Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 1 of 37 PageID# 2 UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGH AAs— ' i r • II E -- '' Alexandria Division 2 20IB UNITED STATES OF AMERICA - -j Criminal No 1 16-mj-406 V ANDREW OTTO BOGGS a k a INCURSIO UNDER SEAL JUSTIN GRAY LIVERMAN a k a D3F4ULT Defendants AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT AND ARREST WARRANTS I BJ Kang being first duly sworn hereby depose and state as follows 1 I am a Special Agent with the Federal Bureau of Investigation FBI assigned to the Washington Field Office WFO » Washington D C I have been employed by the FBI as a Special Agent since 2005 During that time I have participated in numerous investigations of fraud relating to the securities markets including market manipulation insider trading and Ponzi schemes and I have conducted or participated in arrests execution of search warrants surveillance debriefings of informants and reviews of taped conversations and securities trading records I am currently assigned to the criminal computer intrusion squad of the FBI WFO where I investigate crimes involving computer intrusions Prior to my assignment to WFO I was a Supervisory Special Agent at FBI Cyber Headquarters where I provided support to financially-motivated cyber intrusion investigations I have also received training in cybercrime investigation Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 2 of 37 PageID# 3 techniques computer evidence identification and analyzing and tracing digital currency As a Special Agent of the FBI I am authorized to investigate crimes involving fraud computer intrusion and other crimes stated under federal law including Title 18 of the United States Code 2 I make this affidavit in support of an application for a criminal complaint charging ANDREW OTTO BOGGS also known as INCURSIO and JUSTIN GRAY LIVERMAN also known as D3F4ULT with conspiring to violate numerous federal laws as prohibited by 18 U S C § 371 As described in more detail below BOGGS and LIVERMAN knowingly and willfully conspired to violate multiple federal laws including 18 U S C § 912 False personation of officer or employee of the United States 18 U S C § 1028A Aggravated Identity Theft 18 U S C §§ 1030 a 2 B C a 3 Fraud and related activity in connection with computers 18 U S C § 1038 False information and hoaxes and 47 U S C § 223 Harassing telephone calls 3 The facts in this affidavit come from my personal observations review of documents and audio recordings lawfully obtained information obtained from other agents and witnesses and my training and experience Because this affidavit is for the limited purpose of establishing probable cause for a criminal complaint it does not set forth every fact learned in the course of this investigation The Defendants and Co-Conspirators 4 Defendant ANDREW OTTO BOGGS and other members of the Conspiracy not charged herein were members of a Conspiracy that referred to itself as Crackas With Attitude or CWA The group targeted the personal Internet accounts of senior U S Government officials for hacking offenses Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 3 of 37 PageID# 4 5 Defendant JUSTIN GRAY LIVERMAN joined the Conspiracy to target certain senior U S Government officials for hacking offenses Other members of the Conspiracy not charged herein include the 6 following individuals based in the United Kingdom 1 an identified 17-year-old male known as CRACKA 2 an identified 17-year-old male known as DERP and 3 an identified 15-year-old male known as CUBED 7 The members of the Conspiracy utilized anonymizing software Twitter and other social media platforms and instant messaging applications to communicate with one another to obtain unlawful access to online accounts publicize their exploits and harass their victims The members of the Conspiracy utiHzed the following Twitter handles among others Name Twitter Screen Names JUSTIN LIVERMAN @ D3F4ULT @BASHTIEN @SH1N0D4 ANDREW BOGGS @INCURSIOSUBTER @GENUINELYSPOOKY CRACKA @PORNGOD @PHPHAX @D1CKREJECT DERP @DERPLAUGHING CUBED @FRUITYHAX 8 The Conspiracy utilized a technique known as social engineering accessed and attempted to access victims' online computer accounts without authorization obtained personal information and posted that information on the Internet for the purpose of harassing the victims The Conspiracy specifically targeted accounts Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 4 of 37 PageID# 5 belonging to senior U S Government officials their family members as well as individuals perceived to have connections to the U S Government The members of the Conspiracy then posted derogatory and harassing comments on the Internet about the victims and or contacted the victims via telephone to harass them further Manner and Means of the Conspiracy 9 The primary methods of the Conspiracy for infiltrating computer systems to further its unlawful goals can be summarized as follows a A member of the Conspiracy used anonymizing programs and social engineering techniques to obtain unauthorized and unlawful access to a victim's online account such as the victim's Internet Service Provider ISP account A member of the Conspiracy would in most cases change the password for that online account thereby locking the victim out of the account b A member of the Conspiracy would in some instances share the access informationto a victim's account with other members of the Conspiracy Using that access information a member of the Conspiracy would try to obtain unlawful access to other online accounts belonging to the victim such as web-based email or social media accounts c A member of the Conspiracy would obtain information from each victim account and post that information to the Internet for the purpose of harassing the victim In some cases members of the Conspiracy would make telephone calls or online posts for the purpose of harassing the victim Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 5 of 37 PageID# 6 Summary of the Conspiracy's Unlawful Activities 10 The Conspiracy targeted senior U S Government officials and computer systems belonging to the U S Government The targeted individuals and entities included the following a In or about October 2015 a member of the Conspiracy obtained unauthorized access to Victim 1 's AOL account The servers for AOL are located in the Eastern District of Virginia Victim 1 is a senior U S Government official who works and resides in the Eastern District of Virginia Using that access a member of the Conspiracy obtained unauthorized access to several other accounts belonging to Victim 1 or his her family members including accounts for Twitter Verizon Norton and other Internet services Members of the Conspiracy subsequently distributed via the Internet information obtained through this unauthorized and unlawful access to Victim I's accounts b In or about November 2015 a member of the Conspiracy obtained unauthorized access to Victim 2's Comcast ISP account At the time Victim 2 was a senior U S Government official who worked for a federal law enforcement agency Using Victim 2's credentials a member of the Conspiracy obtained unauthorized access to Victim 2's account for the Law Enforcement Enterprise Portal LEEP which is a U S Government computer system that provides law enforcement agencies intelligence groups and criminal justice entities with access to resources such as the Joint Automated Booking System JABS Internet Crime Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 6 of 37 PageID# 7 Complaint Center ICS and Virtual Command Center Special Interest Group The Conspiracy subsequently distributed