Fake bomb threat arrest

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 1 of 17 AO 9l(Rev 08/09) CriminalComplaint

U NITED STATES D ISTRICT C OURT forthe Southern DistrictofFlorida

y FlLgnj

ns. ,

'

RAq -8 2016

United StatesofAmerica

STEVEN M.G RIMORE

cbER6U S DIST.CT.

CaseNo. 16-8075-JMH

s.D.OFFJ L/.-W.BB.

PrestonAlexanderMcW aters, Defendantls)

CRIM INAL CO M PLAINT 1,thecomplainantin thiscase,state thatthefollow ing istruetothebestofmy knowledgeand belief.

Onoraboutthedatets)of 12/11/2015throuqh3/4/2016 inthecountyof southern Districtof Florida ,thedefendantts)violated:

Palm Beach

inthe

-

CodeSection

OffenseDescription

18U.S.C.j875(c)' ,

Transmission in Interstate Commerce ofa CommunicationofThreatsto

18U.S.C.j 1038

Conveying False orMisleading lnformation Regarding an Expl osive Device.

InjurethePersonofAnother' ,and

Thiscrim inalcomplaintisbased on thesefacts: SEE ATTACHED AFFIDAVIT N

W Continuedontheattachedsheet.

hl.Comp inant' ssignature

Task Force A en ScottLiben ood FBI Printedn eand title

Sworn to before meand signed in my presence. Date: .

City and state:

W estPalm Beach, Florida

Jud 'ssignature

HonorableJamesHo ins,Uni tedStatesMa istrate Printe nameand title

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 2 of 17

A FFID A VIT IN SUPPO RT O F A R RE ST W AR R ANT

YourAffiant,ScottLibengood,doeshereby depose and stateasfollow s: 1.

Iam a lsfederallaw enforcementofficer''within the m eaning of FederalRule of

CriminalProeedure41(a)(2)(C),thatis,a govemmentagentengaged in enforcingthe criminal laws.lhavebeenemployedasaTaskForceOffceroftheFederalBureauoflnvestigation(FBl) since 2015,and am currently assigned to M iam iDivision,Palm Beach Office. 1am a federal1aw enforcementofficerwho isengaged in enforcing erim inallaws,including 18 U .S. C.jj875and 1038,and 1am authorized by theAttorney Generalto requestan ArrestW arrant. 2.

Ihave probable cause to believe thatPRESTON ALEXANDER M CW ATERS,

white m ale,date ofbirth July 24,1990,has comm itted one orm ore offensesagainstthe United

States,thatis,18 U.S.C.j 875(c),thetransmission in interstatecommerce ofacommunication

ofthreatsto injurethe person ofanother' ,and 18 U.S.C.j 1038,conveyingfalseormisleading informationregardinganexplosivedevice(i.e.makingfalsebombthreat). 3.

The statem ents contained in this affdavit are based in part on: inform ation

provided to me by FBlSpecialAgents;m itten reportsaboutthisand otherinvestigationsthatl have received,directly or indirectly,from other 1aw enforcementagents;infonuation gathered from the service of subpoenas,courtorders,and search warrants;the results of physicaland

eledronic surveillance conducted by law enforcem ent agents; independent investigation and analysisby FBlagents/analysts and com puterforensie professionals;and m y experience, training

and background as a Task Force Agentwith the FBI. Because this affidavitisbeing submitted for the lim ited purpose of securing authorization for the requested arrest w arrant, I have not included each and every factknow n to m e concerning this investigation. lqstead,lhavesetforth

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 3 of 17

only the factsthatIbelieveare necessary to establish thenecessary foundation forthe requested w arrant.

