0 penilaian0% menganggap dokumen ini bermanfaat (0 suara)
13K tayangan50 halaman
Gayla St. Julien, the women who alleges that The Real Housewives of Atlanta husband, Apollo E. Nida is her partner in crime.
These are her court documents which may answer questions to the charges pending against Apollo.
Gayla St. Julien, the women who alleges that The Real Housewives of Atlanta husband, Apollo E. Nida is her partner in crime.
These are her court documents which may answer questions to the charges pending against Apollo.
Gayla St. Julien, the women who alleges that The Real Housewives of Atlanta husband, Apollo E. Nida is her partner in crime.
These are her court documents which may answer questions to the charges pending against Apollo.
V. CRIMINALCOMPLAINT G A Y L A SHEI LA ST. J UL I AN nee O' NE AL C AS E NUMB E R : l:13-mj-1290 I, A L E X A N D R E HE RRE RA, the undersigned complainant being duly swom state the following is true and correct to the best of my knowledge and belief. From i n or about 2010 to date, i n Fulton County, elsewhere i n the Northem District of Georgia, the defendant(s) did, Track Statutory Language of Offense) knowingly and wi l f ul l y execute and attempt to execute a scheme to defraud federally insured financial institutions by depositing stolen and fraudulently obtained checks and fraudulently obtained auto loan proceeds into bank accounts opened in the stolen identities of real persons, and launder scheme proceeds through other accounts also opened i n stolen identities of real persons, often using the mails, other interstate carriers, and interstate wire communications to obtain the stolen names and personal identifiers used to execute said scheme to defraud; and conspire with others to do so; and knowingly convert to her use and the use of others over half a mi l l i on dollars i n stolen and fraudulently obtained United States Treasury Checks, in violation of Title 18 United States Code, Sectionfs) 641.1028 (A). 1341.1343.1344.1349.. 1956. and 1957. I further state that I am a(n) Special Agent of the United States Secret Service and that this complaint is based on the following facts: SEE A T T A C H E D AFFI DAVI T Continued on the attached sheet and made a part hereof. ( X) Yes ( ) No Signature of Complainant Alexandre Herrera Based upon this complaint, this Court finds that there is probable cause to believe that an offense has been committed and that the defendant has committed it. Swom to before me, and subscribed i n my presence September 10.2013 at Atlanta. G A Date City and State Russell G. Vineyard United States Magistrate Judge Name and Title of Judicial Offi cer AUS A Gale McKenzi e Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l of 50 AFFIDAVIT I, Alexandre Herrera, being first duly swom, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application under Rule 41 of the Federal Rules of Criminal Procedure for a warrant authorizing United States Secret Service and other federal agents to search the premises known as 7900 RI VERTOWN ROAD, FAI RBURN, GA which includes: (a) a two-story, brick residence with a two-car garage as a part of the first floor; (b) a two-story, wooden storage building; (c) a one- story, wooden storage shed; and (d) a white enclosed trailer parked beside the house (hereinafter, collectively the " SUBJ ECT PREMI SES") , which is ftirther described i n Attachment A l , for the things described i n Attachment B. This affidavit is also made i n support of an application for a warrant for the arrest of Gayla St. Julien nee O' Neal (hereinafter "ST. J ULI EN") . Finally, this affidavit is made i n support of an application to search two vehicles recently used by ST. J ULI EN, being a 2010 black Chevy Silverado Truck, GA tag number PHF3074, and a 2013 white Chevy Mal i bu with temporary paper tag number 11955591 (hereinafter " SUBJ ECT VEHI CLES" ) , which are ftirther described in Attachment A2, for the things described in Attachment B. Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 2 of 50 2. The facts set forth in the Affi davi t are based on (a) my personal observations; (b) my training and experience; (c) information obtained from other federal and state agents, and witnesses including bank investigators, identity theft victims, UPS store operators, and other persons; and (d) documents and records obtained from these persons, and from public and other sources. Because your affiant submits this Affi davi t for the limited purpose of showing probable cause, I have not included each and every fact that I have leamed in this investigation in this Affi davi t. Additionally, unless indicated otherwise, all statements and conversations described herein are related in substance and part only rather than verbatim. 3. Your affiant is a Special Agent with the United States Secret Service (USSS), and have been since Apr i l of 2011. Your affiant is presently assigned to the Atlanta Fi el d Office, where I am part of the Counterfeit Squad. You affiant specializes in the investigation of various financial crimes, including bank fraud, identity theft, counterfeit currency, and other offenses. Your affiant is a graduate of Pepperdine University where I received a Bachelor' s Degree. You affiant is also a graduate of the Federal Law Enforcement Training Center i n Glynco, GA and the United States Secret Service's James J. Rowley Training Center i n Beltsville, MD. At these facilities, your affiant underwent a seven month training program that addressed investigation techniques and other matters. 2 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 3 of 50 4. In connection witii official duties, your affiant investigates criminal violations of various federal fraud and financial related offenses, including violations of Title 18, United States Code, Sections 641, 1028A, 1341, 1343, 1344, 1349, 1956, and 1957. I have received training, both formal and informal on-the-job, in the enforcement of the theft of and fraud laws related to the illegal possession, forgery, and negotiation of U. S. Treasury Checks, identity theft, counterfeiting, undercover operations, interviewing techniques, and the use of surveillance. I am familiar with and have used many of the traditional methods of investigation, including, without limitation, visual surveillance, electronic surveillance, informant and witness interviews, consensually recorded telephone conversations, defendant debriefings, the use of confidential sources, undercover operations, examination of bank and financial documents, execution of search warrants, the seizure of U. S. Treasury Check fraud evidence, and controlled purchases of fraudulently obtained U. S. Treasury Checks and counterfeit currency. 5. Your affiant has investigated more than thirty (30) U. S. Treasury Check cases and participated in many more i n which traditional methods of investigation were used to identify suspects and gather evidence for crimes connected with the forgery, theft, possession, negotiation, and laundering of the illegally obtained funds. Your affiant has also been involved in at least one investigation in which the criminal quickly destroyed, concealed, and/or disposed of the items used to further the fraudulent scheme when it was 3 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 4 of 50 believed by the criminal their actions had attracted the attention of law enforcement organizations. FACTUAL PATTERN OF SIMILAR FRAUD SCHEMES 6. Based upon training and experience, your affiant is familiar with the ways in which criminals involved in U. S. Treasury Check and other check frauds conduct their business, including the various ways they obtain stolen and fraudulent U. S. Treasury Checks, distribute the U. S. Treasury Checks, negotiate the U. S. Treasury Checks, and use cellular telephones and computer devices to facilitate their criminal activity. For instance, I know that criminals involved in the negotiation of stolen U. S. Treasury Checks and other stolen checks often use a stolen identity of a victim to set up false company names by fi l i ng with the GA Secretary of State, to appear that the company name is a legitimate operating business. They wi l l often use the stolen identity to pose as the owner of the "shell" companies they set up, which in fact does not conduct legitimate business, and then they wi l l open a bank account i n the false company name with the stolen identity. Often they wi l l use a manufactured counterfeit driver's license with the stolen identity infonnation and a picture of themselves to set up the false business and open the fraudulent bank account. Once the fraudulent bank account is opened, they wi l l negotiate the stolen U. S. Treasury Check or other stolen and fraudulent checks through the account. Once the funds are available, they wi l l withdraw the fiinds directly from the 4 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 5 of 50 account, or often wire transfer tiie fimds to anotiier fraudulent bank account to later be withdrawn. 7. Often the criminals wi l l open and use UPS mailboxes, or the like, i n the name of a stolen identity with a counterfeit or fraudulently obtained driver's license to receive mail related to the bank and stolen check fraud. Many times the mailbox is used as the address for the fraudulent bank account they set up to commit the check fraud. They wi l l use the fraudulent mailbox in the stolen identity name to fiirther the scheme and to avoid detection of their tme identity by law enforcement. 