via the Internet information obtained through this unauthorized and unlawful access to Victim 2's accounts c In or about December 2015 a member of the Conspiracy obtained unauthorized access to Victim 3's Verizon account Victim 3 is the spouse of a senior U S Government official d In or about December 2015 a member of the Conspiracy obtained unauthorized access to Victim 4's Comcast ISP account Victim 4 is a senior U S Government official who works for a federal law enforcement agency and resides in the Eastern District of Virginia The Conspiracy subsequently distributed via the Internet information obtained through this unauthorized and unlawful access to Victim 4's Comcast ISP account e In or about December 2015 a member of the Conspiracy obtained unauthorized access to the Facebook account of Victim 5's spouse Victim 5 is the CEO of a company that provides services such as intelligence Cyber and information technology to government and private sector customers A member of the Conspiracy also obtained unauthorized access to the Linkedin account belonging to Victim 5 as well as Victim 5's Comcast account f In or about January 2016 a member of the Conspiracy made a false bomb threat on a telephone to tl e Palm Beach County Sherriffs Office in West Palm Beach Florida Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 7 of 37 PageID# 8 g In or about January 2016 a member of the Conspiracy published data of more than 80 officers of the several Miami-area law enforcement agencies The data which included names work phone numbers emails and titles was previously obtained from the LEEP computer system when a member of the Conspiracy unlawfully accessed the LEEP computer system h In or about January 2016 and continuing to in or about February 2016 a member of the Conspiracy obtained information through unauthorized access to the Department of Justice's DOJ Case Information Management System CIMS application which is run by DOJ's Civil Division The Conspiracy subsequently distributed via the Internet information obtained through this unlawful access to the DOJ's Civil Division CIMS application The Unlawful Objects of the Conspiracy 11 In conducting the malicious computer activities summarized above and described in more detail herein members of the Conspiracy including BOGGS and LIVERMAN conspired to violate numerous federal statutes Those statutes include but are not necessarily limited to the following a 18 U S C § 912 falsely assumes or pretends to be an officer or employee acting under the authority of the United States or any department agency or officer thereof and acts as such or in such pretended character demands or obtains any money paper document or thing of value Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 8 of 37 PageID# 9 b 18 U S C § 1028A knowingly transfer possess or use without lawful authority a means of identification of another person during and in relation to a specified felony violation c 18 U S C § 1030 a 2 B intentionally access a computer without authorization or exceed unauthorized access and therefore obtain information from any department or agency of the United States d 18 U S C § 1030 a 2 C intentionally access a computer without authorization or exceed unauthorized access and therefore obtain information from any protected computer e 18 U S C § 1030 a 3 intentionally without authorization to access any nonpublic computer of a department or agency of the United States accesses such a computer of that departmentor agency that is exclusively for the use of the Government of the United States or in the case of a computer not exclusively for such use is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States f 18 U S C § 1038 engage in conduct with the intent to convey false or misleading information under circumstances where such information may reasonably be believed and where such information indicates that an activity has taken is taking or will take place that would constitute a violation of chapter 40 of Title 18 and g 47 U S C § 223 makes a telephone call or utilizes a telecommunications device whether or not conversation or communication ensues without 8 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 9 of 37 PageID# 10 disclosing his identity and with intent to abuse threaten or harass any specific person PROBABLE CAUSE The Conspiracy Begins 12 On or about July 17 2015 CRACKA using Twitter screen name @PORNGOD exchanged several Twitter direct messages DMs with Twitter handle ©GENUINELYSPOOKY an account controlled by ANDREW OTTO BOGGS ' In one of these DMs CRACKA related he had obtained the Social Security Number SSN of a senior U S Government official and and jacked his her comcast email so i can listen to his her voicemail look at his her answered calls and missed calls and control whats on his her tv Nvm i don't regret it fuck the gov Later that same day BOGGS using Twitter screen name gGENUINELYSPOOKY asked CRACKA if he would like to join Teamlnncuous BOGGS told CRACKA that We'll only be hitting governments and security firms I'm waiting on our logo to be finished before we commence attacks on governments CRACKA responded Sure I'd love to join P The Conspiracy Targets Victim 1 13 On or about October 12 2015 at approximately 1 06 p m EDT Victim 1's spouse received an email notification from Twitter indicating that Twitter had received a request to reset the password for his her Twitter account Victim 1's spouse ' Records from Twitter showed thatthe ©GENUINELYSPOOKY account was created on or about December 27 2014 from Internet Protocol IP address 24 182 73 99 An IP address is a unique string of numbers separated by periods that identifies each computer using the IP to communicate over a network Twitter records for @GENUINELYSPOOKY from on or about October 2 2015 to on or about November 11 2015 show that the ©GENUINELYSPOOKY account was frequently accessed from IP address 24 182 73 99 during this period Information obtained from Charter Communications revealed that IP address 24 182 73 99 during the relevant time period was assigned to ANDREW OTTO BOGGS's father in North Wilkesboro North Carolina with whom BOGGS lived Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 10 of 37 PageID# 11 had not requested that his her Twitter account password be reset On the same day Victim I's spouse received another email notification from Twitter regarding an unusual login attempt from an unusual device or location as well as a notification that the password to Victim 1's spouse's Twitter account had recently been changed Moreover later in the day Victim 1's spouse received a message on Victim I's spouse's smart phone that he she was being followed on Twitter by someone with the Twitter screen name @PHPHAX The notification read @phphax is now following you Victim I's spouse did not recognize this Twitter screen name which investigation has shown belonged to CRACKA 14 On or about October 12 2015 between approximately 4 24 p m EDT and approximately 4 35 p m EDT BOGGS using Twitter screen name @GENUINELYSPOOKY and CRACKA using Twitter screen name @PHPHAX engaged in the following DM conversation which your affiant believes refers to Victim 1 @GENUINELYSPOOKY I'm going to help you with Owning the U S Government Agency affiliated with Victim 1 I've been looking for evidence of aliens since Gary @PHPHAX i fucking own this loser i have just released emails of them admitting to torture @GENUINELYSPOOKY If you need any publishing done let me know I'll go Charlotte and use public wifi to publish the stolen information @PHPHAX 15 that sounds great On or about October 12 2015 Victim 1's spouse received an email