BA C K G R O UN D O F T H E IN VE ST IG A TIO N A ND PR O BA BLE C A USE

Stalking Report O n M arch 17,2015,the Oconee County Sheriffs O ffice responded to an address

in W atkinsville,Georgia in reference to a stalking complaint.Upon anival, the deputy m etw ith

the victim Devon Kenney (hereinafterKenney)and hermotherKathryn Cooper. Kermey and

hermother made a complaintthatPreston M cW aters (hereinafter M cW aters),a former coworkerwith Kenney,wasstalking Kenney by calling her,texting her,sending hermessageson Facebook,and hasbeen showing up attheirhouse.Kenney estimated thatM cW atershadtriedto eontactherapproxim ately 100 timesthrough telephone orothereledronic com municationsafter being asked to stop,and that he m ade the statem ent that if he couldn't have her, that no one could.

5.

Kenney advised the Sheriffs Deputy that M cW aters was outside their house

hiding and w hen K enney cam e outof the garage,M cW aters confronted her. K enney asked him

to leave and he did notuntilthey called the police. Kenney and her mother stated that his

behaviorfrightened them . 6.

The Sheriffs Office located M cW aters,who was residing atthe time, in Bogart,

Georgia. M cW atersadmitted to the SheriffsDeputy thathehad been atKenney'shome butsaid he rang the doorbelland Kenney cam eout. Further,he adm itted to being asked severaltimesto leave and thathe did notinitially com ply. M cW atersalleged thathe and Kenney had formally dated and he w as trying to patch things up.He was told not to have any further contact w ith

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 4 of 17

eitherKenney orhermother. This incidentwas docum ented in a Sheriffs Office report. The

allegationsfrom Kenneyweresufticientto warrantajudgeto issue at:-rhreatProtedion Order'' which prohibitsM cW atersfrom m aking contactwith Kelmey. The Orderisstillin effectand has been entered into the N CIC system TwitteraccountEricM ead8z

On Decem ber 11, 2015, a Twitter account was created under the username CtEricM ead8z''.This accountwasthen used to postseveralhoax bom b threatsto John 1. Leonard High School and the Palm Beach InternationalAirport, both loeated in Palm Beaeh County, Florida. Exam plesofthe postingsare asfollows:''The bombsatJohn 1. Leonard high schoolare going to blow soon!!!M en' y Christm asyou fucking kids!''and ''1hope palm beach intem ational

airportenjoysthebombslleh forthem l''.

EmailAccountseml8z@ usa.com andemead8z@ usa.com 8.

The Palm Beach Intem ationalA irportgeneralem ailalso received an em ailfrom

[email protected] on December30,2015,thatread ''Thebombsthatlhaveplaceatpalm beach intem ational airport are going to blow at 9:30 pm N ew Year's Eve.

The clock is ticking...

H appy new yearfuckersl''. O n February 2,2016,the Principalof Jupiter High Schoolin Palm Beach County

received an emailfrom [email protected],with the following threat: ''lhaveplaced several bombsatyourschool.They aresetto blow at2:30 pm on W ednesday 02/03/16. You w illalldie unlessyou do aslsay. lfyou callthe copsthen Iwillhave my friendscome to you house and they w ill kill your fam ily' '. This em ail created a panic situation that resulted in the school

having to be evacuated,allthe parents ofthe children had to respond to the schoolto pick up 3

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 5 of 17

theirchildren,and approximately two dozen law enforcem entofficersresponded to search the school. There was a follow up emailthe nextday stating thatitwas a hoax and the userwas laughing atthe police.

ThePrincipalofJohn 1.LeonardHigh School,located in Greenacres, Florida,also

received an emailfxom [email protected] on February 7,2016,thatread ''Ihave placed 5 bom bs containing c4 throughom John 1.Leonard high. l willdetonate the bombs at 1pm on

02/08/16 unless you deliver $500,000 ln cash the the address below. lf you do not comply within thattime,then lwilldetonate the bom bs and people W ILL die. You have m y demands. M ake the smartchoice and don'tgetinnocentpeople killed by infonning the police2111W hite PineCir,AptC GreenacresFlorida33415.'' There w asalso another em ailsentto the sam e PrincipalofJupiterH igh Schoolon

February 17,2016,from nightshade@ engineer.com thatread:''W ehaveplaced 10poundsof(24 plastie explosive around the interior of Jupiter eom munity high sehool. lf you do notbring

$10,000,000.00 in cash to 2500 Via Royale Apt.2508,Jupiter,Fl33458 by 12pm on Friday, then we willblow up yourschooland everyone inside. Thisisnota negotiabletenn. Don'tbe heroesand getpeoplekilled. Bring the cash and yoursehoolwillbespared the blood ofinfidels. Allah Akbar.'' The address provided in the em ailis the realhom e address of Eric M ead and

currentaddrtss ofDevon Kenney. Devon Kenney stated she relocated to Palm Beach County from Georgia in Aprilof2015 to live w ith herboyfriend Eric M ead. l2.