8. You affiant also knows that criminals wi l l often store bank documents, false company and fraudulent bank account records, stolen U. S. Treasury Checks, other stolen and fraudulently obtained checks, and counterfeit and fraudulently obtained driver's licenses and other fraudulent identification documents at their residence, as hard copies and/or on computer storage devices including computer hard drives, smart phones, and media storage devices. Your affiant also knows that criminals involved with stolen identities and stolen and fraudulently obtained U. S. Treasury Checks and other stolen items ordinarily have scheme documentation in their vehicles as they travel to offsite locations: to meet with purchasers and providers of the stolen and fraudulently obtained U. S. Treasury Checks, stolen identities, and counterfeit driver's licenses; and to execute the fraud at various financial institutions. I know that criminals that set up fraudulent 5 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 6 of 50 bank accounts to negotiate fraudulent and stolen checks, ordinarily drive to the financial institutions to deposit the stolen items and to withdraw the illicit funds i n cash or other form of payment. I know that when the criminals drive to the financial institution to conduct their fraudulent bank activities they ordinarily have the counterfeit driver's license on them i n a typical place like a wallet or a purse that someone would keep their genuine driver's license; in order to appear more legitimate and ordinary when they present the counterfeit driver's license to the financial institution or mailbox provider. 9. Criminals also use cellular phones regularly to make deals while obtaining stolen checks and identities. Your affiant knows criminals wi l l often possess multiple cellular phones with false information i n order to distance themselves from one specific number that may be traced to their true identity or location, i n an attempt to avoid detection from law enforcement. Criminals wi l l also use multiple cell phones to further their fraud scheme so that, for instance, when a bank calls the phone number listed on a fraudulent bank account the criminal wi l l know which identity they are supposed to impersonate when answering that particular phone. In at least one instance in a similar investigation, the criminal wi l l actually tape the name of the stolen identity to the back of the cell phone so that they remember what identity they are supposed to impersonate when answering it. 6 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 7 of 50 10. The U. S. Treasury distributes hinds to payees for many agencies and departments including checks for IRS tax retums, Veterans Affai rs, Social Security payments, HUD payments, and federal retirement savings checks (TSP). When these payments are mailed i n the form of U. S. Treasury Checks, which they often are, the checks are distributed through the U. S. Postal Service. In some cases, the U. S. Treasury Checks are intercepted i n the mail and subsequently distributed to other criminals who attempt to negotiate them for illicit profit. The criminals often times negotiate the stolen checks at financial institutions into bank accounts they open i n the name of a stolen identity and victim. The criminals are often times successfiil i n depositing the U. S. Treasury Checks, and also successfial in withdrawing the fiinds from the fraudulent bank accounts before the financial institution is aware that fraud has been committed. When a payee does not receive their rightfiil U. S. Treasury Check in the mail, they submit a request for a replacement check to the U. S. Govemment. And after some time, possibly several months, reclamation to recover the funds from the negotiated stolen U. S. Treasury Check is sent from the U. S. Treasury to the victim financial institution. The financial institution is often first aware that the U. S. Treasury Check was stolen and fraudulently negotiated when the reclamation is received by them from the U. S. Treasury, or i f law enforcement advises that the bank account is fraudulent and opened with a stolen identity. 7 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 8 of 50 THE PREDICATE OFFENSES 11. Chiefly, your affiant is seeking fruits, evidence and instrumentalities of violations of federal criminal offenses, as further described below, including: Title 18, United States Code, Section 641 (embezzlement, theft and conversion of public money); Title 18, United States Code, Section 1028(A) (aggravated identity theft); Title 18, United States Code, Section 1341 (mail fraud); Title 18, United States Code, Section 1343( wire fraud); Title 18, United States Code, Section 1344 (bank fraud); Title 18, United States Code, Section 1349 (conspiracy); and Title 18, United States Code, Sections 1956 and 1957 (money laundering). THE SUBJECT PREMISES 12. The SUBJ ECT PREMI SES comprises of a two-story, single-family brick house located at 7900 Rivertown Road, Fairbum, GA 30213. The house has a driveway on the right side of the house from the street view that leads to a two-car garage located i n the residence on the first floor. The front door is at the center of the house. Al so on the SUBJ ECT PREMI SES is a two-story, detached wooden storage building to the rear comer of the house on the property at this same address. In addition, there is one-story, wooden storage shed building toward the rear of the house on the property at this same address. Finally, a white enclosed trailer has been observed by law enforcement to be parked on this property beside the house on most occasions since Apr i l 2013, when 8 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 9 of 50 surveillance was conducted. An undeveloped wooded lot is directly to the left of the house (when facing the house from the street). The mailbox at the street in front of the driveway that leads to the house is marked with the numbers 7900. The publically filed property records show that this property was purchased i n January 2012 by Jeremy St. Julien, who married ST. J ULI EN in about May 2013. See also. Attachment AI , incorporated herein by reference. PROBABLE CAUSE FINANCIAL FRAUD, IDENTITY THEFT & MONEY LAUNDERING 13. Al l of the financial institution listed and discussed below, were federally insured during the time of the frauds detailed herein. 14. In Febmary of 2012, your affiant became involved with the ST. J ULI EN investigation when an investigator with JP Morgan Chase Bank (JPMC) advised that they were investigating an unknown black female suspect i n the Atlanta area that used four (4) bank accounts, opened with two (2) stolen identities of real persons, to coriimit bank and check fraud. The J PMC bank investigator asked for assistance from the United States Secret Service-Atlanta Fi el d Office (USSS) to identify the suspect and investigate the fraudulent activity. Bel ow is a brief summary of the information I received from J PMC of four (4) of the fraudulent bank accounts: 9 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l0 of 50 15. Two (2) J PMC bank accounts in the name Bobbie L. Cochran were opened on 10/04/11 in Atlanta, GA by an unknown black female suspect (later identified as ST. JULI EN) , using the stolen identity of Bobbie L. Cochran. The J PMC bank investigator provided copies of four (4) fraudulently obtained Texas Comptroller of Public Accounts checks that were fraudulently negotiated through one of the accounts. 16. Two (2) J PMC bank accounts named North Point Vol vo Inc. were opened on 02/10/11 i n Orlando, F L by an unknown subject (later identified as ST. JULI EN) , using the stolen identity of Li nda G. Smith-Kyle. J PMC provided me with copies of Twenty-two (22) stolen U. S. Treasury checks, issued to different payees, which were fraudulently negotiated through the accounts. Although the North Point Vol vo Inc. bank accounts were opened in Orlando, FL, most of the deposit and withdrawal transactions were made i n the Atlanta, GA area. 17. The J PMC investigator also provide the supporting bank documents for each of the four fraudulent accounts opened i n the names of stolen identities including video surveillance photos of the then unknown suspect who was operating the fraudulent bank accounts in J PMC bank branches. The unknown suspect in the surveillance photos appeared to be a middle-aged black female, and was later identified as ST. J ULI EN, as detailed below. 10 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page ll of 50 18. The J PMC investigator advised that State of Texas investigators were investigating the same unknown suspect for the negotiation of the fraudulently obtained Texas Comptroller of Public Accounts checks. J PMC also advised that they had contacted the real Bobbie L. Cochran and verified that her identity, including her name, date of birth, and social security number were stolen and used to open the two (2) fraudulent bank accounts titled in that name. J PMC advised that the unknown suspect used a T N driver's license with Bobbie L. Cochran's identifiers to open the two accounts, but the photo was of the unknown black female suspect (later identified as ST. JULI EN) , rather than the real Bobbie L. Cochran, a white female living in Montana with a MT driver's license. 