50
23. 01/05/10 - 06/30/10 / J PMC / Star Capital Tax Services Inc. / Rebecca J.
Seymour / $63,776.81 / funds moved from this account to other ST.
J ULI EN fraud accounts.
24. 03/09/10 - 06/30/10 / J PMC / Signature Luxury Imports Inc. / Karen
Kennedy / $283,100.00 / funds moved from this account to other ST.
J ULI EN fraud accounts.
25. 07/02/10 - 12/31/10 / J PMC / Upstate Automotive Group Inc. / Apr i l M.
Terry / $57,679.81 / funds moved from this account to other ST. J ULI EN
fraud accounts.
26. 07/02/10 - 12/31/10 / J PMC / Upstate Automotive Group Inc. / Apr i l M.
Terry / $12,585.00 / ftmds moved from this account to other ST. J ULI EN
fraud accounts.
27. 07/02/10 - 12/31/10 / J PMC / Upstate Automotive Group Inc. / Apr i l M.
Terry / $8,545.00 / funds moved from this account to other ST. J ULI EN
fraud accounts.
28. 12/08/10 - 10/05/11 / WF / Jean AUen / Jean AUen / $274,920.10 / fiinds
moved from this account to other ST. J ULI EN fraud accounts.
29. 02/10/11 - 08/10/11 / B OA / Acura Garland Inc. / Lynda Smith-Kyle /
$100.00 / bank surveillance photos of ST. J ULI EN with same stolen
identity used on J PMC fraud account.
30. 02/10/11 - 08/10/11 / B OA / Acura Garland Inc. / Li nda Smith-Kyle /
$100.00 / bank surveiUance photos of ST. J ULI EN with same stolen
identity used on J PMC fraud account.
31. 07/11/11 - 07/31/11 / WF / Jean Al l en / Jean Al l en / $3,819.01 / fiinds
moved from this account to other ST. J ULI EN fraud accounts.
32. 07/11/11 - 08/12/11 / WF / Jean Al l en / Jean Al l en / $9,381.00 / frmds
moved from this account to other ST. J ULI EN fraud accounts.
22
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 23 of 50
33. 05/12/12 - 12/07/12 / Regions / Signature Tax Collections Inc. / Deborah
Kyl e / $8,814.43.86 / bank surveillance photos from same account with
BOA.
34. 10/18/12 - 04/16/13 / BOA / Signature Tax Collections Inc. / Vanessa
Jackson / $54,250.00 / bank surveillance photos.
35. 05/21/13 - to date / SunTrust / Signature Tax Collections Inc. / Vanessa
Jackson / $50,000.00+ / bank surveillance photos from same account with
BOA.
UPS MAILBOXES USED BY ST. JULIEN IN FRAUD SCHEME
37. The following is a list of UPS mailboxes that have been identified by agents
of the USSS and the GOCP as being opened and used by ST. J ULI EN to further her
fraudulent scheme for example, to receive mail sent by the US Postal Service and other
interstate carriers, including bank statements, bank checks, correspondence, and some
fraudulently obtained checks, among other things, as well as the location of at least one
shell company. Application documents for the renter of the following mailboxes were
obtained from the respective UPS store locations. The mailboxes listed here are not a
comprehensive list of UPS mailboxes used during ST. J ULI EN' s schemes, however, they
were all opened by a suspect using a fraudulent driver's license bearing a photo that
appears to be ST. J ULI EN and the stolen name and personal identifiers of a real person,
usually obtained from the fraudulent access to Equifax and/or LexisNexis databases. ST.
23
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 24 of 50
J ULI EN authorized a conspirator to remove items from one of the fr)Ilowing boxes, being
#222.
UPS Store #0458 / 2550 Sandy Plains Rd. / Mai l box #222 / Candace
Owens/08/02/10.
UPS Store #2121 / 931 Monroe Dr. / Mai l box #248 / Candace Owens/
08/17/10.
UPS Store #4322 / 2897 N. Drui d Hi l l s Rd. / Mai l box #283 / Angie
Rickman-Crossan /11/22/10.
UPS Store #2257 / 541 10* St. / Mai l box #451 / Bobbie Cochran /
10/04/11.
UPS Store #1006 / 2625 Piedmont Rd. / Mai l box #119 / Vanessa
Jackson/05/21/12.
VEHI CLE LOAN FRAUD/ ID THEFT/ FINANCIAL INSTITUTION FRAUD
38. According to inft)rmation and records received from the FBI and from BOA,
i n Apr i l 2010, five vehicle loans totaling $277,000 were obtained in stolen names and
personal identities from Campus US A Credit Uni on in FL. The proceeds from these
fraud loans were subsequently deposited into two Atlanta accounts opened at B OA by
ST. J ULI EN: one BOA account i n the shell company Reliance Financial Tax Group and
stolen identity of real person Kel l y Willingham; and another B OA account in shell
company Bynum Financial Inc. and stolen identity of real person Tricia Dew. Thereafter,
24
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 25 of 50
ST. J ULI EN withdrew the proceeds of this vehicle loan fraud from these two BOA
accounts. These ST. J ULI EN accounts are listed above with her connection thereto.