A com pany nam ed Kim ley Holm also received an em ail bom b threat from

[email protected] onJanuary27,2016,whichread ''Ihaveplaced severalpoundsofc4plastic explosive at one of your offices. 1920 W ekiva W ay Suite 200 W estPalm Beach, Fl33411 4

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 6 of 17

you do notcomply with m y demandsthen Iwilldetonate the bom bs and bring yourbuilding to the ground w ith everyone inside. lwant$500,000 deliverto the address2111white pine cir,apt

C in greenacres,Florida 33415. Y ou have 24 hours to com ply. lfyou callthe cops or any other funny businessthen you willcostalotoflives. Don'tdo anything stupid orelse. . . Kaboom !!!'' This em ail resulted in the evacuation of a multi-stol. y building with many businesses and employees. The City of W est Palm Beach Police Department and Fire Departm entresponded and searched the officebuilding.Nothing wasfound.

Interview ofEricM ead 14.

O n Decem ber 30,2015,a fonner A thens, Georgia butnow Palm Beach County

resident named Eric M ead was located and interviewed. M ead denied any know ledge or involvem entin the creation orow nership of the l'EricM ead8z''Tw itteraccount. How ever,M ead

contirmed the photo attached to the tsEricM ead8z''Twitter account was him . M ead said the

address listed on the Twitterposting,2111 W hite Pine Circle, w as his m other's address.M ead stated that he works at the Kimley Horn oftsce in W est Palm Beach, Florida, and the kû82'' representsM ead'syearofbirth. On January 21,2016,due to on-going socialmedia postings negatively affecting hisreputation,EricM ead m adean identitytheftreportto theJupiterFloridaPolice Departm ent. 16.

Currently,EricM ead istheboyfriend ofKenney.

Twitter, Tracfone,and . dT&T Records

17. On Febnlary 9, 2016, a judicial order requested Twitter, lnc. provide Account/subscriberlnformation and IP Recordson the tiEricM ead8z''account. O n February 11, 2016,Tw itter,lnc.provided the requested inform ation.Upon review ing the infonnation, itw as 5

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 7 of 17

determined thatthe çlEricM ead8z''Twitteraccountwas ereated on December l1, 2015,at 19:01

hours(7:01PM )using AT&T W irelessphonenumber561-797-9156.YourAffiantknowsthat in orderto create the account,Twitterrequiresveritication by sending eitheran em ailto an email accountoratextm essageto acellulartelephone. Additional investigative work and subpoena compliance revealed that 561-797-

9156 was a Tracfone (a prepaid wireless service provider) with cellular phone/data services being provided by AT&T W ireless.The 561-797-9156 num ber/account was purchased at a W alm art store on Lexington Road in Athens, Georgia on Decem ber 11,2015 and activated on the sam e date, and deactivated on January 11, 2016. The nam e registered on the Tracfone account w as Eric M ead, W est Palm Beach, FL 33415, w ith an em ail address of

emead8z@ usa.com.

second Tracfone, 561-601-3416, was also purchased at the same

W almartstore on January 22,2016,and itwas activated with Tracfone and AT&T on January 24,20l6. The nam e registered on the seeond Tracfone aecount,561-601-3416, w as also Eric M ead,W estPalm Beach,FL 33415.

19.

W hen he was interviewed, Eric M ead was asked about the first Tracfone

purchase. M ead denied making any Tracfone purchases and stated thathe did notgive anyone permission to purchasea Tracfone in hisnam e. 20.