19. Your affiant then contacted Investigator Mark Kubeczka, Texas Comptroller of Public Accounts, who advised that they have not been able to identify the suspect who negotiated their stolen checks into the account of Bobbie L. Cochran at J PMC. Inv. Kubeczka also advised that he contacted the real Bobbie L. Cochran and verified that her identity was stolen. Inv. Kubeczka advised that the four (4) Texas Comptroller checks were fraudulently issued checks that were fraudulently negotiated. 20. Your affiant then examined the video surveillance photos provided by J PMC of the unknown suspect making bank transactions, on different days and bank branches. Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l2 of 50 utilizing the above four (4) accounts. It appeared that all of the photos were of the same unlmown black female suspect (later identified as ST. JULI EN) . 21. Your affiant then contacted Linda Smith-Kyle, who confirmed her identity was stolen last year, in 2011. Smith-Kyle advised that she filed a fraud alert with the three (3) credit bureaus. She also sent me copies of the documents she filed to the credit bureaus, along with a police report. 22. On 02/21/12, Special Agent Mark Lewis ( USSS/ ATL) and your affiant went to the address listed on the Bobbie L. Cochran J PMC fraudulent bank accounts, 541 10* St. NW Ste. 451, Atlanta, GA. The address was a UPS store location. The UPS store owner advised that they had a mailbox, #451, in that store that was rented in the name Bobbie L. Cochran. The store owner provided me with the account application documents for the subject mailbox. The account documents included a photo copy of a T N driver's license i n the name of Bobbie L. Cochran, including her date of birth and social security number. The photo on the driver's license (later identified as ST. JULI EN) matched the appearance of the same black female suspect that was captured in the video surveillance photos of the above four (4) J PMC fraudulent bank accounts. Al so included was a photo copy of a GA Motor Vehicle Registration i n the name of Bobbie Cochran. The store owner advised that Bobbie Cochran was supposed to pick up a package that was mailed to her mailbox #451 that day. The store owner showed Special 12 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l3 of 50 Agent Lewis and your affiant tlie package. The sender information on the outside of the package was "State of N. J. Dept. of Treasury, P. O. Box 450, Trenton, NJ 08625". The package was sealed, however, by exterior observance appeared to contain a stack of paperwork approximately two (2) inches thick that was paper clipped together. 23. Continuing on 02/21/12, Special Agent Lewis and your affiant observed an individual enter the UPS store and pick up the package that was mailed to mailbox #451. The appearance of the individual appeared to be the same unknown black female suspect i n the video surveillance photos from the aforementioned fraudulent J PMC bank accounts, and the photo on the T N driver's license copy provided by the UPS store owner (all soon to be identified as ST. JULI EN) . 24. Continuing on 02/21/12, Special Agent Lewis and your affiant observed the suspect enter a blue Mercedes-Benz automobile with GA plate CR3919. We followed the suspect to a Kroger grocery store located at 1160 Moreiand Ave. , Atlanta, GA. We observed the suspect enter the store and make a purchase at a self-serve automated register of various grocery items including diapers and food. You affiant used the same register to make a transaction immediately after the suspect's transaction. Special Agent Lewis and your affiant then spoke with the Kroger store manager and provided him with a copy of the receipt from my transaction. The store manager was able to pinpoint the transaction of the then unknown suspect by utilizing the information on my receipt, and 13 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l4 of 50 we were able to obtain a copy of the transaction details made by the unknown suspect. The items in the transaction of the suspect were purchased with an EBT Food Stamp card. 25. On 02/27/12, your affiant contacted Special Agent Robin Wi l cox, United States Department of Agriculture-OIG, and requested her to provide the account information of the owner of the EBT card used in the purchase made by the suspect at Kroger that Special Agent Lewis and your affiant observed on 02/21/12. SA Wi l cox advised that he EBT card used by the subject at Kroger belonged to: Gayla O' Neal with date of birth 04/30/1970, and social security number x2532. 26. Continuing on 02/27/12, Criminal Research Specialist (CRS) Joan Kaiser (USSS) provided your affiant with a copy of the GA driver's license information of Gayla O' Neal from the GA Department of Driver Services. The photo of Gayla O' Neal on the GA driver's license matched the suspect in the video surveillance photos from the aforementioned fraudulent J PMC bank accounts, the photo on the T N driver's license copy provided by the UPS store owner i n the name of Bobbie Cochran, and the suspect that Special Agent Lewi s and your affiant observed during our surveillance on 02/21/12. Records recovered at a later time reveal that Gayla O' Neal married Jeremy St. Julien in 2013. Therefore, she is referred to herein as ST. J ULI EN. Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l5 of 50 FURTHER INVESTIGATION OF ST. JULIEN 27. On 03/30/12, Special Agent Davi d Coffey (USSS) and your affiant went to the UPS store located at 2897 N. Druid Hi l ls Rd. , Atlanta, GA. The UPS store manager advised that mailbox #283 was rented by someone using the name Angie Rickman- Crossan, but it was not in use anymore. The manager also advised that an investigator named Monty Mohr was investigating the same subject and others last year, and he had requested mailbox account information. The UPS manager provided your affiant with mailbox account information of mailbox #283 at 2897 N. Drui d Hi l l s Rd. for Rickman- Crossan. The information included a copy of a Tennessee driver's license i n the name of Angie Lee Rickman-Crossan bearing the photo of the suspect now known to be ST. J ULI EN. The photo on the copy of the T N driver's license matched the same photo on an AT &T employee ID i n the name of Candace Owens that ST. J ULI EN had provided to JP Morgan Chase Bank as identification to open fraudulent bank accounts i n the name of a shell company, Goodwin Automall Inc., using the stolen identity of Candace Owens. Investigation revealed that both the Rickman-Crossan and the Owens names and personal identifiers were stolen from real persons. IDENTITIES STOLEN FROM EQUIFAX AND LEXISNEXIS 28. On 04/04/12, your affiant contacted Monty Mohr. Mohr advised that he was a criminal investigator with the GA Govemor' s Office of Consumer Protection (GOCP), 15 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l6 of 50 and was actively investigating the same female suspect (now know to be ST. JULI EN) who had rented the UPS mailbox #283 at 2897 N. Druid Hi l l s Rd. , Atlanta, GA, for identity theft and fraud involving fraudulently obtaining access to both Equifax and LexisNexis databases to steal the identities of real persons used by ST. J ULI EN in the bank fraud schemes described i n this affidavit. 29. In early 2011, Equifax had discovered fraud and closed an account which had been opened with them in September 2009, in the name of shell company Onyx Collections & Locator Service and stolen identity Robert Watkins, using UPS box #248 at 931 Monroe Drive as the forwarding address for receipt of Onyx mail. ST. J ULI EN had previously opened UPS box #248 in the name of Onyx Collections & Locator Service using the stolen identity of Candace Owens, as detailed below. Before Equifax discovered the fraud, their database had been accessed by Onyx vi a the intemet to obtain personal identifiers of hundreds of individuals, including Candace Owens and most of the stolen identities used by ST. J ULI EN to execute the bank fraud detailed in this affidavit. The intemet was also used by ST. J ULI EN to apply for fraudulent vehicle loans from intemet lenders. 30. During this same time period, the LexisNexis database had also been fraudulently accessed via the intemet, and personal identifiers were received by Onyx on approximately 300 occasions with Onyx using the same Watkins stolen identity and UPS 16 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l7 of 50 mailbox rented to ST. J ULI EN in the Owens stolen identity. The names with personal identifiers fraudulently obtained from LexisNexis were also used by ST. J ULI EN and her conspirators to commit bank and other loan fraud as described herein. 31. In June 2011, after both Equifax and LexisNexis had terminated Onyx' s access to their databases, Inv. Mohr advised that his agency conducted an undercover operation on a new shell company named Reliance Recovery and Collections Group Inc., which appeared to have been set up to pose as a debt collection type company to again gain access to Equifax files, and thereby obtain reports which include personal identifiers, including names, addresses, DOBs, SSNs, employment, and credit histories, and to use the same to commit fraud. 