39. In or about February 2011, ST. J ULI EN obtained additional vehicle loan
proceeds totaling approximately $125,000 vi a on line applications submitted to lender.
Up To Drive, i n stolen identities obtained by Onyx' s fraudulent online access of the
Equifax database.
UNCLAI MED PROPERTY FRAUD/ ID THEFT/ BANK FRAUD
40. In September and October 2011, an unknown person used the stolen
identities of four real persons, Bobbie Cochran, Gussie Stanley, Li l l i an Sears, and Susan
Roy, to obtain four checks totaling $30,560 i n unclaimed property funds from the State of
Texas. In October and November 2011, these fraudulently obtained checks were
deposited into the Atlanta account opened by ST. J ULI EN at J PMC i n the stolen Cochran
identity, and the proceeds withdravm soon thereafter. That J PMC account is listed above
with the ST. J ULI EN connection thereto. The state of T X placed these four checks in the
mail and they were eventually transported to Atlanta for deposit as described herein.
ST. JULIEN BACKGROUND
41. According to a NCI C query of ST. J ULI EN, she has prior fraud and identity
theft convictions: Degree Forgery on 05/25/88 i n Fulton County ( GA) and a federal
conviction for Title 18 USC 922(G)(1) (Felon Possession of Firearm), 1028(A)(5) (ID
25
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 26 of 50
Fraud), 1029(A)(3) (Access Device Fraud), and 408(A)(7)(C) ( SSN Number Fraud) on
08/29/03 in tiie U. S. District Court for the District of Nevada. Details of her latest case
are included below, as they show a pattern for some of her recent criminal conduct
described herein which occurred after she was released from custody.
42. Specifically, the FBI advised your affiant that ST. J ULI EN was arrested on
January 10, 2003, at her then residence in Las Vegas, NV, during the execution of a
search warrant by the FBI at her residence. The FBI investigation involved ST. J ULI EN
perpetrating a complex "account takeover" fraud scheme. That scheme involved the
creation of counterfeit payroll business checks on her computer made payable to
purported employees who were, i n fact, the stolen identities of the persons whose account
information she had obtained from a bank employee. She thereafter used fraudulent GA
driver's licenses in the stolen identities of the account holders to cash the counterfeit
"payroll" checks at branches of the purported employees' banks i n GA, A L and other
southem states.
43. During the execution of the search warrant at the ST. J ULI EN residence on
01/10/03, the FBI seized a .357 magnum handgun at her residence. During an interview,
post Miranda Rights advisement and waiver, ST. J ULI EN admitted to agents that the .357
magnum belonged to her. ST. J ULI EN told agents that she purchased the gun using an
alias and stolen Social Security Number. ST. J ULI EN was already at this time a
26
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 27 of 50
convicted felon. ST. J ULI EN also admitted to FBI agents that she fabricated and used
various forms of false identification including, stolen Social Security Numbers, stolen
bank account numbers, stolen names, and other personal identifiers of account holders,
plus various aliases in furtherance of a scheme to cash fraudulent checks i n different parts
of the United States. ST. J ULI EN pled guilty to said scheme i n the District of South
Carolina on a Rule 20 from the District of Nevada.
44. When ST. J ULI EN was released from custody on these 2003 federal
charges, her supervised release was subsequently revoked i n July 2007, for continuing to
negotiate counterfeit payroll business checks in stolen identities in Alabama i n 2005. ST.
J ULI EN served time in A L from 10/1/05 until 3/8/07, when she was released by A L into
federal custody on the supervision release violation warrant. She was released from
federal custody on the supervised release violations on 10/4/07.
45. Upon release from custody, it appears that ST. J ULI EN continued her fraud
scheme i n Atlanta, GA. On 12/23/08, a WA MU account (now J PMC) was opened in the
name of Jean Al l en and approximately $250,000 i n proceeds were withdrawn in checks
deposited into a Jean Al l en account at Wells Fargo Bank (WF). Thereafter, $75,000 from
the WF account was deposited into the BOA account controlled by ST. J ULI EN which
she had opened in shell company Goodwin Automall Inc., using the stolen identity of
Candace Owens as detailed above.
27
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 28 of 50
2013 SURVEI LLANCE OF SUBJECT PREMISES AND VEHI CLES
46. Several surveillances have been conducted on ST. J ULI EN at the SUBJ ECT
PREMI SES and elsewhere by agents of t he USSS and the GOCP since Apr i l of 2013.