Further investigation revealed that Traefone number 561-797-9156 received an

SM S messagefrom 40404 (40404 isa shorteodeto allow mobilephonesto aeeessTwitter)on

December 11,2015,at 19:03 hours (7:03 PM );thiswould indicate Twitterwasverifying the creation of the account.Cellularrecords subpoenaed from AT&T W ireless revealed that 561797-9156 sentand received SM S m essages to 40404 approxim ately sixteen tim es, approxim ately

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 8 of 17

five ofthose timeswere on December l6,2015,which isthe sam e day thatthe iûEricM ead8z'' Tw itter accounthad approxim ately four postings threatening to blow up John 1. Leonard High

School. Search Klarrants

21.

On February l2,2016,tw o StateofFlorida search warrantswere authorized. The

tirst warrant requested Twitter Inc.to disclose a1l information regarding the ktEricM ead8z'' accountand a second Twitteraceountunderthe nam e ''M eadLewis''. Both ofthese accounts were made using the sam eprotilepidureoftherealErie M ead. The realErie M ead saidthatthe picture may have been copied from anothersocialm edia accountthathe had created before he

moved to Florida called Linkedln. The second warrantrequested Facebook lnc. to disclose a11 inform ation regarding an ''Eric M ead''accountwhich had been created with the same profile picture used in the fake Eric M ead Twitter accounts and was now being used to send death threatsto K enney.

Lewis is the fonner last nam e of the real Eric M ead before he had it legally changed.Thisnew StM eadlwewis''accountwasused to makepostingsofdeath threatsdirected at Kenney. The ''M eadLew is'' Tw itter account w as used to send several m essages to Kenney's Tw itter accountone of w hich read ''your going to fucking die you cuntbitch, lw antto hearyou

scream while Iskullfuck you,you psychotic whorel''. The fake Facebook ''Eric M ead''account wasused to send severaldeath and rape threalm essagesto Kenney'sFacebook account,one of w hich read: ''They are going to com e to your house in Florida and are going to rape and kill you... You disgusting fuck slut. l've paid them w ell. Your gonna suffer.''U nlike the other m essages sent,thism essage sentthrough Facebook show sthatitw asposted via m obile.

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 9 of 17

YourAffantbelievesthatthe suspectisusing both a com puterand atelephone to send these death threats. 24.

On February 22, 2016,Tw itter lnc.provided the follow ing inform ation: a new

telephone number,561-601-3416,had been used in the creation ofthe ilM eadlwewis''accounton

January25,2016,[email protected]. WalmartPurchasesofthe Tracfones W almartsecurity investigatorshave been able to identify the store security video of the tinaneialtransadions for the purehases of the two Tracfones. They have supplied the transadions and the video to the FBI. Upon looking atthe stillphotographs ofthe individual m aking the purchases,the suspectappears to be a w hite m ale, m edium build,20 to 30 yearsof age,w ith slightfacialhair. He appears to be w earing the sam e hatin both ofthese transactions,

possibly a tan colored baseballhatwith the University of Georgia em blem on it. ln the first

transaction,heappearsto bewearing aratheruniquejacket,onethatisablack and camouflage pattern. ln the second transaction,the suspectcan be seen leaving the store driving a newer m odelreddish in colorChevroletCam aro. 26.

On February 24,2016,W alm artsecurity from Athens, Georgia contacted the FBI.

They had been instructed to be on the lookoutforthe individualreturning to the W alm art. O ne ofthe security officersthathad reviewed the video tape and waslooking outforthe suspectwas

outsideW almartataShellgasstationatCollegeRoad andBarnet'tSholasRoad inAthens(Your Affiant knows thatthis road is near the subdivision where M cW aters resides). The security officer observed the individual at that gas station/store and identitied him from the video surveillance from W almart. The security officertook a picture ofhim and his carwith the tag 8

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 10 of 17

number and sentitto the FBI. ltshould be noted thatW almartseeurity personnelwere never advised of the suspect's name,Preston M cW aters or the tag num ber of M cW aters Chevrolet Cam aro. W alm artsecurity m ade the identification on theirow n. Thetag num berofthe vehicle

that they identified is identical to M cW aters' tag number,Georgia plate num ber CEG9185. Georgia DM V records show that this tag is registered to Preston M cW aters and his mother AnnettePhelabaum ,155 SnapfingerLane,Athens,Georgia. 27.