notification fi om Verizon indicating that there was an update to Victim 1's Verizon account The email stated As a result of your recent contact with Verizon through our call center our automated phone system or our website we have updated your account to 10 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 11 of 37 PageID# 12 add or change your online password and or reset your Verizon online account Neither Victim 1 nor Victim 1's spouse had requested that the Verizon password be reset Records obtained from Verizon included October 11 2015 voice recordings from multiple calls by CRACKA who impersonated a Verizon employee and Victim 1 to gain unauthorized access into Victim I's Verizon ISP account 16 On or about October 13 2015 Victim 1's spouse received an email notification from AOL that the password to his her main AOL account had been reset The servers for AOL are located in the Eastern District of Virginia In addition the alternate email address for Victim 1's spouse's AOL account was changed to an email address associated with Twitter screen name @PHPHAX This email address was unfamiliar to Victim 1's spouse and which Victim 1's spouse did not authorize Because of the unauthorized password reset Victim 1's spouse was unable to access his her AOL email account 17 On or about October 12 2015 CRACKA @PHPHAX publicly posted on his Twitter page an image of what appears to be a screenshot of Victim 1's AT T wireless telephone bill 18 On or about October 13 2015 CRACKA @PHPHAX publicly posted on Twitter an image of what appears to be a screenshot of Victim 1's AOL account CRACKA @PHPHAX tweeted Its now just a battle between me and U S Government Agency they keep taking the account back and I keep taking it back after xD 19 Between on or about October 13 2015 and on or about October 18 2015 Victim 1 received multiple telephone calls to Victim 1's home and cellular telephones 11 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 12 of 37 PageID# 13 from CRACKA and or others Victim 1 works and resides in the Eastern District of Virginia The calls were harassing and derogatory in nature During this period other family members of Victim 1 located within the Eastern District of Virginia also received telephone calls from CRACKA and or others which were harassing in nature For example on one occasion CRACKA and or others allegedly stated to Victim 1 that we have totally taken over your email account again 20 On or about October 14 2015 at approximately 7 21 p m EDT BOGGS using Twitter screen name @GENUINELYSPOOKY sent CRACKA @PHPHAX a DM that read Hacked anymore U S Government Agency agents P CRACKA @PHPHAX replied that he had not hacked anymore U S Government Agency agents and that CRACKA had a one hour phone call with the New York Times regarding the compromise of Victim I's AOL account At approximately 7 44 p m EDT CRACKA @PHPHAX sent BOGGS @GENUINELYSPOOKY a DM that read oh also Victim 1 gets a 17% discount from Victim Ts ATT bills At approximately 9 03 p m EDT BOGGS ©GENUINELYSPOOKY replied That's not fair 21 On or about October 19 2015 BOGGS using Twitter screen name @INCURSIOSUBTER exchanged group Twitter DMs with CRACKA @PHPHAX and DERP @DERPLAUGHING regarding Victim 1 In these messages BOGGS and DERP offered their assistance to CRACKA with whatever we can help with BOGGS stated I want to carry on CRACKA's legacy if or when he is arrested I know he'll receive a harsh sentence because our government doesn't like being embarrassed so there's no better way of protesting than hacking and leaking more documents over and over again CRACKA then provided BOGGS and DERP with personal information 12 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 13 of 37 PageID# 14 belonging to Victim 1 and his her spouse that included home address and telephone number cellular telephone numbers Victim Ts spouse's SSN U S Passport number email accounts WiFi password MediaAccess Control MAC address and several Twitter links to screenshots partial redaction on some of screenshots with the follov ng descriptors A little bit of Victim 1's Contact list on Victim 1's email A screenshot of a email sent to Victim 1 on Victim I's email A screenshot of Victim Ts spouse's Amazon jacked A screenshot of Victim I's spouse's Verizon account jacked Proof ofjacking Victim I's ATT account Also BOGGS requested that CRACKA @PHPHAX untag @GENUINELYSPOOKY which BOGGS advised was his personal account from CRACKA's public tweets about Victim 1 and requested that CRACKA @PHPHAX instead tag @INCURSIOSUBTER 22 On or about October 20 2015 LIVERMAN using Twitter screen name @_D3F4ULT exchanged Twitter DMs with CRACKA @PHPHAX in which LIVERMAN congratulated CRACKA for successfully targeting Victim P CRACKA replied that Victim 1 got bent lol LIVERMAN then advised CRACKA to stay safe and dban any drive you don't need bro Your affiant understands DBAN to refer to A MAC address is a unique identifier assigned to network hardware interfaces for communications on a physical network such as Ethernet Time Warner Cable records foran IP address thatwas used to access the@_D3F4ULT and @BASHTIEN_ Twitter accounts during the relevant time period revealed the subscriber as Edith Liverman Open source research revealed that JUSTIN LIVERMAN resided with Edith Liverman during the relevant time period 13 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 14 of 37 PageID# 15 Darik's Boot and Nuke a program that can wipe a computer hard drive so that it is no longer readable 23 On or about November 1 2015 CRACKA @PHPHAX sent LIVERMAN @_D3F4ULT a Twitter DM asking for LIVERMAN's Jabber chat handle LIVERMAN replied by providing CRACKA with his Jabber chat handle The Conspiracy Targets Victim 2 and the LEEP Computer System 24 According to information obtained from computer hard drives used by LIVERMAN pursuant to a lawful search warrant on or about November 1 2015 LIVERMAN and CRACKA engaged in a Jabber chat session During this Jabber chat session at approximately 11 10 a m EDT CRACKA stated imma drop VICTIM 2's last 4 ssn lol At the time Victim 2 was a senior U S Government official who worked for a federal law enforcement agency LIVERMAN replied dooo itttttt LIVERMAN told CRACKA that he was located in Key West Florida ducking the miamipd Around 3 28 p m EDT CRACKA told LIVERMAN that he was in VICTIM 2's ISP account which is supported by Comcast records CRACKA also told LIVERMAN that Victim 2's spouse paid the bills for the ISP account Around 3 38 p m CRACKA sent LIVERMAN a link to a screen capture tool called LightShot Your affiant understands LightShot to be a program that allows a user to take a customizable screenshot of any area on his her desktop The LightShot link CRACKA sent to LIVERMAN appears to be a screenshot of Victim 2's monthly Comcast Xfmity bill that is partially redacted The monthly Comcast Xfinity bill lists VICTIM 2's spouse's name At approximately 3 48 p m EDT LIVERMAN told CRACKA to plz jack all Victim 2's shit haha Jabber is a free online instantmessaging service 14 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 15 of 37 PageID# 16 CRACKA told LIVERMAN that Victim 2 maintained a list of 200 contacts on the account Around 4 13 p m EDT LIVERMAN told CRACKA if you could get into Victim 2's U S Government Agency acc im sure it would yield At approximately 4 21 p m EDT LIVERMAN asked CRACKA how hard u think itll be to get into Victim 2's U S Government Agency email acc A few minutes later LIVERMAN stated that he never accessed the U S Government Agency's email servers but that it would be nice At approximately 4 42 p m EDT CRACKA shared with LIVERMAN information about