On 04/15/13, Special Agent Robin Wi l cox, U. S. Department of Agriculture ( USDA) ,
provided your affiant with updated EBT Food Stamp account information for ST.
J ULI EN. The account was active and the address for ST. J ULI EN was listed as the same
address which is the SUBJ ECT PREMI SES. Most of the recent transaction activity made
with this card revealed purchases made in the local area of the SUBJ ECT PREMI SES.
47. Specifically, the enclosed white trailer has been observed parked beside the
house on this premises, and has remained stationary during most of the law enforcement
observations. The two above-described storage buildings at this address have also been
observed by law enforcement from the public street area.
48. The blue Mercedes-Benz that your affiant observed ST. J ULI EN to be
driving in the past to retrieve items from one of the UPS mailboxes described above and
the GOCP observed ST. J ULI EN to be driving during their undercover operation, has
also been observed parked i n the driveway of the SUBJ ECT PREMI SES on several
different days since Apr i l 2013. ST. J ULI EN has also been observed driving the blue
Mercedes-Benz from her residence to different locations during the day. That Mercedes
was subsequently "totaled" in a June 2013 wreck.
28
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 29 of 50
49. A red 2005 Hummer H2, license tag number PDB9483, has been seen
parked in the driveway oft he SUBJ ECT PREMI SES on multiple days since Apr i l 2013.
The Hummer license plate was also registered in the name of ST. J ULI EN, and she has
been observed driving the Hummer by agents of the GOCP.
50. A black 2010 Silverado Chevy truck, license tag number PHF3074,
registered to ST. J ULI EN' s husband, Jeremy St. Julien, has been seen in the driveway at
the SUBJ ECT PREMI SES as well. ST. J ULI EN has also been seen driving the Chevy
truck by agents of the GOCP during surveillances.
51. On 08/30/13, Inv. Dan Vogt (GOCP) observed a new vehicle parked at the
SUBJ ECT PREMI SES. The vehicle, a 2013 white Chevy Mal i bu, temporary tag number
11955591, is registered to Jeremy St. Juhen. Inv. Vogt (GOCP) also observed ST.
J ULI EN drive the Chevy Mal i bu this same day from her house to a Chevron gas station
nearby.
52. Both the Chevy Silverado and the Mal i bu, are THE VEHI CLES for which a
search warrant is requested to search for items listed i n Attachment B. THE VEHI CLES
are further described in Attachment A2, incorporated herein by reference.
RECENT BK FRAUD, STOLEN ID, MONEY LAUNDERING & ATTEMPT
53. Recent fraudulent activities of ST. J ULI EN include operation of her
fraudulent bank account at SunTrust Bank in the name of shell company. Signature Tax
29
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 30 of 50
Collections Inc., which account is listed above. The stolen identity ST. J ULI EN used to
open and operate this account is in the name Vanessa Jackson. ST. J ULI EN used a
counterfeit driver's license from SC with her picture on it and the personal identifiers of
identity theft victim Vanessa Jackson.
54. In March 2013, an unknown white male i n conjunction with ST. J ULI EN
attempted an "account takeover" fraud, utilizing ST. J ULI EN' s Signature Tax Collections
Inc., account at SunTrust, among others. The unknown male obtained identification in
the stolen identity of true BOA business account holder, Wi l l i am Stanbach, and made
multiple unsuccessful attempts to use the Stanback stolen identifiers to wire transfer a
total of $566,023.55 from Stanbach account proceeds. Two of those attempts were wires
to ST. J ULI EN' s SunTrust account she had opened i n the stolen identity of Vanessa
Jackson and the shell company Signature Tax Collections. This attempted "account
takeover" fraud is similar to the one for which ST. J ULI EN was convicted i n 2003.
55. On 08/22/13, a SunTrust Bank investigator advised Inv. Mohr (GOCP) that
ST. J ULI EN, using the stolen identity of Vanessa Jackson, was i n the teller line at a
SunTrust Bank branch in Atlanta, GA, attempting to withdraw funds from the Signature
Tax Collections Inc. account, but was unsuccessfiil. The SunTmst account had just
received a wire transfer of $25,400.00 from a Wells Fargo bank account in the name of
Ferrari Autohaus, Inc. on 08/22/13. A 9/6/13 search of offi ci al GA Secretary of State
30
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 3l of 50
records revealed no such company. From public records and intemet searches, plus the
personal knowledge of the bank investigator, the address ST. J ULI EN listed for Ferrari
Autohaus, Inc. appears to be a single-story, single-family house with no commercial
business affiliations, and certainly no car lot.