32. Inv. Mohr advised that, during the undercover operation, one of his investigators acting as an undercover employee of a vetting company, met with applicant "Reliance Recovery and Collections Group Inc." owner "Mol l y Prentice" (now identified as ST. JULI EN) to conduct a site visit. A site visit was required as an Equifax due diligence measure before Reliance Recovery could be approved to gain access to Equifax data. The UC agent recorded the site visit with an audio-video device. The female suspect posing as Mol l y Prentice met with the UC agent for several minutes and signed documents as Mol l y Prentice i n his presence as he conducted the site visit of her office. This office space was apparently rented for the Equifax fraud. 17 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l8 of 50 33. The GOCP also took surveillance photos of the female suspect using the stolen name and personal identifiers of the real Mol l y Prentice, but was then unable to discover her true identity. Mohr provided your affiant with photos taken during the undercover operation including face close-up photos and photos of the vehicle driven by the female suspect. The vehicle was the same Mercedes-Benz car your affiant identified ST. J ULI EN driving on 02/21/12, with GA plate number CR3919. Your affiant also identified the GOCP photos and Mohr UC video of their subject as ST. J ULI EN. 34. In May of 2013, Inv. Mohr (GOCP) advised that during an examination of documents recovered by retrieving abandoned trash from a garbage bin at the street at 7900 Rivertown Rd. (the present residence of ST. JULI EN) , they found paperwork indicating that Gayla O' Neal was married to Jeremy St. Julien earlier that month and was now going by the name Gayla Sheila St. Julien. BANK ACCOUNTS USED FOR FRAUD AND MONEY LAUNDERING 35. During the investigation of ST. J ULI EN from February of 2012 to present, your affiant has obtained records of many bank accounts operated by ST. J ULI EN as part of her fraud scheme. ST. J ULI EN used a conspirator as an authorized signor on two of her bank accounts, although ST. J ULI EN conducted most of the transactions on those two accounts. Below, i n chronological order, is a list of those accounts with the dates, bank, shell company name and stolen identities of real persons used to open accounts 18 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page l9 of 50 (often obtained from the fraudulent access of Equifax and/or LexisNexis databases, detailed above), and usually a surveillance photo of ST. J ULI EN conducting one or more transactions. Your affiant has obtained copies of the bank surveillance photos closely matching the appearance of ST. J ULI EN for the listed accounts, along with the other bank records. The stolen names and personal identifiers used by ST. J ULI EN have been confirmed to belong to real persons by either interviews and/or law enforcement databases. Multiple bank accounts i n the same stolen identity are listed because ST. J ULI EN operated more than one account in the same name at the same bank. The total deposits for each account primarily include stolen U. S. Treasury Checks, stolen corporate checks, and fraudulently obtained state govemment checks, as well as transfers of scheme proceeds from the original shell company accounts Opened by ST. J ULI EN i n a stolen identity to other similar accounts. This list is not comprehensive, and there are more fraudulent bank accounts that appear to be part of ST. J ULI EN' s fraud scheme. Dates/Bank/Acct/Stolen ID/Deposits/ Connection to ST. JULIEN 1. 01/12/10 - 06/30/10 / BOA / Bynum Financial Inc. / Tricia A. Dew / $173,999.89 / bank surveillance photos. 2. 01/12/10 - 06/30/10 / BOA / Bynum Financial Inc. / Tricia A. Dew / $121,853.59 / bank surveillance photos. 3. 01/12/10 - 12/22/10 / J PMC / Bynum Financial Inc. / Tricia A. Dew / $140,673.75 / bank surveillance photos from same account with B of A. 19 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 20 of 50 4. 01/12/10 - 12/22/10 / J PMC / Bynum Financial Inc. / Tricia A. Dew / $198,800.25 / bank surveillance photos from same account with B of A. 5.02/24/10 - 07/12/10 / BOA / Reliance Financial Tax Group Inc. / Kel l y Willingham / $122,647.86 / bank surveillance photos from same account with J PMC. 6. 02/24/10 - 07/12/10 / BOA / Reliance Financial Tax Group Inc. / Kel l y Willingham / $78,015.61 / bank surveillance photos from same account with J PMC. 7. 02/24/10 - 12/31/10 / J PMC / ReHance Financial Tax Group Inc. / Kel l y Willingham / $422,200.12 / bank surveillance photos. 8. 02/24/10 - 12/31/10 / J PMC / Reliance Financial Tax Group Inc. / Kel l y Willingham / $209,660.66 / bank surveillance photos. 9. 07/01/10 - 12/31/10 / J PMC / Goodwin Automall Inc. / Candace Owens / $99,116.00 / bank surveillance photos from same account with B of A. 10. 07/01/10 - 12/31/10 / J PMC / Goodwin Automall Inc. / Candace Owens / $69,500.00 / bank surveillance photos from same account with B of A. 11. 07/07/10 - 11/07/11 / BOA / Goodwin AutomaU Inc. / Candace Owens / $386,110.00 / bank surveillance photos. 12. 07/07/10 - 12/31/10 / BOA / Goodwin Automall Inc. / Candace Owens / $63,050.00 / bank surveiUance photos. 13. 11/23/10 - 02/05/11 / J PMC / Universal Tax Group Inc. / Angie L. Rickman-Crossan / $54,510.29 / bank surveillance photos. 14. 02/10/11 - 01/31/12 / J PMC / North Point Vol vo Inc. / Lynda G. Smith- Kyl e / $238,070.78 / bank surveillance photos. 15. 02/10/11 - 01/31/12 / J PMC / North Point Vol vo Inc. / Lynda G. Smith- Kyl e / $115,636.89 / bank surveillance photos. 20 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 2l of 50 16. 10/04/11 - 12/13/11 / J PMC / Bobbie L. Cochran / Bobbie L. Cochran / $30,560.84 / bank surveihance photos. 17. 12/03/11 - 12/30/11 / J PMC / Annie L. Cochran / Capital Tax Strategies Inc. / $21,050.00 / bank surveillance photos. 18. 01/13/12 - 02/22/12 / J PMC / Mol l y Prentice / Mol l y Prentice / $25.00 / bank surveillance photos. 19. 01/13/12 - 02/29/12 / J PMC / Reliance Recovery & Collections Group Inc. / Mol l y Prentice / $464.13 / bank surveillance photos. 20. 10/18/12 - 04/16/13 / BOA / Signature Tax Collections Inc. / Vanessa Jackson / $54,250.00 / bank surveillance photos. 21. 05/21/13 - current / SunTrust / Signature Tax Collections Inc. / Vanessa Jackson / bank surveillance photos. 36. Bel ow is a list of other fraudulent bank accounts that have been identified by this investigation related to ST. J ULI EN' s fraud scheme. These accounts were also opened using stolen identities of real persons and shell company names. The primary factor connecting the below accounts are the checks and wire transfers made between these accounts and the above listed fraudulent accounts with the ST. J ULI EN surveillance photos. 22. 12/23/08 - 06/25/12 / J PMC / Jean C. Al l en / Jean C. AUen / $250,200.00 / Funds moved from this account via checks to other ST. J ULI EN fraud accounts. 21 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 22 of 50 23. 01/05/10 - 06/30/10 / J PMC / Star Capital Tax Services Inc. / Rebecca J. Seymour / $63,776.81 / funds moved from this account to other ST. J ULI EN fraud accounts. 24. 03/09/10 - 06/30/10 / J PMC / Signature Luxury Imports Inc. / Karen Kennedy / $283,100.00 / funds moved from this account to other ST. J ULI EN fraud accounts. 25. 07/02/10 - 12/31/10 / J PMC / Upstate Automotive Group Inc. / Apr i l M. Terry / $57,679.81 / funds moved from this account to other ST. J ULI EN fraud accounts. 26. 07/02/10 - 12/31/10 / J PMC / Upstate Automotive Group Inc. / Apr i l M. Terry / $12,585.00 / ftmds moved from this account to other ST. J ULI EN fraud accounts. 27. 07/02/10 - 12/31/10 / J PMC / Upstate Automotive Group Inc. / Apr i l M. Terry / $8,545.00 / funds moved from this account to other ST. J ULI EN fraud accounts. 28. 12/08/10 - 10/05/11 / WF / Jean AUen / Jean AUen / $274,920.10 / fiinds moved from this account to other ST. J ULI EN fraud accounts. 29. 02/10/11 - 08/10/11 / B OA / Acura Garland Inc. / Lynda Smith-Kyle / $100.00 / bank surveillance photos of ST. J ULI EN with same stolen identity used on J PMC fraud account. 30. 02/10/11 - 08/10/11 / B OA / Acura Garland Inc. / Li nda Smith-Kyle / $100.00 / bank surveiUance photos of ST. J ULI EN with same stolen identity used on J PMC fraud account. 31. 07/11/11 - 07/31/11 / WF / Jean Al l en / Jean Al l en / $3,819.01 / fiinds moved from this account to other ST. J ULI EN fraud accounts. 32. 07/11/11 - 08/12/11 / WF / Jean Al l en / Jean Al l en / $9,381.00 / frmds moved from this account to other ST. J ULI EN fraud accounts. 22 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 23 of 50 33. 05/12/12 - 12/07/12 / Regions / Signature Tax Collections Inc. / Deborah Kyl e / $8,814.43.86 / bank surveillance photos from same account with BOA. 34. 10/18/12 - 04/16/13 / BOA / Signature Tax Collections Inc. / Vanessa Jackson / $54,250.00 / bank surveillance photos. 35. 