Case Documentnb truest Page J. of l4 PageiD 1 IN THE UNITED STATES 3 FOR THE NORTHERN DISTRICT ?Tm" TEXAS DALLAS DIVISION I "m ?mi i '20? UNITED STATES OF AMERICA N0. 3 i a, t?vw?vrvr ?Tani?QC}. T.) V. Luputy JOHNRAYNERIVELLO 1 CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best of my knowledge and belief: On or about December 15, 2016, in the Dallas Division of the Northern District of Texas and elsewhere, defendant John Rayne Rivello, with the intent to kill, injure, harass, and intimidate, did knowingly and intentionally use an interactive computer service and an electronic communication service to engage in a course of conduct that placed a person in reasonable fear of the death of and serious bodily injury to that person and caused, attempted to cause, and would be reasonably expected to cause substantial emotional distress to that person; in that Rivello posed as Twitter user Ari Goldstein and used his Twitter account @j ew_goldstein to post an animated Graphics Interchange Format (GIF) on the Victim?s Twitter feed, knowing that the Victim was an epileptic and knowing that the animated GIF was a strobe bearing the message DESERVE A SEIZURE FOR YOUR In violation of 18 Use. and (B), and 18 U.S.C. 2261(b)(3). This criminal complaint is based on the facts set out in the attached af?davit. Ma NATHAN P. Special Agent Federal Bureau of Investigation or to before me and signed 1n-my presence in Dallas, Texas, on March /0 2017 U. 3. DISTRICT COURT NORTHERN DISTRICT OF TEXAS FILED MAR I 20!? UNITE STATES MA ISTR EJUDG a, CLERK, U.S. DISTRICTVCOURT Bv . . Wyn-mu. PM . .1 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 2 of 14 PageID 2 AFFIDAVIT I, Nathan P. Hopp, a Special Agent (SA) with the Federal Bureau of Investigation (FBI), being duly sworn, hereby depose and state as follows: INTRODUCTION 1. I have been a Special Agent with the FBI since December 3, 2010. I am currently assigned to the Dallas Division of the FBI, Cyber Crime Squad, where I investigate computer crimes including computer intrusion. I have gained experience in conducting these investigations through training in seminars, classes, and day?to?day work related to investigations of this type. 2. As a federal agent, I am authorized to investigate violations of laws of the United States and to execute warrants issued under the authority of the United States. 3. The information contained in this af?davit is based upon my personal knowledge of the described investigation and from information obtained from other law enforcement agents. Since this af?davit is being submitted for the limited purpose of securing an arrest warrant, I have not included each and every fact known to me concerning this investigation. Instead, I have set forth only the facts that I believe are necessary to establish probable cause to believe that John Rayne Rivello did knowingly commit the offense described herein. 4. This af?davit is submitted in support of a criminal complaint charging John Rayne Rivello with Cyber Stalking, in violation of 18 U.S.C. and (B). Section and (B) provide in pertinent part as follows: Af?davit-Page 1 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 3 of 14 PageID 3 Whoever? (2) with the intent to kill, injure, harass, intimidate . . . uses . . . any interactive computer service or electronic communication service or electronic communication system of interstate commerce, or any other facility of interstate or foreign commerce to engage in a course of conduct that? (A) places that person in reasonable fear of the death of or serious bodily injury to [that] person; or (B) causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress to [that] person; shall be punished as provided in section 2261(b) of this title. 18 U.S.C. 226l(b)(3) provides imprisonment ?for not more than 10 years, if serious bodily injury to the victim results or if the offender uses a dangerous weapon during the offense.? 5. 18 U.S.C. 2262(2) defines ?course of conduct? as a ?pattern of conduct composed of 2 or more acts, evidencing a continuity of purpose.? 18 U.S.C. 1365(h)(3) defines ?serious bodily injury? as any ?bodily injury which involves a substantial risk of death, extreme physical pain, protracted and obvious dis?gurement; or protracted loss or impairment of the function of a bodily member, organ, or mental faculty.? The Fifth Circuit Pattern Jury Instructions define a ?dangerous weapon? as ?any object capable of in?icting death or serious bodily injury.? 