56. On 08/30/13, a Wells Fargo investigator advised that the bank account for
Ferrari Autohaus Inc. had sent a $25,000.00 wire transfer to Signature Tax Collections
Inc. on 07/22/13 and another $25,400.00 wire transfer to the same on 08/22/13.
57. On 08/23/13, a SunTrust investigator advised your affiant that "Vanessa
Jackson" went to another SunTrust Bank branch and successfiilly withdrew $9,500 i n
cash and wire transferred $8,000 from her Signature Tax Collections Inc. account to an
account named Heritage Recovery also in the name of Vanessa Jackson. The SunTrust
bank investigator also advised that they have frozen the remaining funds in the account,
and that "Vanessa Jaclcson" has been calling everyday multiple times to various bank
locations in an attempt to recover those funds
TRASH PULLS AT SUBJECT PREMISES
58. Bel ow are a few of the items of interest that were retrieved by agents oft he
GOCP since May of 2013 from trash pulls at the SUBJ ECT PREMI SES. Al l oft he trash
pulls were conducted by GOCP agents retrieving the trash that was already placed in a
31
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 32 of 50
garbage bin and set at the street next to the mailbox in front oft he SUBJ ECT PREMI SES
on the scheduled garbage collection day of Waste Industries.
GA license plate CR39I 9 (same plate that was observed on Mercedes-Benz
vehicle during prior surveillances of ST. J ULI EN fraudulent activities).
Signature Boutique pay stub for Gayla O' Neal and a receipt for VI SA
account ending in 6908.
Georgia Compass Human Services letter to Gayla O' Neal .
HP PhotoSmart Test page.
Blank Regions checking deposit slip.
Envelope to Sheila St. Julien from Dianne Robinson.
NetlO $50 calling card.
Westem Union money transfer order from Sheila St. Julien to Tara
Williams.
RE Automotive Inc. invoice for Gayla O' Neal .
Wells Fargo transaction receipt for account ending i n 8528.
Letter and receipt for childcare services to Mrs. St. Julien.
Application to plead guilty for Gayla O' Neal.
32
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 33 of 50
Various purchase receipts with credit/debit card accounts ending in 1537,
4638, 4588, 8411, 1992, 3035, 7771, 9574, 6307, 0827, and 1611.
Regions A T M receipt.
Odometer Disclosure statement for 2005 Hummer H2 from K & D Auto Sales
for buyer Gayla O' Neal .
e Federal Credit Union receipt with account balance of $17,370.88.
Wells Fargo transaction receipt for check cash transaction.
Color photograph of young couple appearing at Prom with note on back "To
Gayla, from your Sis, Toya".
iPhone box with identifiers SN#F17KMBFFF8GJ, IMEI# 99000282553125
for iPhone 5, white in color. Model A1429, 16GB.
Regions Bank receipt on account ending in 5825.
Fi ft h Third Bank check renewal slip i n the name of Gayla O' Neal .
T-Mobile Wireless Aircard.
AT &T SI M card: #890114104254778907033.
Pantech AT &T cellphone model: P7040P and S/ N: 114802317135.
Fi ft h Third Bank customer receipt account ending in 9906.
33
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 34 of 50
Empty Office Depot box for Home Office and Business Check Writing Suite
software.
HP printer Status Report and Set-Up instmctions.
Multiple prescription pi l l bottles i n the name of Gayla O' Neal .
59. Based on the above information, Affiant beheves G A Y L A ST. J ULI EN
committed acts in violation of Ti t l e 18 U. S. C. Sections 641, 1028(A), 1341, 1343, 1344,
1349, 1956 and 1957.
TECHNI CAL TERMS
60. Based on training and experience, your affiant uses the following technical
terms to convey the following meanings:
a. Intemet: The Intemet is a global network of computers and other
electronic devices that communicate with each other. Due to the
stmcture of the Intemet, connections between devices on the Intemet
often cross state and intemational borders, even when the devices
communicating with each other are in the same state.
b. Storage medium: A storage medium is any physical object upon
which computer data can be recorded. Examples include hard disks,
floppy disks, flash memory, CD- ROMs , and several other types of
magnetic or optical media not listed here.
34
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 35 of 50
COMPUTERS, ELECTRONI C STORAGE, AND FORENSIC ANALYSIS
6 L As described above and in Attachment B, this application seeks permission
to search for records that might be found on the SUBJ ECT PREMI SES and the
VEHI CLES, i n whatever form they are found. Among other forms, records might be
found in data stored on a laptop computer hard drive, desktop computer hard drive, discs,
CDs, USB thumb or flash drives, cellular phone, or other storage media. Thus, the
warrant applied for would authorize the seizure of electronic storage media or,
potentially, the copying of electronically stored information, all under Rule 41(e)(2)(B).