Victim 2's Internet connection specifically Victim 2's MAC address Comcast records for Victim 2's Comcast Xfmity account shows the same MAC address as the one CRACKA shared with LIVERMAN At approximately 4 48 p m EDT CRACKA sent LIVERMAN a LightShot linkto an image of Victim 2's son 25 On or about November 1 2015 at approximately 6 02 14 p m EDT BOGGS using Twitter screen name @INCURSIOSUBTER sent CRACKA a Twitter DM asking What account did you hijack I wish I could get involved with hacking and programming for CWA Approximately 27 seconds later at 6 02 41 p m EDT CRACKA replied via DM 2nd highest person for U S Government Agency Approximately seven seconds later at 6 02 48 p m EDT CRACKA sent another DM to BOGGS with Victim 2's full name Approximately 11 seconds later at 6 02 59 p m EDT CRACKA sent another DM to BOGGS that read 200 email contact list At approximately 6 03 31 p m EDT BOGGS replied via DM Nice On or about November 30 2015 LIVERMAN using Twitter screen name @_D3f4ult publicly tweeted this image of Victim 2's son along with the following message Daaaaaaad our @comcast internet is down again 15 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 16 of 37 PageID# 17 26 On or about November 1 2015 at approximately 8 21 p m EDT LIVERMAN using the Facebook account Joseph Markowicz posted on Facebook damnit Victim 2's spouse's first name i thought i told you to pay that bill from @Cisco - Victim 2's full name senior government official of U S Government Agency lololol @phphax Moreover on or about November 2 2015 at approximately 12 19 a m EST LIVERMAN using Twitter screen name @_D3F4ULT publicly tweeted When you're senior government official of U S Government Agency but your wife still pays for the internet @PHPHAX along with a screenshot showing what appears to be a redacted version of a Comcast Xfmity payment dated September 7 2015 for Victim 2's Comcast account This is the same screenshot described above in paragraph 23 27 Computer hard drives used by LIVERMAN contained what appears to be contemporaneous Bandicam video recordings of some of his actions in relation to the Conspiracy On or about November 2 2015 LIVERMAN and CRACKA engaged in a Jabber chat session regarding Victim 2's cell number LIVERMAN asked is that realy Victim 2's cell CRACKA replied yes Imao and that CRACKA was calling people in Victim 2's call logs CRACKA also related Victim 2 fucking regained access to Victim 2's isp hahaha LIVERMAN replied daaaamn well you already got access to important shit LIVERMAN then told CRACKA that he would Facebook records for the Facebook account Joseph Markowicz showed that the registration email address was the same email address that was used to register the Twitter handle @_D3F4ULT Moreover the majority of the accesses to the Joseph Markowicz Facebook account for the relevant time period were from the same proxy IP address that was used almost exclusively to access the @_D3F4ULT Twitter account ' Bandicam is a screen recorder programthat can capture anything on a user's PC screen as high-quality video 16 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 17 of 37 PageID# 18 phonebomb Victim 2 if Victim 2's cell number was legitimate At approximately 1 42 p m EST LIVERMAN told CRACKA that Victim 2's cell number was legitimate According to call records for Victim 2's U S Government-issued cellular telephone a call that lasted approximately 30 seconds was received at approximately 1 42 p m EST from telephone number 213 267-XXXX According to Twitter telephone number 213 267-XXXX is a phone number associated with LIVERMAN's @_D3F4ULT Twitter account At approximately 1 44 p m EST LIVERMAN related when i heard Victim 2's voicemail i fcukkin spit my coffee everytwhere CRACKA replied im forwarding Victim 2's number so whoever calls Victim 2 gets forwarded to a anti-war number LOL LIVERMAN then replied waaaitttt I warma do something before that gonna tell people its my number and to call or text me A contemporaneous Bandicam recording dated on or about November 2 2015 made by LIVERMAN showed him setting up and paying $20 via Bitcoin for a phonebombing campaign against Victim 2's Government issued cellular telephone number whereby a call would be placed to Victim 2's cellular telephone according to the Bandicam recording every hour for 30 days The same contemporaneous Bandicam recording showed LIVERMAN sending by way of a computer application called Guerrilla Mail the following harassing text message to Victim 2's Government issued cellular telephone on multiple occasions Listen here you fucking boomer we will destroy your reputation Just like two senior U S Government officials including Victim 1 ®Phonebombing refers to the act of sending multiple phone callsand or text messages to a victim cellular telephone number for purposes of harassing the victim ' Guerrilla Mail is a free disposable email address service Visitors do not need to register to use the service Visitors are logged in automatically and a random email address is issued on each visit or they can set their own address 17 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 18 of 37 PageID# 19 I guess you couldn't handle us jacking your Comcast ISP accounts too many times so you actually canceled your account And telling me to watch my back wasn't a good idea lol How is your derogatory comment Incorrect spouse name We will keep a close eye on your family especially your son LIVERMAN also included in this message a LightShot link to an image of Victim 2's son Moreover at the end of this Bandicam recording LIVERMAN typed out the following note to himself in Notepad fucking golden Victim 2 of the U S Government Agency Victim 2's first name and middle initial fuck cant spell his lastname looooooool but yeah just boomer incharge on U S Government Agency jacked Victim 2's comcast isp account got Victim 2's 200 contact list found Victim 2's cell spammed it via email to sms and now phone bombing Victim 2 with zeekill threat voicemails lol 28 Moreover a review of another Bandicam recording dated on or about November 2 2015 shows LIVERMAN creating an account using Victim 2's name on the so-called darknet market Abraxas Market where your affiant know that various illegal items are sold including drugs 29 During the November 2 2015 Jabber chat session LIVERMAN told CRACKA that he wanted to post a message to Facebook soliciting texts and calls to Victim 2's cellular telephone number At approximately 1 54 p m EST LIVERMAN publicly posted the following Facebook message from his alias account of Joseph Markowicz t his line will be active for only 24hrs so call sms it if you want to talk to me i also accept sexy nudes lol Victim 2's Government-issued cellular telephone 18 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 19 of 37 PageID# 20 number #AnonSec d3f4ult Later that same day at approximately 5 31 p m EST LIVERMAN using Twitter screen name @_D3F4ULT publicly tweeted the same message 30 On or about November 4 2015 LIVERMAN and CRACKA engaged in another Jabber chat session in which LIVERMAN updated CRACKA on the status of the phonebombing campaign At approximately 3 32 p m EST LIVERMAN told CRACKA that if we could get Victim 2 swatted that would be amazing '' Laterthat day at approximately 6 05 p m EST CRACKA sent LIVERMAN an image via a LightShot link that appears to be a screenshot of the LEEP computer system login page showing Victim 2's full name displayed at the top of the page next to the words Log Out LIVERMAN asked CRACKA what information was contained on LEEP to which CRACKA responded every law enforcement info fticking shaking LIVERMAN replied holy fucking