Y our A ffiant has review ed the G eorgia Driver's License photograph of Preston

M cW aters,white male date ofbirth July 24,1990,and compared itto the photos ofthe susped purchasing the phones at W alm art. The suspect looks like M cW aters. Investigation has also

revealed that the house located at 155 Snaptsnger Lane in Athens, Georgia, is ow ned by M cW aters'mother,Phelabaum ,however,M cW atershasthisaddressashisplaceofresidence in num erous databases.

Surveillance OfSUBJECT PREM ISES 28.

On or about February 22, 2016, the FBI in Athens conducted a drive by

surveillance ofthishouse and located M cW aters red Camaro atthis address. Your Affianthas conducted a googlem aps search and hasdeterminedthatthere are threeW almartsin the Athens, Georgia area. The W alm arton Lexington Road where the Tracfones w ere purchased is the closestone to M cW aters house,itisapproxim ately 5 m ilesaw ay.

29.

On February 29,2016,FBI Agents conducted surveillance of 155 Snapfinger

Lane. D ue to the ruralnature of the neighborhood,the A gents w ere unable to setup directly in

frontofthehome. TheAgentswere ableto seefrom adistancethatasubjectwho matchesthe description ofPreston MeW aters,(and based upon a1ltheknown facts,YourAftiantbelievesis 9

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 11 of 17

McW aters),did comeoutoftheresidenceand droveawayin McW aters'red in colorChevrolet Camaro atapproxim ately 5:15 am . TheAgentsfollowed him to theUniversity ofGeorgiawhere hestayed forthe day apparently working. They then followed him back to 155 SnapfingerLane thatafternoon.

EmplovmentofM cWaters

YourAffianthasalso learned through the University ofGeorgia (UGA)Police Departm entthat M cW aters works atUGA in the dining hall in Athens, G eorgia. The U GA police have provided a copy ofM cW aters work schedule and itshowsthathe worksas early as 5:55 am .

CellSiteLocation from Tracfones On February 22,2016,a Florida state courtorder requested thatAT& T provide tollrecordsand cellular site location data forthe tirsttargettelephone, 561-797-9156. On that sam e day,A T& T responded w ith the requested inform ation. The FBl conducted a cell phone

analysisofthe data and provided the following response: The resultswere thattargettelephone 561-797-5156 connected to the cellular towers 28 tim es. O f those 28 tim es, 24 times (on

12/11/2015and 12/15/2015)thecelltowerlocation data showed thatthetargettelephonewasin the geographicalarea of 155 SnapfingerLane,Athens,Georgia. The remaining 4 times(on

12/16/2015),the targettelephone wasin the geographicalarea ofthe University ofGeorgia in Athens. Those dates are significant because D ecem ber 11th 2015 w as the date the phone was

purchased,activated,and used to create the fake ''EricM ead8z''Twitteraccount. D ecem ber 15tb5 2015 was the date that the firsttw o m essages w ere posted on the ''EricM ead8z''account which were generalin nature and it appeared that the suspectw as testing the account. D ecem ber 16th5

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 12 of 17

20l5 issignitseantbecause thatwasthe date thatthe firstbom b threatsto John 1.Leonard High Schoolwereposted. 32.

On February,25,2016,a state courtorderrequested thatAT&T provide cellsite

records on the second Tracfone, 561-601-3416. These records show that the target telephone connected to Tw itter via textm essaging to 40404 tw o tim es on January 25,2016, which w asthe

creation dateofthe second fake Eric M ead Twitteraccount''M ead Lewis''.The FBIconducted a cellphoneanalysisofthe data and provided the following response: The resultswere thattarget telephone 561-601-3416 connected to the sam e cellular tow ers as did the previous target telephone,this tim e a totalof 14 tim es on January 24,2016, and onee on January 29,2016. Of the 14 tim es on January 24th, the ce11tow er location data show ed thatthe targettelephone w as in the geographical area of 155 Snapfinger Lane,Athens,G eorgia. The rem aining one tim e, the phone w as in a geographicalarea south w estofAthens. IP Addresses 33.