05/21/13 - to date / SunTrust / Signature Tax Collections Inc. / Vanessa Jackson / $50,000.00+ / bank surveillance photos from same account with BOA. UPS MAILBOXES USED BY ST. JULIEN IN FRAUD SCHEME 37. The following is a list of UPS mailboxes that have been identified by agents of the USSS and the GOCP as being opened and used by ST. J ULI EN to further her fraudulent scheme for example, to receive mail sent by the US Postal Service and other interstate carriers, including bank statements, bank checks, correspondence, and some fraudulently obtained checks, among other things, as well as the location of at least one shell company. Application documents for the renter of the following mailboxes were obtained from the respective UPS store locations. The mailboxes listed here are not a comprehensive list of UPS mailboxes used during ST. J ULI EN' s schemes, however, they were all opened by a suspect using a fraudulent driver's license bearing a photo that appears to be ST. J ULI EN and the stolen name and personal identifiers of a real person, usually obtained from the fraudulent access to Equifax and/or LexisNexis databases. ST. 23 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 24 of 50 J ULI EN authorized a conspirator to remove items from one of the fr)Ilowing boxes, being #222. UPS Store #0458 / 2550 Sandy Plains Rd. / Mai l box #222 / Candace Owens/08/02/10. UPS Store #2121 / 931 Monroe Dr. / Mai l box #248 / Candace Owens/ 08/17/10. UPS Store #4322 / 2897 N. Drui d Hi l l s Rd. / Mai l box #283 / Angie Rickman-Crossan /11/22/10. UPS Store #2257 / 541 10* St. / Mai l box #451 / Bobbie Cochran / 10/04/11. UPS Store #1006 / 2625 Piedmont Rd. / Mai l box #119 / Vanessa Jackson/05/21/12. VEHI CLE LOAN FRAUD/ ID THEFT/ FINANCIAL INSTITUTION FRAUD 38. According to inft)rmation and records received from the FBI and from BOA, i n Apr i l 2010, five vehicle loans totaling $277,000 were obtained in stolen names and personal identities from Campus US A Credit Uni on in FL. The proceeds from these fraud loans were subsequently deposited into two Atlanta accounts opened at B OA by ST. J ULI EN: one BOA account i n the shell company Reliance Financial Tax Group and stolen identity of real person Kel l y Willingham; and another B OA account in shell company Bynum Financial Inc. and stolen identity of real person Tricia Dew. Thereafter, 24 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 25 of 50 ST. J ULI EN withdrew the proceeds of this vehicle loan fraud from these two BOA accounts. These ST. J ULI EN accounts are listed above with her connection thereto. 39. In or about February 2011, ST. J ULI EN obtained additional vehicle loan proceeds totaling approximately $125,000 vi a on line applications submitted to lender. Up To Drive, i n stolen identities obtained by Onyx' s fraudulent online access of the Equifax database. UNCLAI MED PROPERTY FRAUD/ ID THEFT/ BANK FRAUD 40. In September and October 2011, an unknown person used the stolen identities of four real persons, Bobbie Cochran, Gussie Stanley, Li l l i an Sears, and Susan Roy, to obtain four checks totaling $30,560 i n unclaimed property funds from the State of Texas. In October and November 2011, these fraudulently obtained checks were deposited into the Atlanta account opened by ST. J ULI EN at J PMC i n the stolen Cochran identity, and the proceeds withdravm soon thereafter. That J PMC account is listed above with the ST. J ULI EN connection thereto. The state of T X placed these four checks in the mail and they were eventually transported to Atlanta for deposit as described herein. ST. JULIEN BACKGROUND 41. According to a NCI C query of ST. J ULI EN, she has prior fraud and identity theft convictions: Degree Forgery on 05/25/88 i n Fulton County ( GA) and a federal conviction for Title 18 USC 922(G)(1) (Felon Possession of Firearm), 1028(A)(5) (ID 25 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 26 of 50 Fraud), 1029(A)(3) (Access Device Fraud), and 408(A)(7)(C) ( SSN Number Fraud) on 08/29/03 in tiie U. S. District Court for the District of Nevada. Details of her latest case are included below, as they show a pattern for some of her recent criminal conduct described herein which occurred after she was released from custody. 42. Specifically, the FBI advised your affiant that ST. J ULI EN was arrested on January 10, 2003, at her then residence in Las Vegas, NV, during the execution of a search warrant by the FBI at her residence. The FBI investigation involved ST. J ULI EN perpetrating a complex "account takeover" fraud scheme. That scheme involved the creation of counterfeit payroll business checks on her computer made payable to purported employees who were, i n fact, the stolen identities of the persons whose account information she had obtained from a bank employee. She thereafter used fraudulent GA driver's licenses in the stolen identities of the account holders to cash the counterfeit "payroll" checks at branches of the purported employees' banks i n GA, A L and other southem states. 43. During the execution of the search warrant at the ST. J ULI EN residence on 01/10/03, the FBI seized a .357 magnum handgun at her residence. During an interview, post Miranda Rights advisement and waiver, ST. J ULI EN admitted to agents that the .357 magnum belonged to her. ST. J ULI EN told agents that she purchased the gun using an alias and stolen Social Security Number. ST. J ULI EN was already at this time a 26 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 27 of 50 convicted felon. ST. J ULI EN also admitted to FBI agents that she fabricated and used various forms of false identification including, stolen Social Security Numbers, stolen bank account numbers, stolen names, and other personal identifiers of account holders, plus various aliases in furtherance of a scheme to cash fraudulent checks i n different parts of the United States. ST. J ULI EN pled guilty to said scheme i n the District of South Carolina on a Rule 20 from the District of Nevada. 44. When ST. J ULI EN was released from custody on these 2003 federal charges, her supervised release was subsequently revoked i n July 2007, for continuing to negotiate counterfeit payroll business checks in stolen identities in Alabama i n 2005. ST. J ULI EN served time in A L from 10/1/05 until 3/8/07, when she was released by A L into federal custody on the supervision release violation warrant. She was released from federal custody on the supervised release violations on 10/4/07. 45. Upon release from custody, it appears that ST. J ULI EN continued her fraud scheme i n Atlanta, GA. On 12/23/08, a WA MU account (now J PMC) was opened in the name of Jean Al l en and approximately $250,000 i n proceeds were withdrawn in checks deposited into a Jean Al l en account at Wells Fargo Bank (WF). Thereafter, $75,000 from the WF account was deposited into the BOA account controlled by ST. J ULI EN which she had opened in shell company Goodwin Automall Inc., using the stolen identity of Candace Owens as detailed above. 27 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 28 of 50 2013 SURVEI LLANCE OF SUBJECT PREMISES AND VEHI CLES 46. Several surveillances have been conducted on ST. J ULI EN at the SUBJ ECT PREMI SES and elsewhere by agents of t he USSS and the GOCP since Apr i l of 2013. On 04/15/13, Special Agent Robin Wi l cox, U. S. Department of Agriculture ( USDA) , provided your affiant with updated EBT Food Stamp account information for ST. J ULI EN. The account was active and the address for ST. J ULI EN was listed as the same address which is the SUBJ ECT PREMI SES. Most of the recent transaction activity made with this card revealed purchases made in the local area of the SUBJ ECT PREMI SES. 47. Specifically, the enclosed white trailer has been observed parked beside the house on this premises, and has remained stationary during most of the law enforcement observations. The two above-described storage buildings at this address have also been observed by law enforcement from the public street area. 48. The blue Mercedes-Benz that your affiant observed ST. J ULI EN to be driving in the past to retrieve items from one of the UPS mailboxes described above and the GOCP observed ST. J ULI EN to be driving during their undercover operation, has also been observed parked i n the driveway of the SUBJ ECT PREMI SES on several different days since Apr i l 2013. ST. J ULI EN has also been observed driving the blue Mercedes-Benz from her residence to different locations during the day. That Mercedes was subsequently "totaled" in a June 2013 wreck. 28 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 29 of 50 49. A red 2005 Hummer H2, license tag number PDB9483, has been seen parked in the driveway oft he SUBJ ECT PREMI SES on multiple days since Apr i l 2013. The Hummer license plate was also registered in the name of ST. J ULI EN, and she has been observed driving the Hummer by agents of the GOCP. 50. A black 2010 Silverado Chevy truck, license tag number PHF3074, registered to ST. J ULI EN' s husband, Jeremy St. Julien, has been seen in the driveway at the SUBJ ECT PREMI SES as well. ST. J ULI EN has also been seen driving the Chevy truck by agents of the GOCP during surveillances. 51. On 08/30/13, Inv. Dan Vogt (GOCP) observed a new vehicle parked at the SUBJ ECT PREMI SES. The vehicle, a 2013 white Chevy Mal i bu, temporary tag number 11955591, is registered to Jeremy St. Juhen. Inv. Vogt (GOCP) also observed ST. J ULI EN drive the Chevy Mal i bu this same day from her house to a Chevron gas station nearby. 