62. I submit that i f a computer or storage medium is found on the SUBJ ECT
PREMI SES or VEHI CLES, there is probable cause to believe records containing
evidence of a crime related to Title 18, United States Code, Section 641, 1028(A), 1341,
1343, 1344, 1349, 1956, and 1957 would be found on that computer or storage medium,
for at least the following reasons:
a. Based on my knowledge, training, and experience, your affiant knows
that computer files or remnants of such files can be recovered months
or even years after they have been downloaded onto a storage
medium, deleted, or viewed via the Intemet. Electronic files
downloaded to a storage medium can be stored for years at little or no
cost. Even when files have been deleted, they can be recovered
months or years later using forensic tools. This is so because when a
person "deletes" a file on a computer, the data contained i n the file
35
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 36 of 50
does not actually disappear; rather, that data remains on the storage
medium until it is overwritten by new data.
b. Therefore, deleted fdes, or reronants of deleted files, may reside in
free space or slack space^that is, i n space on the storage medium that
is not currently being used by an active file^^for long periods of time
before they are overwritten, hi addition, a computer's operating
system may also keep a record of deleted data in a "swap" or
"recovery" file.
c. Whol l y apart from user-generated files, computer storage mediain
particular, computers' intemal hard drivescontain electronic
evidence of how a computer has been used, what it has been used for,
and who has used it. To give a few examples, this forensic evidence
can take the form of operating system configurations, artifacts from
operating system or application operation, file system data stmctures,
and virtual memory "swap" or paging files. Computer users typically
do not erase or delete this evidence, because special software is
typically required for that task. However, it is technically possible to
delete this information.
d. Similarly, files that have been viewed via the Intemet are sometimes
automatically downloaded into a temporary Intemet directory or
"cache."
e. Based upon information discovered during this investigation,
computer devices were used to access the intemet to illicitly gather
information to steal identities and commit fraud using those identities.
Al so, a computer device was used to access online bank accounts that
have been identified to be fraudulently obtained and used by ST.
J ULI EN. ST. J ULI EN has also used multiple counterfeit driver's
licenses with a photo of herself and the stolen identifiers of victims on
them to commit fraud. In my training and experience, I believe it is
very likely that the counterfeit driver's licenses were made using a
36
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 37 of 50
computer device. Accordingly, I believe there is probable cause that
ST. J ULI EN has possession of a computer device that has been used
to fiirther her fraudulent activities at the SUBJ ECT PREMI SES and
VEHI CLES.
fi In 2003, the FBI search ofher Las Vegas premises and statements by
ST. J ULI EN revealed that she was using her computer to create
counterfeit payroll business checks, among other things, as detailed
above.
63. As further described i n Attachment B, this application seeks permission to
locate not only computer files that might serve as direct evidence of the crimes described
on the warrant, but also for forensic electronic evidence that establishes how computers
were used, the purpose of their use, who used them, and when. There is probable cause
to believe that this forensic electronic evidence wi l l be on any computer or storage media
i n the SUBJ ECT PREMI SES and/or VEHI CLES because:
a. Data on the storage medium can provide evidence of a file that was
once on the storage medium but has since been deleted or edited, or of
a deleted portion of a file (such as a paragraph that has been deleted
from a word processing file). Virtual memory paging systems can
leave traces of information on the storage medium that show what
tasks and processes were recently active. Web browsers, e-mail
programs, and chat programs store configuration information on the
storage medium that can reveal information such as online nicknames
and passwords. Operating systems can record additional information,
such as the attachment of peripherals, the attachment of USB flash
storage devices or other extemal storage media, and the times the
computer was i n use. Computer file systems can record information
37
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 38 of 50
about the dates files were created and the sequence in which they were
created.
b. Forensic evidence on a computer or storage medium can also indicate
who has used or controlled the computer or storage medium. This
"user attribution" evidence is analogous to the search for "indicia of
occupancy" while executing a search warrant at a residence. For
example, registry information, configuration files, user profiles, e-
mail, e-mail address books, "chat," instant messaging logs,
photographs, the presence or absence of malware, and correspondence
(and the data associated with the foregoing, such as file creation and
last-accessed dates) may be evidence of who used or controlled the
computer or storage medium at a relevant time.
c. A person with appropriate familiarity with how a computer works can,
after examining this forensic evidence i n its proper context, draw
conclusions about how computers were used, the purpose of their use,
who used them, and when.
d. The process of identifying the exact files, blocks, registry entries,
logs, or other forms of forensic evidence on a storage medium that are
necessary to draw an accurate conclusion is a dynamic process. While
it is possible to specify in advance the records to be sought, computer
evidence is not always data that can be merely reviewed by a review
team and passed along to investigators. Whether data stored on a
computer is evidence may depend on other information stored on the
computer and the application of knowledge about how a computer
behaves. Therefore, contextual information necessary to understand
other evidence also falls within the scope of the warrant.
e. Further, i n finding evidence of how a computer was used, the purpose
of its use, who used it, and when, sometimes it is necessary to
establish that a particular thing is not present on a storage medium.