During the course ofthe investigation,subpoenas and search w arrants have been

directed to variouscompaniesin an attemptto identify the internetprotocol(IP)addressfrom where the emailm essagesare being sent. One ofthe companies identified is 1& 1,who is the

domain holder of numerous free email accounts including @ usa.com, @techie.com, and @ engineer.eom. The response from Facebook showed thatthe aceountwascreated using an emailaddressoferic8z@ techie.com . Alloftheresponsesfrom l&1,Facebook,Twitter,and Tracfone have been traced by IP address back to a com pany nam ed London TrustM edia dba privateinternetaccess.com . This com pany isan anonym izing com pany whose pum ose isto allow

users ofthe internetto m ask their originalIP address w here they are sending m essages from .

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 13 of 17

subpoena was senttt?London TrustM edia and the only information they eould provide isthat the cluster of IP addresses being used w as from the east eoast of the U nited States. How ever,

London Trustdid providethatthey acceptpaym entfortheirservicesthrough creditcard with a vendorcompany ofStripe and/orAmazon. They also acceptforms ofpaym entonline through paypal,bitpay,bitcoin,cashyou,ripple,ok pay,and pay garden. Although the investigation hasnotrevealed any paymentby M cW atersto London Trust, he did m ake a purchase from AnchorFree 1nc on O ctober 23, 2015. A nchorFree,

according to their website,is a HotspotShield VPN (virtualprivate network) service that itprotectsyourIP address,enabling you to surftheweb anonym ously and privately''. BankRecords On February 29,2016,a subpoena w as sentto the FirstM adison Bank in Athens,

Georgia requesting banking records for Preston M cW aters. FirstM adison responded with the requested infonnation. The banking records show thatM cW aters listed his address as the 155 Snaptinger Lane in Athens, Georgia. The banking records also show that on Decem ber 11,

2015,M cW aters m ade a cash withdrawalof $80.00 and on January 22,2016,he m ade a cash withdrawalof$60.00. These datesaresigniticantbecause these are the exactsame datesthatthe prepaid Tracfonesdiscussed previously in thisafidavitwere purchased from W alm artin Athens

with eash. On the January 22,20l6,transaction,thecashtendered attheregisterwas$60.00,the exad am ount that M cW aters withdrew from his bank account that day.First M adison also provided video surveillance photos of M cW aters m aking the withdrawals on those two dates. On Decem ber 11tb, the photo show s M cW aters face directly in front of the cam era m aking the w ithdraw alat 11:44 am . In the photo you can also see thathe isw earing sunglasses, ablack and

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 14 of 17

camouflagecoloredjacket,andabaseballstylehatwiththeUniversity ofGeorgiaemblem on it. H e is driving a dark eolored Jeep SU V . This elothing m atches the deseription of the clothing

worn by the suspectpurchasing the firsttracfone referred to in this affidavit,561-797-9156, at the W alm artstore on this sam e date at 12:11 pm . Therefore,your A ffantbelieves that it was

M cW aters who purchased the Tracfone on December 11,2015. The FBltook a picture of 155 Snapfinger Lane while conducting surveillance on February 29,20l6. M cW aters'red in color

Cam aro and a dark colored Jeep SUV were parked in the drivew ay. The video surveillance photos also show the transaction that occurred on Janual'y 22,2016. A t 8:14 am .M eW aters

dxivesup lo the ATM in hisred in colorCam aro.The camera angle did notcapture a picture of his face because the vehicle sits too low to the ground. How ever, the vehicle m atches the

description ofthe vehicle thatthe suspectdrove to W alm arton thatsame day to purchase the second Tracfone referred to in this aftidavit, 561-601-3416, at 10:04 am . Based on the

surveillanee video from the bank and W alm art,yourAffantbelievesthatitwasM cW aterswho purchased the second Tracfone on January 22,2016. Activity O rl-etpïp.e .