52. Both the Chevy Silverado and the Mal i bu, are THE VEHI CLES for which a search warrant is requested to search for items listed i n Attachment B. THE VEHI CLES are further described in Attachment A2, incorporated herein by reference. RECENT BK FRAUD, STOLEN ID, MONEY LAUNDERING & ATTEMPT 53. Recent fraudulent activities of ST. J ULI EN include operation of her fraudulent bank account at SunTrust Bank in the name of shell company. Signature Tax 29 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 30 of 50 Collections Inc., which account is listed above. The stolen identity ST. J ULI EN used to open and operate this account is in the name Vanessa Jackson. ST. J ULI EN used a counterfeit driver's license from SC with her picture on it and the personal identifiers of identity theft victim Vanessa Jackson. 54. In March 2013, an unknown white male i n conjunction with ST. J ULI EN attempted an "account takeover" fraud, utilizing ST. J ULI EN' s Signature Tax Collections Inc., account at SunTrust, among others. The unknown male obtained identification in the stolen identity of true BOA business account holder, Wi l l i am Stanbach, and made multiple unsuccessful attempts to use the Stanback stolen identifiers to wire transfer a total of $566,023.55 from Stanbach account proceeds. Two of those attempts were wires to ST. J ULI EN' s SunTrust account she had opened i n the stolen identity of Vanessa Jackson and the shell company Signature Tax Collections. This attempted "account takeover" fraud is similar to the one for which ST. J ULI EN was convicted i n 2003. 55. On 08/22/13, a SunTrust Bank investigator advised Inv. Mohr (GOCP) that ST. J ULI EN, using the stolen identity of Vanessa Jackson, was i n the teller line at a SunTrust Bank branch in Atlanta, GA, attempting to withdraw funds from the Signature Tax Collections Inc. account, but was unsuccessfiil. The SunTmst account had just received a wire transfer of $25,400.00 from a Wells Fargo bank account in the name of Ferrari Autohaus, Inc. on 08/22/13. A 9/6/13 search of offi ci al GA Secretary of State 30 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 3l of 50 records revealed no such company. From public records and intemet searches, plus the personal knowledge of the bank investigator, the address ST. J ULI EN listed for Ferrari Autohaus, Inc. appears to be a single-story, single-family house with no commercial business affiliations, and certainly no car lot. 56. On 08/30/13, a Wells Fargo investigator advised that the bank account for Ferrari Autohaus Inc. had sent a $25,000.00 wire transfer to Signature Tax Collections Inc. on 07/22/13 and another $25,400.00 wire transfer to the same on 08/22/13. 57. On 08/23/13, a SunTrust investigator advised your affiant that "Vanessa Jackson" went to another SunTrust Bank branch and successfiilly withdrew $9,500 i n cash and wire transferred $8,000 from her Signature Tax Collections Inc. account to an account named Heritage Recovery also in the name of Vanessa Jackson. The SunTrust bank investigator also advised that they have frozen the remaining funds in the account, and that "Vanessa Jaclcson" has been calling everyday multiple times to various bank locations in an attempt to recover those funds TRASH PULLS AT SUBJECT PREMISES 58. Bel ow are a few of the items of interest that were retrieved by agents oft he GOCP since May of 2013 from trash pulls at the SUBJ ECT PREMI SES. Al l oft he trash pulls were conducted by GOCP agents retrieving the trash that was already placed in a 31 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 32 of 50 garbage bin and set at the street next to the mailbox in front oft he SUBJ ECT PREMI SES on the scheduled garbage collection day of Waste Industries. GA license plate CR39I 9 (same plate that was observed on Mercedes-Benz vehicle during prior surveillances of ST. J ULI EN fraudulent activities). Signature Boutique pay stub for Gayla O' Neal and a receipt for VI SA account ending in 6908. Georgia Compass Human Services letter to Gayla O' Neal . HP PhotoSmart Test page. Blank Regions checking deposit slip. Envelope to Sheila St. Julien from Dianne Robinson. NetlO $50 calling card. Westem Union money transfer order from Sheila St. Julien to Tara Williams. RE Automotive Inc. invoice for Gayla O' Neal . Wells Fargo transaction receipt for account ending i n 8528. Letter and receipt for childcare services to Mrs. St. Julien. Application to plead guilty for Gayla O' Neal. 32 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 33 of 50 Various purchase receipts with credit/debit card accounts ending in 1537, 4638, 4588, 8411, 1992, 3035, 7771, 9574, 6307, 0827, and 1611. Regions A T M receipt. Odometer Disclosure statement for 2005 Hummer H2 from K & D Auto Sales for buyer Gayla O' Neal . e Federal Credit Union receipt with account balance of $17,370.88. Wells Fargo transaction receipt for check cash transaction. Color photograph of young couple appearing at Prom with note on back "To Gayla, from your Sis, Toya". iPhone box with identifiers SN#F17KMBFFF8GJ, IMEI# 99000282553125 for iPhone 5, white in color. Model A1429, 16GB. Regions Bank receipt on account ending in 5825. Fi ft h Third Bank check renewal slip i n the name of Gayla O' Neal . T-Mobile Wireless Aircard. AT &T SI M card: #890114104254778907033. Pantech AT &T cellphone model: P7040P and S/ N: 114802317135. Fi ft h Third Bank customer receipt account ending in 9906. 33 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 34 of 50 Empty Office Depot box for Home Office and Business Check Writing Suite software. HP printer Status Report and Set-Up instmctions. Multiple prescription pi l l bottles i n the name of Gayla O' Neal . 59. Based on the above information, Affiant beheves G A Y L A ST. J ULI EN committed acts in violation of Ti t l e 18 U. S. C. Sections 641, 1028(A), 1341, 1343, 1344, 1349, 1956 and 1957. TECHNI CAL TERMS 60. Based on training and experience, your affiant uses the following technical terms to convey the following meanings: a. Intemet: The Intemet is a global network of computers and other electronic devices that communicate with each other. Due to the stmcture of the Intemet, connections between devices on the Intemet often cross state and intemational borders, even when the devices communicating with each other are in the same state. b. Storage medium: A storage medium is any physical object upon which computer data can be recorded. Examples include hard disks, floppy disks, flash memory, CD- ROMs , and several other types of magnetic or optical media not listed here. 34 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 35 of 50 COMPUTERS, ELECTRONI C STORAGE, AND FORENSIC ANALYSIS 6 L As described above and in Attachment B, this application seeks permission to search for records that might be found on the SUBJ ECT PREMI SES and the VEHI CLES, i n whatever form they are found. Among other forms, records might be found in data stored on a laptop computer hard drive, desktop computer hard drive, discs, CDs, USB thumb or flash drives, cellular phone, or other storage media. Thus, the warrant applied for would authorize the seizure of electronic storage media or, potentially, the copying of electronically stored information, all under Rule 41(e)(2)(B). 62. I submit that i f a computer or storage medium is found on the SUBJ ECT PREMI SES or VEHI CLES, there is probable cause to believe records containing evidence of a crime related to Title 18, United States Code, Section 641, 1028(A), 1341, 1343, 1344, 1349, 1956, and 1957 would be found on that computer or storage medium, for at least the following reasons: a. Based on my knowledge, training, and experience, your affiant knows that computer files or remnants of such files can be recovered months or even years after they have been downloaded onto a storage medium, deleted, or viewed via the Intemet. Electronic files downloaded to a storage medium can be stored for years at little or no cost. Even when files have been deleted, they can be recovered months or years later using forensic tools. This is so because when a person "deletes" a file on a computer, the data contained i n the file 35 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 36 of 50 does not actually disappear; rather, that data remains on the storage medium until it is overwritten by new data. b. Therefore, deleted fdes, or reronants of deleted files, may reside in free space or slack space^that is, i n space on the storage medium that is not currently being used by an active file^^for long periods of time before they are overwritten, hi addition, a computer's operating system may also keep a record of deleted data in a "swap" or "recovery" file. c. Whol l y apart from user-generated files, computer storage mediain particular, computers' intemal hard drivescontain electronic evidence of how a computer has been used, what it has been used for, and who has used it. To give a few examples, this forensic evidence can take the form of operating system configurations, artifacts from operating system or application operation, file system data stmctures, and virtual memory "swap" or paging files. Computer users typically do not erase or delete this evidence, because special software is typically required for that task. However, it is technically possible to delete this information. d. Similarly, files that have been viewed via the Intemet are sometimes automatically downloaded into a temporary Intemet directory or "cache." e. Based upon information discovered during this investigation, computer devices were used to access the intemet to illicitly gather information to steal identities and commit fraud using those identities. Al so, a computer device was used to access online bank accounts that have been identified to be fraudulently obtained and used by ST. J ULI EN. ST. J ULI EN has also used multiple counterfeit driver's licenses with a photo of herself and the stolen identifiers of victims on them to commit fraud. In my training and experience, I believe it is very likely that the counterfeit driver's licenses were made using a 36 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 37 of 50 computer device. Accordingly, I believe there is probable cause that ST. J ULI EN has possession of a computer device that has been used to fiirther her fraudulent activities at the SUBJ ECT PREMI SES and VEHI CLES. fi In 2003, the FBI search ofher Las Vegas premises and statements by ST. J ULI EN revealed that she was using her computer to create counterfeit payroll business checks, among other things, as detailed above. 