For example, the presence or absence of counter-forensic programs or
38
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 39 of 50
anti-vims programs (and associated data) may be relevant to
establishing the user's intent.
64. In most cases, a thorough search of a premises or vehicles for information
that might be stored on storage media often requires the seizure of the physical storage
media and later off-site review consistent with the warrant. In lieu of removing storage
media from the premises, it is sometimes possible to make an image copy of storage
media. Generally speaking, imaging is the taking of a complete electronic picture of the
computer's data, including all hidden sectors and deleted files. Either seizure or imaging
is often necessary to ensure the accuracy and completeness of data recorded on the
storage media, and to prevent the loss of the data either from accidental or intentional
destruction. This is tme because of the following:
a. The time required for an examination. As noted above, not all
evidence takes the form of documents and files that can be easily
viewed on site. Analyzing evidence of how a computer has been
used, what it has been used for, and who has used it requires
considerable time, and taking that much time on premises could be
unreasonable. As explained above, because the warrant calls for
forensic electronic evidence, it is exceedingly likely that it wi l l be
necessary to thoroughly examine storage media to obtain evidence.
Storage media can store a large volume of information. Reviewing
that information for things described i n the warrant can take weeks or
months, depending on the volume of data stored, and would be
impractical and invasive to attempt on-site.
39
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 40 of 50
b. Technical requirements. Computers can be configured in several
different ways, featuring a variety of different operating systems,
application software, and configurations. Therefore, searching them
sometimes requires tools or knowledge that might not be present on
the search site. The vast array of computer hardware and software
available makes it difficult to know before a search what tools or
knowledge wi l l be required to analyze the system and its data on the
Premises. However, taking the storage media off-site and reviewing it
i n a controlled environment wi l l allow its examination with the proper
tools and knowledge.
c. Variety of forms of electronic media. Records sought under this
warrant could be stored in a variety of storage media formats that may
require off-site reviewing with specialized forensic tools.
65. Based on the foregoing, and consistent with Rule 41(e)(2)(B), when persons
executing the warrant conclude that it would be impractical to review the media on-site,
the warrant applied for would permit seizing for later imaging and search without
additional warrants for said searches, or imaging storage media on site, that reasonably
appear to contain some or all of the evidence described in the warrant, thus permitting its
later examination consistent with the warrant. The examination may require techniques,
including but not limited to computer-assisted scans of the entire medium, that might
expose many parts of a hard drive to human inspection in order to determine whether it is
evidence described by the warrant.
40
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 4l of 50
CONCLUSION
66. Based upon the facts detailed above, there exists probable cause to beheve
that within the SUBJ ECT PREMI SES and the VEHI CLES, there exists evidence, fruits
and instrumentalities of violations of Title 18, United States Code, Sections 641,
1028(A), 1341, 1343, 1344, 1349, 1956 and 1957 ; as weh as probable cause for the
arrest of G A Y L A ST. J ULI EN nee O' NEAL.
41
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 42 of 50
ATTACHMENT A l
PREMISES TO BE SEARCHED
7900 Rivertown Road, Fairburn, GA 3 0213
The premises known as 7900 RIVERTOWN ROAD, FAIRBURN, GA
30213 i n c l u d e s : (a) a two-story, b r i c k residence w i t h a two-car
garage as a p a r t of the f i r s t f l o o r ; (b) a two-story, wooden
storage b u i l d i n g ; (c) a one-story, wooden storage shed; and (d)
a white enclosed t r a i l e r parked beside the house ( h e r e i n a f t e r,
c o l l e c t i v e l y the "SUBJECT PREMISES"). The SUBJECT PREMISES i s a
two-story, s i n g l e - f a m i l y b r i c k house l o c a t e d at 7900 Rivertown
Road, Fairburn, GA 30213. The house has a driveway on the r i g h t
side of the house from the s t r e e t view that leads to a two-car
garage l o c a t e d i n the residence on the f i r s t f l o o r . The f r o n t
door i s at the center of the house. Also a p a r t of the SUBJECT
PREMISES at t h i s address i s a two-story, detached wooden storage
b u i l d i n g and a one-story, wooden storage shed both toward the
r e a r of the house, plus a white enclosed t r a i l e r parked beside
the house. An undeveloped wooded l o t i s d i r e c t l y to the l e f t of
the house when f a c i n g the house from the s t r e e t . The mailbox at
the s t r e e t i n f r o n t of the driveway that leads to the house i s
marked w i t h the numbers 7900. A recent photo of the SUBJECT
PREMISES i s a part of t h i s attachment.