shitttttttttt LIVERMAN then asked CRACKA if he could search by state city because many officers info in miami i would love After LIVERMAN reiterated that i would love a list of officers in miami at approximately 6 43 p m EST CRACKA sent LIVERMAN by way of Jabber a list of more than 80 officers associated with Miami-area police departments 31 According to information obtained from computer hard drives used by LIVERMAN pursuant to a lawful search warrant a file titled miami_officers txt on one of LIVERMAN's hard drives contained the entire dump of informationrelating to AnonSec is a hacking collective that claims to have hacked over 700 websites LIVERMAN claims on his @_D3F4ULT Twitter biography to be A Official Admin of #AnonSec '' Swatting refers to the act of deceiving an emergency service via such means as hoaxing an emergency services dispatcher into dispatching an emergency response based on the false report of an ongoing critical incident 19 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 20 of 37 PageID# 21 more than 80 officers associated with Miami-area police departments Furthermore on or about November 4 2015 CRACKA advised LIVERMAN by way ofJabber chat that Victim 2 had not used the LEEP computer system since 2013 A review of Victim 2's internal LEEP access records show that the last time Victim 2 accessed LEEP was in 2013 32 On or about November 4 2015 at approximately 7 31 p m EST CRACKA sent DERP @DERPLAUGHING a DM that read tell incursio to get on cryptocat' its fucking insane you wont believe it At approximately one minute later 7 32 p m EST DERP replied Download Wickr' and show me it You can make your messages delete themselves after a certain you want them to I'll tell her now though ' CRACKA then replied tell incursio its insane like INSANELY INSANE At approximately two minutes later 7 34 p m EST CRACKA sent DERP a DM that read probably biggest hack ever 33 According to Criminal Justice Information Services CJIS and LEEP help desk audio recordings and records maintained by CJIS and LEEP on or about November 4 2015 from approximately 6 02 p m EST to approximately 7 26 p m EST CRACKA used Victim 2's computer credentials without authorization to access the LEEP computer system It is believed that CRACKA accessed portions of the LEEP Cryptocat is an application intended to allow encrypted online chat sessions Wickr instant messaging application allows users to exchange encrypted and contentexpiring messages including photos videos and file attachments ''' BOGGS represented through private communications with othermembers of the conspiracy that Incursio was a female located in North Carolina Access to the LEEP system is maintained by CJIS which is an FBI organization Generally CJIS help desk has the ability to reset passwords for FBI LEEP users 20 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 21 of 37 PageID# 22 computer system including JABS ' It is believed that CRACKA queried JABS for the name Jeremy Hammond ' The Conspiracy Releases Information It Unlawfully Obtained From the LEEP Computer System 34 On or about November 5 2015 at approximately 1 30 a m EST DERP using Twitter screen name @DERPLAUGHING publicly tweeted The @FBI are going to be really embarrassed today tomorrow #CWA 35 On or about November 5 2015 at approximately 11 33 a m EST CRACKA using Twitter screen name @PHPHAX publicly posted 34 000 lines of emails names position and phone numbers of gov associates including military 0 #CWA At approximately 11 40 a m EST CRACKA publicly posted Just to clear this up CWA did indeed have access to everybody in USA's private information now imagine if we was Russia or China #CWA At approximately 11 50 a m EST CRACKA publicly posted Do you guys want a screenshot of what JABS a federal arrest information tool looks like We found Jeremy Hammond lol Among other tweets at approximately 3 52 p m EST CRACKA publicly posted Happy Nov5 guys This is only part 1 Gov Police Military names emails and phone numbers This post included links to access this information on two websites Pastebin com and Cryptobin org The information posted on Pastebin com comprised approximately 295 JABS is a U S government computer system that helps federal law enforcement agencies book identify and share information quickly about persons in federal custody The U S Department of Justice developed JABS to support its law enforcement components Jeremy Hammond is a convicted computer hacker from Chicago Pastebin and Cryptobin are popular websites for storing and sharing text Though they are used for distributing legitimate data they also seem to be frequently used as a public repository of stolen information 21 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 22 of 37 PageID# 23 pages that listed the names title organization agency telephone number and email address of local and federal government officials 36 On or about November 8 2015 at approximately 2 21 p m EST BOGGS using Twitter screen name @INCURSIOSUBTER publicly tweeted Jeremy Hammond was sentenced to 10 years in federal prison while sabu got off scot-free for his cooperation This tweet included what appears to be a screenshot of Jeremy Hammond's JABS booking report that revealed his arrest photo date of birth date of arrest and other confidential information Victim 1 s Personal Information is Released 37 On or about October 21 2015 WikiLeaks announced that over the coming days it would release documents from Victim 1's personal email account Later that day WikiLeaks released on its website the contents of Victim I's personal email account including highly personal information such as Victim I's Standard Form 86 SF-86 and other information to include DOBs SSNs contact numbers and email addresses of individuals employed at law firms and the U S Senate ' WikiLeaks made additional information from Victim 1's personal email account available on or about October 22 2015 and October 26 2015 38 On or about November 9 2015 Twitter user @CthulhuSec ® publicly posted the following tweet Thanks to the #CWA @Fruityhax for providing the files directly Here is the Victim I's AOL Email Files Victim I's Employer thecthulhu SF-86 is entitled Questionnaire for National Security Positions SF-86 is used by the U S Government as part of its background investigation process into individuals seeking national security positions SF-86 contains highly personal information including social security numbers dates of births current and prior addresses of the applicant as well as family members The user of @CthulhuSec regularly hosts data on his server that others may have obtained from compromised accounts 22 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 23 of 37 PageID# 24 com This tweet contained an Internet Hnk to another web site titled U S Government Agency Data Leaks This web site contained links to download the personal data obtained from Victim I's AOL account including Victim Ts SF-86 form and attributed credit to the CWA group @phphax co The Conspiracy Tries to Regain Access to the LEEP Computer System 39 A member of the Conspiracy continued to try to regain access to the LEEP computer system by posing as Victim 2 and at other times posing as other government officials Specifically from on or about November 3 2015 to on or about December 20 2015 CRACKA and potentially other individuals called the LEEP help desk approximately 34 times and the CJIS help desk approximately 56 times These calls were recorded 40 On or about November 21 2015 CRACKA and BOGGS exchanged Twitter DMs about regaining access to the LEEP computer system CRACKA asked BOGGS whether he should add our aliases when i regain