On M arch 4,2016,at 1:03 am ,the principalofa Palm Beach County Elem entary

schoolreceived anemailfrom DevonKenneyg4@ mail.com thatstatedthefollowing: ûkWehave plaeed 13 chemicalweaponsthroughoutyourfacilities.They willdetonate at10:30 a.m .M arch

7,2016 ifyou do noteomply with ourdemands and bring $20,000,000.00 to 2500 Via Royale Apt.2508.Jupiter,FL 33458 by the tim e ofdetonation. lfyou even try to contactthe authorities and alertthem to the situation then w e w illdetonate the w eapons early and everyone of your students w illdie. You have 4 days.Do not fuck w ith us!W e are w atching you kkLeslie Bolte''

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 15 of 17

and yourfam ily.''

Search ofResidence 37.

On M arch 7, 2016, a federal search warrantwas signed by a United States

M agistrate Judge in the M iddle Districtof Georgia authorizing the search of 155 Snapfinger Lane in A thens, Georgia. O n M arch 8, 2016, FB I A gents executed the search w arrant.

M cW aterswaslocated in hisbedroom and in hispossession washisApple iphone.Upon gaining

aeeessto the iphone,a mobile application forPrivate InternttAccess (PIA)was discovered. Private IntenwtAccessisa VPN (VirtualPrivateNetwork)providerthatspecializesin secure, encrypted VPN tunnels which create several layers of privacy and security.Private Internet Access is affiliated with London TrustM edia.A11em ailaddresses responsible for the emailed bom b threatswere em ailaddresses owned by London TrustM edia.A search ofM cW aters'red Chevrolet Cam aro revealed tw o LG m odel=ar chargers.These car chargers are notcom patible

with M cW atersiphone and are believed to be the carchargersforthetwo TracFonespurchased by M cW aters. Also in the vehicle was a note with the following information: PlA .com

,

U sem am e:p6808444,Passw ord:ZPDN 9YhkAe.M cW aters'w allet,to include his identification,

wasin thered Cam aro.

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 16 of 17

CONCLUSION 38.

Based on theforegoing,there isprobableeauseto believe thatthefederalerim inal

statutes cited herein have been violated by PRESTON ALEXANDER M CW ATERS and that suftivientevideneehasbeen presented to authorize an arrestwarrant. lrespectfully requestthat this Courtissue an arrestw arrantforPRESTON A LEXA N D ER M CW ATER S.

Respectfu y subm itted, g

ScottLlben OX

Task Force O fticer FederalBureau oflnvestigation

subscribedandswol. ntobeforemeonthis S''dayofMarch,2016

y N O RA BLE JA M ES M . PKIN S UN ITED STA TES M AG ISTR ATE JU DG E

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 17 of 17

U N ITED STA TES D ISTR IC T C O U R T SOUTH ERN DISTRICT OF FLORIDA C ase N o.:16-80754 M 11

FILED BY

UNITED STATES OF AM ERICA,

MA2 23 21s

V.

STEVEN M.1. . /91:408E CLERK U. S DIST CT, S.D OF FLA ,i%PB

PRESTO N A LEX AN D ER M CW AT ER S, D efendant.

COVER SHEET Didthism atteroriginatefrom am atterpendingintheNorthern RegionoftheUnited States Attorney'sO ffice priorto O ctober 14,20032 Y es X No 2.

D id this m atteroriginate from a m atterpending in the CentralRegion ofthe United States Attorney'sOfficepriorto September1,2007? Yes X No Respectfully subm itted, W IFREDO A .FERRER UN ITED STATES ATTO

EY

By: * Edw ard C.N ucci A ssistantU nited StatesA ttorney

FloridaBarNo.794406 United StatesAttorney'sOffice Southern D istrictofFlorida 500 S.A ustralian A venue,Suite 400 W estPalm Beach,Florida33401

Teleghone:(561)820-871l Facslmile:(561)805-4986

Em ail:Edward.Nuccirg,usdoi.gov

D.C.