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 43 of 50
7 foo / ^ , V e r f o K / A id.
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 44 of 50
ATTACHMENT A2
PREMISES TO BE SEARCHED
Known as "VEHICLES"
The VEHICLES to be searched are a white 2013 Chevy Malibu
with temporary tag number 11955591, and a black 2010 Chevy
S i l v e r a d o truck, l i c e n s e p l a t e number PHF3074, i n c l u d i n g any
closed and/or locked compartments and containers t h e r e i n .
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 45 of 50
ATTACHMENT B
The f o l l o w i n g items to be seized, whether hard copies or
e l e c t r o n i c a l l y stored, c o n s i s t of evidence, contraband, f r u i t s ,
and i n s t r u m e n t a l i t i e s of c r i m i n a l v i o l a t i o n s of T i t l e 18 U.S.C.
641 (embezzlement, t h e f t and conversion of p u b l i c money) ,
1028(A) (aggravated i d e n t i t y t h e f t ) , 1341 (mail fraud), 1343
(wire fraud) , 1344 (bank fraud) , 1349 (conspiracy) and 1956 and
1957 (money laundering).
(a) . Personal and business bank and c r e d i t card statements,
bank account numbers, c r e d i t card numbers, account passwords,
check books, deposit s l i p s , withdrawal s l i p s , canceled checks,
cashier's checks, wire t r a n s f e r advices, ATM r e c e i p t s , c r e d i t
and debit cards, charge s l i p s , safe deposit box r e n t a l s and
keys, c o u n t e r f e i t checks, cash, money orders, pay stubs, and any
items and documentation r e l a t i n g to any and a l l ST. JULIEN
assets, or r e f l e c t s t o l e n and other i d e n t i t i e s used to obtain
and launder fraud proceeds.
(b) . Jewelry and other luxury items purchased w i t h scheme
proceeds.
(c) . Any and a l l information r e l a t i n g to i d e n t i t i e s of
others and a l l i d e n t i f i c a t i o n documents i n c l u d i n g , but not
l i m i t e d t o , o r i g i n a l s or copies of d r i v e r s l i c e n s e s , whether
complete or p a r t i a l l y made, photographs f o r d r i v e r s l i c e n s e s ,
s o c i a l s e c u r i t y cards, s o c i a l s e c u r i t y numbers, b i r t h
c e r t i f i c a t e s , u t i l i t y b i l l s , employee and other i d e n t i f i c a t i o n
documents, c r e d i t reports, LexisNexis r e p o r t s , and any hand
w r i t t e n or e l e c t r o n i c a l l y stored notes of the personal
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 46 of 50
i d e n t i f i e r s of others.
(d) . A p p l i c a t i o n s with supporting documents i n names of Onyx
C o l l e c t i o n & Locator Service, Reliance Recovery and C o l l e c t i o n s ,
and any other a p p l i c a t i o n s f o r access to Equifax, LexisNexis and
any other c r e d i t r e p o r t i n g or data c o l l e c t i o n databases, and
correspondence r e l a t e d thereto.
(e) . Documents r e l a t i n g to the r e n t a l of any storage u n i t s ,
post o f f i c e boxes, UPS boxes. Federal Express accounts and
addresses, other "mail drop" l o c a t i o n s , v i r t u a l and other
o f f i c e s , present and p r i o r residence addresses; a l l records,
i n c l u d i n g but not l i m i t e d t o , packing s l i p s , correspondence, and
address l a b e l s , of anything sent to or receive d by or through
such addresses, and a l l contents thereof.
(f) . Records of a l l past and present ST. JULIEN addresses,
whether i n ST. JULIEN name, a l i a s name, s t o l e n i d e n t i t i e s , or
company names.
(g) . Any and a l l devices and other items used to make
c o u n t e r f e i t checks, f a l s e i d e n t i f i c a t i o n , or other unauthorized
access devices, i n c l u d i n g but not l i m i t e d t o, computers,
p r i n t e r s , copy machines, scanners, cameras, memory cards, smart
phones, check c r e a t i o n software, check paper, blank p l a s t i c
cards, c r e d i t card skimmers and re-encoders, and a l l media
storage devices used f o r such purposes.
(h) Any and a l l devices and other items used to access bank
accounts, c r e d i t accounts, and database information i n c l u d i n g
but not l i m i t e d to smart phones, computers, and t a b l e t s
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 47 of 50
(i) A p p l i c a t i o n s f o r v e h i c l e or other loans with supporting
documents (eg., W2s, 1099s, pay stubs, pay checks, employment
v e r i f i c a t i o n s , bank statements, and tax r e t u r n s ) , v e h i c l e t i t l e s
and r e g i s t r a t i o n s , borrower/purchasers' d r i v e r ' s l i c e n s e s ,
s o c i a l s e c u r i t y cards, r e c e i p t and dispossession of loan
proceeds, c o l l e c t i o n s and other correspondence with lenders and
others.