access BOGGS responded Yeah add our aliases and subsequently advised CRACKA to be careful and that he could end up in jail if the authorities attributed his activities back to him The Conspiracy Targets Victim 3 s Spouse 41 On or about December 10 2015 among other things LIVERMAN and CRACKA engaged in a Jabber chat session about Victim 3's spouse Specifically at approximately 5 17 p m EST LIVERMAN stated Victim 3's spouse talks mad shit abt snowden At approximately 5 19 p m EST LIVERMAN asked CRACKA if you come across anything related to Victim 3's spouse let me know and Victim 3's 23 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 24 of 37 PageID# 25 spouse needs to getrekt ' Approximately eleven minutes later LIVERMAN told CRACKA that bashtien wants to phonebomb the shitt outta Victim 3's spouse Bashtien is one of LIVERMAN's online identities that he used to obfuscate his true identity After CRACKA told LIVERMAN that he had obtained a purported address for Victim 3's spouse LIVERMAN stated I wish sic had Victim 3's spouse's cell and noted that bashtien rocked Victim 2's cell hard 720 voicemail threats and like 1000 goatse sms image messages CRACKA subsequently told LIVERMAN thathe had obtained Victim 3's spouse's Verizon ISP account number and was attempting to obtain the 4-digit PIN to their account 42 Records obtained from Verizon include voice recordings of several social engineering calls that CRACKA made on or about December 10 2015 to Verizon regarding Victim 3's Verizon account In the calls CRACKA impersonated both a Verizon employee and Victim 3 the account holder 43 During a December 12 2015 Jabber chat session at approximately 1 57 p m EST CRACKA sent LIVERMAN a LightShot link that appeared to be a Verizon web page with the words Please wait while we retrieve your account information LIVERMAN responded by asking if CRACKA had obtained access to Victim 3's Verizon account CRACKA replied that he was trying to see if he could access Victim 3's spouse's call logs and that he was having some issues logging into their Verizon account CRACKA stated the account keeps fucking up for me sometimes it lets me log in sometimes it doesn't At approximately 2 02 p m EST CRACKA stated i'll Rekt is Internet slang for wrecked Goatse refers to a lewd image of a naked man 24 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 25 of 37 PageID# 26 try logging in now it only lets me log in through tor loP i always login through tor on jacked accounts anyways CRACKA then asked LIVERMAN if LIVERMAN wanted to try logging into Victim 3's Verizon account LIVERMAN replied yes D LIVERMAN then told CRACKA to call Victim 3's spouse's cellular telephone number At approximately 2 19 p m EST LIVERMAN stated that he couldn't place the call himselfbecause i dont have any voip and down to my lastbumer ' Over the next few days CRACKA placed several calls to Victim 3's spouse's cellular telephone as well as Victim 3's home telephone Call records show that on or about December 12 2015 telephone number 213 204-XXXX placed an approximately 11-second call to Victim 3's cellular telephone Records from a Bitcoin exchange revealed that telephone number 213 204-XXXX is associated with an account under the name of Joseph Markowicz v th a registration email address of d3f4ult @ protonmail ch As described in earlier paragraphs Joseph Markowicz is the vanity name for LIVERMAN's Facebook account Moreover records for Twitter account @_D3F4ULT show the same registration email address of d3f4ult @ protonmail ch that was used to register the same Bitcoin account 44 During the same December 12 2015 Jabber chat session LIVERMAN and CRACKA discussed ways to deface the sign-on page for Victim 3's online Verizon account CRACKA sent LIVERMAN two versions of a defaced image for the account LIVERMAN and CRACKA also discussed how they should use Twitter to taunt Victim 3 Ultimately they decided to impersonate Edward Snowden to taunt Victim 3 on Tor is an encrypted network that can route your traffic through relays making the traffic appear to come from Tor exit nodes VoIP stands for Voiceover Internet Protocol VoIP is a technology that allows a user to make voice calls over the Internet Your affiant believes that the reference to burner is a reference to a burner mobile application that allows smartphone users to have temporary disposable telephone numbers 25 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 26 of 37 PageID# 27 Twitter At approximately 4 56 p m EST after discussing the exact text with CRACKA LIVERMAN using Twitter screen name @BASHTIEN_ publicly tweeted dis is @Snowden I heard u talkin shit Twitter handle associated to Victim 3's spouse so i tok ur acc bish The post included a defaced image of a Verizon account's sign-in page that included reference to three Twitter users cracka_d3f4ult_bashtien_2015 below the Verizon site key image of a snow man 45 During the same December 12 2015 Jabber chat session CRACKA provided LIVERMAN with the login credentials for Victim 3's online Verizon account A contemporaneous Bandicam recording made by LIVERMAN showed multiple attempts by LIVERMAN on or about December 12 2015 between 3 23 p m EST and 3 44 p m EST to access Victim 3's online Verizon account The contemporaneous video recording also showed LIVERMAN coordinating his efforts to access Victim 3's online Verizon account with CRACKA during the December 12 2015 Jabber chat session described above The Conspiracy Targets Victim 4 46 During a December 18 2015 Jabber chat session at approximately 8 16 p m EST CRACKA sent LIVERMAN a news article about Victim 4 with the comment Victim 4's getting hacked Victim 4 resides in the Eastern District of Virginia LIVERMAN responded less than a minute later fuck yeah plz do LIVERMAN stated that Victim 4 probably had some secrets At approximately 8 34 p m EST CRACKA stated i'll see what i can do 3 At approximately 9 21 p m EST LIVERMAN asked CRACKA if he had discovered Victim 4's cellular telephone number yet because id loooove to phonebomb Victim 4's voicemail and sms spam 26 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 27 of 37 PageID# 28 47 During a December 19 2015 Jabber chat session at approximately 3 27 p m EST CRACKA told LIVERMAN that he had obtained access to Victim 4's online Comcast account a fact which is supported by Comcast records Less than one minute later LIVERMAN responded roger that set off the explosivees Over the next few hours CRACKA and LIVERMAN discussed different ways of harassing Victim 4 using the information obtained from CRACKA's access to Victim 4's online Comcast account CRACKA sent LIVERMAN screenshots of his activities while in Victim 4's online Comcast account including evidence that CRACKA harassed Victim 4 by altering the settings for the Comcast account at Victim 4's home located in the Eastern District of Virginia such as resetting the passcode to Victim 4's voicemail remotely playing movies on Victim 4's family room cable box and renaming Victim 4's cable boxes to derogatory statements about Victim 4 LIVERMAN instructed CRACKA to send him Victim 4's call logs via Crytobin 48 Call logs for Victim 4's home Comcast account was found on one of LIVERMAN's hard drives 49 On or about December 19 2015 Victim 4 received a notification from Comcast that the password to Victim 4's online Comcast account had been changed Victim 4 also received a telephone call that was harassing in nature allegedly from CRACKA on or about December 19 2015 50 During a December 24 2015 Jabber chat session among other things CRACKA and LIVERMAN chatted about CRACKA's new Twitter account @DICKREJECT At approximately 5 56 