63. As further described i n Attachment B, this application seeks permission to locate not only computer files that might serve as direct evidence of the crimes described on the warrant, but also for forensic electronic evidence that establishes how computers were used, the purpose of their use, who used them, and when. There is probable cause to believe that this forensic electronic evidence wi l l be on any computer or storage media i n the SUBJ ECT PREMI SES and/or VEHI CLES because: a. Data on the storage medium can provide evidence of a file that was once on the storage medium but has since been deleted or edited, or of a deleted portion of a file (such as a paragraph that has been deleted from a word processing file). Virtual memory paging systems can leave traces of information on the storage medium that show what tasks and processes were recently active. Web browsers, e-mail programs, and chat programs store configuration information on the storage medium that can reveal information such as online nicknames and passwords. Operating systems can record additional information, such as the attachment of peripherals, the attachment of USB flash storage devices or other extemal storage media, and the times the computer was i n use. Computer file systems can record information 37 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 38 of 50 about the dates files were created and the sequence in which they were created. b. Forensic evidence on a computer or storage medium can also indicate who has used or controlled the computer or storage medium. This "user attribution" evidence is analogous to the search for "indicia of occupancy" while executing a search warrant at a residence. For example, registry information, configuration files, user profiles, e- mail, e-mail address books, "chat," instant messaging logs, photographs, the presence or absence of malware, and correspondence (and the data associated with the foregoing, such as file creation and last-accessed dates) may be evidence of who used or controlled the computer or storage medium at a relevant time. c. A person with appropriate familiarity with how a computer works can, after examining this forensic evidence i n its proper context, draw conclusions about how computers were used, the purpose of their use, who used them, and when. d. The process of identifying the exact files, blocks, registry entries, logs, or other forms of forensic evidence on a storage medium that are necessary to draw an accurate conclusion is a dynamic process. While it is possible to specify in advance the records to be sought, computer evidence is not always data that can be merely reviewed by a review team and passed along to investigators. Whether data stored on a computer is evidence may depend on other information stored on the computer and the application of knowledge about how a computer behaves. Therefore, contextual information necessary to understand other evidence also falls within the scope of the warrant. e. Further, i n finding evidence of how a computer was used, the purpose of its use, who used it, and when, sometimes it is necessary to establish that a particular thing is not present on a storage medium. For example, the presence or absence of counter-forensic programs or 38 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 39 of 50 anti-vims programs (and associated data) may be relevant to establishing the user's intent. 64. In most cases, a thorough search of a premises or vehicles for information that might be stored on storage media often requires the seizure of the physical storage media and later off-site review consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes possible to make an image copy of storage media. Generally speaking, imaging is the taking of a complete electronic picture of the computer's data, including all hidden sectors and deleted files. Either seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded on the storage media, and to prevent the loss of the data either from accidental or intentional destruction. This is tme because of the following: a. The time required for an examination. As noted above, not all evidence takes the form of documents and files that can be easily viewed on site. Analyzing evidence of how a computer has been used, what it has been used for, and who has used it requires considerable time, and taking that much time on premises could be unreasonable. As explained above, because the warrant calls for forensic electronic evidence, it is exceedingly likely that it wi l l be necessary to thoroughly examine storage media to obtain evidence. Storage media can store a large volume of information. Reviewing that information for things described i n the warrant can take weeks or months, depending on the volume of data stored, and would be impractical and invasive to attempt on-site. 39 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 40 of 50 b. Technical requirements. Computers can be configured in several different ways, featuring a variety of different operating systems, application software, and configurations. Therefore, searching them sometimes requires tools or knowledge that might not be present on the search site. The vast array of computer hardware and software available makes it difficult to know before a search what tools or knowledge wi l l be required to analyze the system and its data on the Premises. However, taking the storage media off-site and reviewing it i n a controlled environment wi l l allow its examination with the proper tools and knowledge. c. Variety of forms of electronic media. Records sought under this warrant could be stored in a variety of storage media formats that may require off-site reviewing with specialized forensic tools. 65. Based on the foregoing, and consistent with Rule 41(e)(2)(B), when persons executing the warrant conclude that it would be impractical to review the media on-site, the warrant applied for would permit seizing for later imaging and search without additional warrants for said searches, or imaging storage media on site, that reasonably appear to contain some or all of the evidence described in the warrant, thus permitting its later examination consistent with the warrant. The examination may require techniques, including but not limited to computer-assisted scans of the entire medium, that might expose many parts of a hard drive to human inspection in order to determine whether it is evidence described by the warrant. 40 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 4l of 50 CONCLUSION 66. Based upon the facts detailed above, there exists probable cause to beheve that within the SUBJ ECT PREMI SES and the VEHI CLES, there exists evidence, fruits and instrumentalities of violations of Title 18, United States Code, Sections 641, 1028(A), 1341, 1343, 1344, 1349, 1956 and 1957 ; as weh as probable cause for the arrest of G A Y L A ST. J ULI EN nee O' NEAL. 41 Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 42 of 50 ATTACHMENT A l PREMISES TO BE SEARCHED 7900 Rivertown Road, Fairburn, GA 3 0213 The premises known as 7900 RIVERTOWN ROAD, FAIRBURN, GA 30213 i n c l u d e s : (a) a two-story, b r i c k residence w i t h a two-car garage as a p a r t of the f i r s t f l o o r ; (b) a two-story, wooden storage b u i l d i n g ; (c) a one-story, wooden storage shed; and (d) a white enclosed t r a i l e r parked beside the house ( h e r e i n a f t e r, c o l l e c t i v e l y the "SUBJECT PREMISES"). The SUBJECT PREMISES i s a two-story, s i n g l e - f a m i l y b r i c k house l o c a t e d at 7900 Rivertown Road, Fairburn, GA 30213. The house has a driveway on the r i g h t side of the house from the s t r e e t view that leads to a two-car garage l o c a t e d i n the residence on the f i r s t f l o o r . The f r o n t door i s at the center of the house. Also a p a r t of the SUBJECT PREMISES at t h i s address i s a two-story, detached wooden storage b u i l d i n g and a one-story, wooden storage shed both toward the r e a r of the house, plus a white enclosed t r a i l e r parked beside the house. An undeveloped wooded l o t i s d i r e c t l y to the l e f t of the house when f a c i n g the house from the s t r e e t . The mailbox at the s t r e e t i n f r o n t of the driveway that leads to the house i s marked w i t h the numbers 7900. A recent photo of the SUBJECT PREMISES i s a part of t h i s attachment. Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 43 of 50 7 foo / ^ , V e r f o K / A id. Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 44 of 50 ATTACHMENT A2 PREMISES TO BE SEARCHED Known as "VEHICLES" The VEHICLES to be searched are a white 2013 Chevy Malibu with temporary tag number 11955591, and a black 2010 Chevy S i l v e r a d o truck, l i c e n s e p l a t e number PHF3074, i n c l u d i n g any closed and/or locked compartments and containers t h e r e i n . Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 45 of 50 ATTACHMENT B The f o l l o w i n g items to be seized, whether hard copies or e l e c t r o n i c a l l y stored, c o n s i s t of evidence, contraband, f r u i t s , and i n s t r u m e n t a l i t i e s of c r i m i n a l v i o l a t i o n s of T i t l e 18 U.S.C. 641 (embezzlement, t h e f t and conversion of p u b l i c money) , 1028(A) (aggravated i d e n t i t y t h e f t ) , 1341 (mail fraud), 1343 (wire fraud) , 1344 (bank fraud) , 1349 (conspiracy) and 1956 and 1957 (money laundering). (a) . Personal and business bank and c r e d i t card statements, bank account numbers, c r e d i t card numbers, account passwords, check books, deposit s l i p s , withdrawal s l i p s , canceled checks, cashier's checks, wire t r a n s f e r advices, ATM r e c e i p t s , c r e d i t and debit cards, charge s l i p s , safe deposit box r e n t a l s and keys, c o u n t e r f e i t checks, cash, money orders, pay stubs, and any items and documentation r e l a t i n g to any and a l l ST. JULIEN assets, or r e f l e c t s t o l e n and other i d e n t i t i e s used to obtain and launder fraud proceeds. (b) . Jewelry and other luxury items purchased w i t h scheme proceeds. (c) . Any and a l l information r e l a t i n g to i d e n t i t i e s of others and a l l i d e n t i f i c a t i o n documents i n c l u d i n g , but not l i m i t e d t o , o r i g i n a l s or copies of d r i v e r s l i c e n s e s , whether complete or p a r t i a l l y made, photographs f o r d r i v e r s l i c e n s e s , s o c i a l s e c u r i t y cards, s o c i a l s e c u r i t y numbers, b i r t h c e r t i f i c a t e s , u t i l i t y b i l l s , employee and other i d e n t i f i c a t i o n documents, c r e d i t reports, LexisNexis r e p o r t s , and any hand w r i t t e n or e l e c t r o n i c a l l y stored notes of the personal Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 46 of 50 i d e n t i f i e r s of others. (d) . A p p l i c a t i o n s with supporting documents i n names of Onyx C o l l e c t i o n & Locator Service, Reliance Recovery and C o l l e c t i o n s , and any other a p p l i c a t i o n s f o r access to Equifax, LexisNexis and any other c r e d i t r e p o r t i n g or data c o l l e c t i o n databases, and correspondence r e l a t e d thereto. (e) . Documents r e l a t i n g to the r e n t a l of any storage u n i t s , post o f f i c e boxes, UPS boxes. Federal Express accounts and addresses, other "mail drop" l o c a t i o n s , v i r t u a l and other o f f i c e s , present and p r i o r residence addresses; a l l records, i n c l u d i n g but not l i m i t e d t o , packing s l i p s , correspondence, and address l a b e l s , of anything sent to or receive d by or through such addresses, and a l l contents thereof. (f) . Records of a l l past and present ST. JULIEN addresses, whether i n ST. JULIEN name, a l i a s name, s t o l e n i d e n t i t i e s , or company names. (g) . Any and a l l devices and other items used to make c o u n t e r f e i t checks, f a l s e i d e n t i f i c a t i o n , or other unauthorized access devices, i n c l u d i n g but not l i m i t e d t o, computers, p r i n t e r s , copy machines, scanners, cameras, memory cards, smart phones, check c r e a t i o n software, check paper, blank p l a s t i c cards, c r e d i t card skimmers and re-encoders, and a l l media storage devices used f o r such purposes. (h) Any and a l l devices and other items used to access bank accounts, c r e d i t accounts, and database information i n c l u d i n g but not l i m i t e d to smart phones, computers, and t a b l e t s Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 47 of 50 (i) A p p l i c a t i o n s f o r v e h i c l e or other loans with supporting documents (eg., W2s, 1099s, pay stubs, pay checks, employment v e r i f i c a t i o n s , bank statements, and tax r e t u r n s ) , v e h i c l e t i t l e s and r e g i s t r a t i o n s , borrower/purchasers' d r i v e r ' s l i c e n s e s , s o c i a l s e c u r i t y cards, r e c e i p t and dispossession of loan proceeds, c o l l e c t i o n s and other correspondence with lenders and others. ( j ) . Records of a l l car, mortgage, and c r e d i t card payments. (k). C e l l and other phone usage and b i l l i n g records. (1) . Any f e d e r a l or s t a t e government issued checks, and r e c e i p t and d i s p o s i t i o n records f o r such checks. (m) . A p p l i c a t i o n s with supporting documentation p e r t a i n i n g to EBT Food Stamp cards/program, EBT food stamp cards, account statements, records of food stamp r e c e i p t and usage, updated i n s t a t u s , correspondence, and any other m a t e r i a l r e l a t e d to food stamps. (n). Names, p h y s i c a l addresses, email addresses, SSNs, DOBs, telephone numbers, contact l i s t s , and photographs of c o n s p i r a t o r s , other associates, and i d e n t i t y t h e f t v i c t i m s , whether hand w r i t t e n notes or hard copy books or stored e l e c t r o n i c a l l y on computers, t a b l e t s , smart phones, or other e l e c t r o n i c storage devices. (o). Travel records of ST. JULIEN and c o n s p i r a t o r s , i n t h e i r own names or i n s t o l e n i d e n t i t i e s , i n c l u d i n g a i r , or otherwise; records of a l l car r e n t a l s and payments. (p) . Opened E-mails, text messages, v o i c e mails, and any other correspondence and contacts w i t h c o n s p i r a t o r s , lenders. Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 48 of 50 f i n a n c i a l i n s t i t u t i o n s , c r e d i t r e p o r t i n g agencies, data s e r v i c e companies, and vendors of database s e r v i c e s . (q) . Any w a l l or f l o o r safes, b r i e f c a s e s , or other locked containers or compartment on the SUBJECT PREMISES Or i n the two VEHICLES and any GPS records t h e r e i n . (r) . A p p l i c a t i o n s w i t h O f f i c e s of the Secretary of States f o r the i n c o r p o r a t i o n , formation, and/or r e a c t i v a t i o n of companies, a r t i c l e s of i n c o r p o r a t i o n , annual f i l i n g s , company addresses, d i r e c t o r , o f f i c e r and employee names, and a l l t r a n s a c t i o n s conducted i n such company names. (s). Paper Shredder and any shredded m a t e r i a l . (t) . Desktop Computers, Laptop Computers, t a b l e t s , smart phones, other c e l l phones, PDA's, and p e r i p h e r a l devices, such as modems, a c o u s t i c couplers, d i r e c t l i n e couplers, CRT t e r m i n a l s , keyboards, p r i n t e r s , i n t e r n a l or e x t e r n a l d i s k d r i v e s , and other input/output medium; magnetic media, i n c l u d i n g but not l i m i t e d to magnetic tapes, d i s k s , p e r i p h e r a l i n t e r f a c e boards, a l l output produced by or cause to be produced by a computed, i n c l u d i n g p r i n t e r output, t e l e t y p e output or other o f f i c e equipment output, a l l of s a i d devices to the seized and, t h e r e a f t e r l a t e r searched, i f time c o n s t r a i n t s and other c o n s i d e r a t i o n s are not conducive to o n s i t e searches. (u). Further, due to the f a c t that some or a l l of the above- described record may be stored by means of computerized i n f o r m a t i o n system, the items and m a t e r i a l s to be seized and searched s h a l l i n c l u d e : (1) . Any and a l l information and/or data stored i n the Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 49 of 50 form of magnetic or e l e c t r o n i c coding on computer media or on media capable of being read by a computer or w i t h the a i d of computer r e l a t e d equipment. This media includes floppy d i s k e t t e s , CD's, CD ROMS, magnetic tapes, f i x e d hard d r i v e s , f l a s h d r i v e s , hard d i s k e t t e s , video c a s s e t t e s , and a l l other media which are capable of s t o r i n g e l e c t r o n i c memory or magnetic coding. (2) . Any and a l l e l e c t r o n i c devices which are capable of analyzing, c r e a t i n g , d i s p l a y i n g , converting, or t r a n s m i t t i n g e l e c t r o n i c or magnetic computer impulses or data. These devices include computers, computer components, computer p e r i p h e r a l s word processing equipment, modems, monitors p r i n t e r , p l o t t e r s , encryption c i r c u i t boards, o p t i c a l scanners, e x t e r n a l hard d r i v e s and other computer r e l a t e d devices. Case l:l3-cr-00403-CAP Document l Filed 09/l0/l3 Page 50 of 50