( j ) . Records of a l l car, mortgage, and c r e d i t card payments.
(k). C e l l and other phone usage and b i l l i n g records.
(1) . Any f e d e r a l or s t a t e government issued checks, and
r e c e i p t and d i s p o s i t i o n records f o r such checks.
(m) . A p p l i c a t i o n s with supporting documentation p e r t a i n i n g
to EBT Food Stamp cards/program, EBT food stamp cards, account
statements, records of food stamp r e c e i p t and usage, updated i n
s t a t u s , correspondence, and any other m a t e r i a l r e l a t e d to food
stamps.
(n). Names, p h y s i c a l addresses, email addresses, SSNs, DOBs,
telephone numbers, contact l i s t s , and photographs of
c o n s p i r a t o r s , other associates, and i d e n t i t y t h e f t v i c t i m s ,
whether hand w r i t t e n notes or hard copy books or stored
e l e c t r o n i c a l l y on computers, t a b l e t s , smart phones, or other
e l e c t r o n i c storage devices.
(o). Travel records of ST. JULIEN and c o n s p i r a t o r s , i n t h e i r
own names or i n s t o l e n i d e n t i t i e s , i n c l u d i n g a i r , or otherwise;
records of a l l car r e n t a l s and payments.
(p) . Opened E-mails, text messages, v o i c e mails, and any
other correspondence and contacts w i t h c o n s p i r a t o r s , lenders.
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 48 of 50
f i n a n c i a l i n s t i t u t i o n s , c r e d i t r e p o r t i n g agencies, data s e r v i c e
companies, and vendors of database s e r v i c e s .
(q) . Any w a l l or f l o o r safes, b r i e f c a s e s , or other locked
containers or compartment on the SUBJECT PREMISES Or i n the two
VEHICLES and any GPS records t h e r e i n .
(r) . A p p l i c a t i o n s w i t h O f f i c e s of the Secretary of States
f o r the i n c o r p o r a t i o n , formation, and/or r e a c t i v a t i o n of
companies, a r t i c l e s of i n c o r p o r a t i o n , annual f i l i n g s , company
addresses, d i r e c t o r , o f f i c e r and employee names, and a l l
t r a n s a c t i o n s conducted i n such company names.
(s). Paper Shredder and any shredded m a t e r i a l .
(t) . Desktop Computers, Laptop Computers, t a b l e t s , smart
phones, other c e l l phones, PDA's, and p e r i p h e r a l devices, such
as modems, a c o u s t i c couplers, d i r e c t l i n e couplers, CRT
t e r m i n a l s , keyboards, p r i n t e r s , i n t e r n a l or e x t e r n a l d i s k
d r i v e s , and other input/output medium; magnetic media, i n c l u d i n g
but not l i m i t e d to magnetic tapes, d i s k s , p e r i p h e r a l i n t e r f a c e
boards, a l l output produced by or cause to be produced by a
computed, i n c l u d i n g p r i n t e r output, t e l e t y p e output or other
o f f i c e equipment output, a l l of s a i d devices to the seized and,
t h e r e a f t e r l a t e r searched, i f time c o n s t r a i n t s and other
c o n s i d e r a t i o n s are not conducive to o n s i t e searches.
(u). Further, due to the f a c t that some or a l l of the above-
described record may be stored by means of computerized
i n f o r m a t i o n system, the items and m a t e r i a l s to be seized and
searched s h a l l i n c l u d e :
(1) . Any and a l l information and/or data stored i n the
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 49 of 50
form of magnetic or e l e c t r o n i c coding on computer media or on
media capable of being read by a computer or w i t h the a i d of
computer r e l a t e d equipment. This media includes floppy
d i s k e t t e s , CD's, CD ROMS, magnetic tapes, f i x e d hard d r i v e s ,
f l a s h d r i v e s , hard d i s k e t t e s , video c a s s e t t e s , and a l l other
media which are capable of s t o r i n g e l e c t r o n i c memory or magnetic
coding.
(2) . Any and a l l e l e c t r o n i c devices which are capable of
analyzing, c r e a t i n g , d i s p l a y i n g , converting, or t r a n s m i t t i n g
e l e c t r o n i c or magnetic computer impulses or data. These devices
include computers, computer components, computer p e r i p h e r a l s
word processing equipment, modems, monitors p r i n t e r , p l o t t e r s ,
encryption c i r c u i t boards, o p t i c a l scanners, e x t e r n a l hard
d r i v e s and other computer r e l a t e d devices.
Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 50 of 50

Anda mungkin juga menyukai