p m EST CRACKA asked LIVERMAN if he 27 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 28 of 37 PageID# 29 should release Victim 4's call logs Within a minute LIVERMAN responded ayyyyyyyyyy fuck yes and early Christmas 51 On or about December 24 2015 at approximately 5 59 p m EST CRACKA using Twitter screen name @DICKREJECT publicly tweeted Merry Christmas @ Victim 4's law enforcementagency Victim 4 Call Logs cryptobin org XXXXXXXX Password is lol This Cryptobin link contained several pages worth of Victim 4's call records from Victim 4's home telephone number located in the Eastern District of Virginia from on or about September 20 2015 to on or about December 16 2015 The Conspiracy Targets Victim 5 52 During a December 27 2015 Jabber chat session at approximately 9 29 a m EST CRACKA told LIVERMAN that he would target Victim 5's company LIVERMAN asked why them About 30 minutes later CRACKA answered im targeting them because they supply gov to which LIVERMAN responded niice CRACKA first targeted the Facebook page belonging to Victim 5's spouse Facebook records revealed that the Facebookaccount belongingto Victim 5's spouse was accessed from a Tor IP address on or about December 27 2015 at approximately 2 22 p m EST At approximately 2 35 p m EST CRACKA shared a LightShot link of a draft post from Victim 5's spouse's Facebook page that read Jacked by Cracka CRACKA then found a January 1 2016 restaurant reservation for two at a restaurant near Victim 5's residence At approximately 3 17 p m EST LIVERMAN told CRACKA to cancel that shit which CRACKA replied i already cancelled it LIVERMAN and CRACKA then discussed different ways of harassing Victim 5 and Victim 5's spouse LIVERMAN and 28 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 29 of 37 PageID# 30 CRACKA then coordinated via Jabber chat a conversation they also had via Facebook as Victim 5's spouse and Joseph Markowicz an account controlled by LIVERMAN 53 A screenshot of a Facebook Friend Request from LIVERMAN to the compromised account of Victim 5's spouse's Facebook account which was compromised by CRACKA was found in one of LIVERMAN's computer hard drives 54 On or about December 27 2015 at approximately 4 09 p m EST CRACKA using Twitter screen name @DICKREJECT publicly tweeted There seems to be some strange posts coming from Victim 5's spouse's facebook account This tweet included a partial screenshot of purported Facebook messages from Victim 5's spouse For example one of these purported Facebook messages stated The US government funds Israel so they can kill innocent people in Palestine The US government and the Israel government are the real terrorists Bush Did 911 Jet fuel doesn't melt steel beams At approximately 6 09 p m EST CRACKA told LIVERMAN by way of Jabber chat that he took Victim 5's linkedin too Imao 55 On or about December 28 2015 at approximately 5 23 a m EST @DICKREJECT publicly tweeted this ceo is a derogatory comment hahahha Less than twenty minutes later @DICKREJECT publicly tweeted whats happened to Victim 5's Linkedin Linkedin com Victim 5's name This tweet included a screenshot of Victim 5's defaced Linkedin page that included recently fucking rekt by cracka Later that same day LIVERMAN using Twitter screen name @_D3F4ULT re-tweeted @DICKREJECT's tweet about Victim 5's defaced Linkedin page Linkedin records revealed that Victim 5's Linkedin page was accessed from Tor IP addresses on or about December 28 2015 29 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 30 of 37 PageID# 31 56 Later on December 28 2015 LIVERMAN and CRACKA by way of Jabber continued to chat about Victim 5's spouse's Facebook account At approximately 7 56 p m EST LIVERMAN stated awwww Victim 5's spouse defriended me CRACKA replied Victim 5's spouse must've seen our fucking facebook messages At approximately 8 07 p m EST LIVERMAN told CRACKA i just called Victim 5's spouse a whistler blower on twitter hhhhhhhhhhhhhhhhhhhhh '' On or about December 28 2015 at approximately 8 04 p m EST LIVERMAN using Twitter screen name @_D3F4ULT made the following public tweet shouts to Victim 5's spouse for showing #AnonSec that love becoming a whistleblower This tweet included a screenshot that appears to show Victim 5's spouse's compromised Facebook page Less than twenty minutes later approximately 8 20 p m EST @DICKREJECT tweeted a hashtag for FreePalestine This tweet included what appears to be a screenshot of Victim 5's spouse's defaced Facebook message response to a friend's messages that read If you are a friend of Victim 5's spouse please be aware that his her account has been hacked and ignore any offensive posts They are not firom Victim 5's spouse The purported response from Victim 5's spouse reads Derogatory term HOW IS SAYING FREE PALESTINE OFFENSIVE Derogatory comment FREE PALESTINE FUCK ISRAEL FREE PALESTINE FUCK ISRAEL The Conspiracy Releases Information About Miami-Area Police Officers Obtainedfrom the LEEP Computer System 57 On or about January 21 2016 LIVERMAN using Twitter screen name @BASHTIEN_ publicly tweeted links to two sites that contained information on more than 80 police officers employees of several Miami-area law enforcement agencies The data contained names work phone numbers emails and titles of more than 80 30 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 31 of 37 PageID# 32 officers employees of several Miami-area law enforcement agencies The data was obtained from the LEEP computer system in or about November 2015 when a member of the Conspiracy unlawfully accessed the LEEP computer system The Conspiracy Swats the Palm Beach Sheriffs Office 58 During a January 16 2016 Jabber chat session CRACKA and LIVERMAN discussed swatting a police department Below is a partial transcript of that Jabber chat session SENDER TIME TEXT CRACKA 3 46 11 PM CRACKA 3 47 03 PM im gonna swat a police department yolo CRACKA 3 47 04 PM Imao CRACKA 3 48 49 PM LIVERMAN 3 49 10 PM CRACKA 3 49 23 PM what shall i say ayyyyyyyy yolo fuck it what shall i say tho LIVERMAN 3 49 31 PM hopefully they will have a shootout and kill eachother CRACKA 3 49 32 PM CRACKA 3 49 36 PM i got bombs in the building LOL yeee CRACKA 3 49 49 PM shall i say i got bombs in the building LIVERMAN 3 51 25 PM yeaaa that usually works LIVERMAN 3 51 33 PM nano thermite hhhhhhhh CRACKA 3 51 54 PM LOL aight im doing it now CRACKA 3 52 14 PM im nervous as fuck CRACKA 3 54 08 PM IM DOING IT »»• CRACKA 3 59 29 PM i told them i had bombs at their building In the following minutes CRACKA shared several links to tweets and news articles about an unfolding bomb threat and building evacuation at the Palm Beach County Sheriff's Office's PBSO Belle Glade administrative building in Belle Glade Florida On or about January 16 2016 CRACBCA using Twitter screen name @DICKREJECT publicly tweeted about the swatting event several times including tagging LIVERMAN 31 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 32 of 37 PageID# 33 @BASHTIEN_ with emoticons of a smiley face and a heart In one of the tweets CRACKA said i love the chaos 8 59 According to records and an audio recording maintained by the PBSO on or about January 16 2015 at approximately 3 54 p m EST I believe that CRACKA contacted the PBSO non-emergency telephone line He told the dispatcher that I have some bombs He told the dispatcher that the bombs were at the Belle Glade Police Department provided a fake name and stated that he was calling from a phone that he found and that he was in a white truck He later stated that the bombs were actually at the location of a police-involved shooting that occurred earlier that day which garnered national media coverage The call lasted approximately five minutes 60 Moreover during the January 16 2016 Jabber chat between CRACKA and LIVERMAN CRACKA described his swatting call with the PBSO CRACKA related they asked me where i put them and i said i don't know LIVERMAN replied imagine all the ppl running around m thinking there is a bomb in the building CRACKA replied hhahahaa I GOT KIDS CRACKA related i said i was in a white truck dude legit she asked me where i put them in the police department or the sheriffs and i said hold on and searched up where the shooting happened 61 In response to this call the PBSO dispatched multiple police officers who evacuated the Belle Glade administrative building No explosive devices were found during a search of the building 62 LIVERMAN had a file named cwa_target on one of his hard drives This list contained the names of 14 victims to include the names of the Victims described herein 32 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 33 of 37 PageID# 34 The Conspiracy Targets the DOJ's CivilDivision s CIMSApplication 63 On or about January 30 2016 at approximately 1 39 p m EST a member of the Conspiracy using Twitter screen name @DOTGOVS publicly tweeted Oh This tweet included a screenshot of the DOJ's Civil Division Office of Management Information Case Information Management System's CIMS landing page The email address that was used to register the @DOTGOVS account was the same email address that was used to register the @PHPHAX account 64 On or about February 03 2016 CRACKA and LIVERMAN engaged in Jabber chat wherein CRACKA related i owned the entire doj like all doj agencies so fbi dea Interpol dhs i'm sitting here with 20k fbi employee names country email phone number title i have access to a doj computer CRACKA provided LIVERMAN with some screenshots to include a screenshot of what appears to be the main internal DOJ Civil Division landing page LIVERMAN stored the DOJ screenshots on his computer 65 On or about January 30 2016 at approximately 4 40 p m EST @DOTGOVS publicly tweeted 9 000 @DHSgov employees This tweet included a partial redacted screenshot containing names and dhs gov domain names 66 On or about January 30 2016 at approximately 5 13 p m EST @DOTGOVS publicly tweeted Why do we have 20 000 @FBI employees names phone numbers countries and emails Including ones abroad 67 According to the DOJ Justice Security Operations Center JSOC CIMS is a DOJ Civil Division intemal only application that is not publically accessible via the Internet A JSOC analysis determined that a member of the Conspiracy had social 33 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 34 of 37 PageID# 35 engineered the DOJ Civil Division help desk and then obtained access to an identified DOJ contract employee's credentials On multiple occasions between on or about January 27 2016 and on or about February 2 2016 a member of the Conspiracy used the employee's credentials to fully access the CIMS application and DOJ systems 68 On or about February 7 2016 at approximately 2 24 p m EST @DOTGOVS publicly tweeted well folks it looks like @TheJusticeDept has finally realized their computer has been breached after 1 week 69 On or about February 7 2016 at approximately 6 57 p m EST @DOTGOVS publicly tweeted ALL DHS GOV EMPLOYEES 9 000 NAMES TITLES PHONE NUMBER STATE EMAIL cryptobin org XXXXXXXX #FreePalestine pass password is lol The cryptobin org link in this tweet contained approximately 9 000 DHS employee names and their respective titles telephone numbers and email addresses in alphabetical order from A to Z 70 On or about February 7 2016 at approximately 9 02 p m EST @DOTGOVS publicly tweeted Tomorrow we shall release 20 000 FBI employeesdata including ones outside the US #FreePalestine 71 On or about February 7 2016 at approximately 10 26 p m EST @DOTGOVS publicly tweeted Ahoy there follow @IncursioSubter and wait for the 20 000 FBI employee data drop maybe it'll get dropped early 72 On or about February 8 2016 at approximately 3 43 p m EST @DOTGOVS publicly tweeted 20 000 FBI EMPLOYEES NAMES TITLES PHONE NUMBERS EMAILS COUNTRY cryptobin org XXXXXXXX password is lol #FreePalestine The cryptobin org Hnk in this tweet contained approximately 22 000 34 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 35 of 37 PageID# 36 FBI employee names and their respective titles telephone numbers and email addresses in alphabetical order from A to J 73 The entire 20 000 FBI employee information and the 9 000 DHS employee information were stored on LIVERMAN's computer 74 On or about February 9 2016 the U K authorities searched CRACKA's residence and conducted other law enforcement action 75 On or about February 10 2016 at approximately 9 26 a m EST BOGGS using Twitter screen name @INCURSIOSUBTER publicly tweeted Either the servers at cryptobin were overwhelmed or the feds shut it down I'm voting for the latter 76 On or about February 10 2016 at approximately 9 31 a m EST BOGGS using Twitter screen name @INCURSIOSUBTER publicly tweeted Archived indybay org uploads 2016 0 indybay org uploads 2016 0 @DotGovs Thesetwo indybay org upload links contained the thousands of FBI and DHS employee names telephone numbers and email addresses that were allegedly stolen from DOJ's CIMS application by way of unauthorized access as described above 77 On or about February 11 2016 at approximately 10 33 a m EST BOGGS using Twitter screen name @INCURSIOSUBTER publicly tweeted Before publishing any of the leaks from @dotgovs on pastebin make sure you're using a VPN or public wifi @pastebin is known for snitching 78 On or about February 11 2016 at approximately 11 54 a m EST BOGGS using Twitter screen name @INCURSIOSUBTER publicly tweeted Cryptobin went down roughly the same time a member of @dotgovs was arrested Do you still think it's coincidental 35 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 36 of 37 PageID# 37 79 On or about February 11 2016 at approximately 3 14 p m EST BOGGS using Twitter screen name @INCURSIOSUBTER publicly tweeted @DotGovs suspended Follow our backup @Dotgovz_ 80 On or about February 12 2016 at approximately 8 31 a m EST @DOTGOVZ_ publicly tweeted ghostbin com paste gd5rd raw Leak directory from most of our leaks Will be updated in future Not every leak is there This ghostbin com paste contains URLs to the thousands of FBI and DHS employee names telephone numbers and email addresses that were allegedly stolen from DOJ's CIMS application by way of unauthorized access Twitter records for @DOTGOVZ_ account appears to show that CUBED had access to the @DOTGOVZ_ account Specifically on or about February 11 2016 at approximately 3 11 p m EST a Twitter user sent a DM to @DOTGOVZ_ and asked if he was @Fruityhax A few minutes later @DOTGOVZ_ replied Yeh At approximately 3 24 p m EST @DOTGOVZ_ sent a DM to another Twitter user that read ill message you on my fruityhax account if you want On or about February 12 2016 at approximately 8 49 a m EST @DOTGOVZ_ sent a DM to another Twitter user that CRACKA was arrested by Law Enforcement Agency in the UK 36 Case 1 16-mj-00406-MSN Document 2 Filed 09 02 16 Page 37 of 37 PageID# 38 CONCLUSION 81 Based on the foregoing I believe that there is probable cause to support the attached complaint and associated arrest warrants for ANDREW OTTO BOGGS and JUSTIN GRAY LIVERMAN j 9 BJKang 7 Special AgeWt v J Federal Bureau of Investigation Reviewed by AUSA Jay V Prabhu AUSA Maya Song SAUSA LT Joseph V Longobardo Subscribed and sworn to before me on September 2016 AU Michael S Nachmanoff United States Magistrate Judge Honorable Michael S Nachmanoff United States Magistrate Judge Alexandria Virginia 37