6. The images included in this affidavit have been redacted. BACKGROUND AND OVERVIEW OF INVESTIGATION 7. The FBI and the United States Attorney?s Office are investigating a crime in which Victim#l, an individual known to John Rayne Rivello and others to Af?davit?Page 2 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 4 of 14 PageID 4 suffer from epilepsy, received a message over the social media platform Twitter from Rivello, who was using the Twitter handle Ari Goldstein@jew_goldstein. The cash? NM . . . .massage' also referred to as a tweet, contained an animated strobe 1mage embedded with the statement, ?You deserve a seizure for your post.? The strobe image ?ashed automatically when the tweet was viewed by Victim#1. Upon viewing the ?ashing strobe image, Victim#l immediately suffered a seizure. 8. Twitter owns and operates a free?access social-networking website of the same name that can be accessed at Twitter permits users with Twitter accounts to create, share and read l40-character messages called ?Tweets.? Upon creating a Twitter account, a Twitter user must create a unique Twitter username and an account password, and the user may also select a different name of 20 characters or fewer to identify his or her Twitter account. 9. Twitter asks users to provide basic identity and contact information, either during the registration process or thereafter. This information may include the user?s full name, e?mail addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, occupation, and other personal identifiers. For each user, Twitter may retain information about the date and time at which the user?s profile was created, the date and time at which the account was created, and the Internet Protocol address at the time of sign?up. Affidavit?Page 3 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 5 of 14 PageID 5 10. Twitter keeps IP logs for each user. These logs contain information about the user?s logins to Twitter including, for each access, the IP address assigned to the user and the date stamp at the time the user accessed his or her account. 11. As discussed above, Twitter users can use their Twitter accounts to post ?Tweets? of 140 characters or fewer. Twitter users can also ?favorite,? ?retweet,? or reply to the Tweets of other users. One Twitter user can direct a Tweet to another user?s account by including the intended recipient?s Twitter handle in the message, preceded by the sign. Unless the sender has been blocked by the recipient, the tweet will be automatically directed to the user?s account where it is viewable by the recipient. 12. Twitter users can embed visual files, like photographs or images, in their Tweets. These files can include animated, or moving, images known as Graphics Interchange Format (GIF) images. As a default, Twitter will play GIF images automatically when they are viewed by the recipient. 13. According to Twitter records, on December 11, 2016, at 19:36, Rivello created the ?Ari Goldstein@jew_goldstein? Twitter account. On December 15, 2016, at approximately 10:15 pm (CST), Victim#1 logged into his Twitter account @[redacted] in his home office in Dallas, Texas, in the Northern District of Texas. Upon login, Victim#l observed a GIF posted as a tweet on his Twitter account that read, ?You deserve a seizure for your post.? The animated GIF played a repeating Af?davit?Page 4 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 6 of 14 PageID 6 strobe light on the computer that immediately caused Victim#1 to suffer an epileptic seizure. 14. Within minutes of the seizure, Victim#1?s wife walked into his of?ce, observed him having the seizure, and rushed to his aid. The seizure lasted approximately eight minutes. For the duration of the seizure, Victim#l experienced a complete loss of his bodily functions and mental faculty. For many months following the seizure, Victim#1 experienced continued impairment to his bodily functions and mental faculty. 15. Upon entering the of?ce, Victim#l ?3 wife immediately noticed the Mentions . . . . . 176,"an strobing light on his computer . ?m and took a photograph of the image on the computer monitor . with her cell phone. (This photo appears to the left). She rushed to aid Victim#1 and placed him I . in a safe location on the floor so he would not sustain further injury. She then called 911 to report the incident to the police. The incident and the after?affects have resulted in substantial emotional distress for Victim#l, his wife, and his children. Af?davit?Page 5 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 7 of 14 PageID 7 16. On December 22, 2016, DPD submitted a search warrant to Twitter Inc. for the account of @jew_goldstein, which sent the seizure-inducing tweet. The search warrant showed the following subscriber information: Account 1D: 808031649325871105 Created At: 12/11/2016 Email: ari.jew.gold@gmail.com Screen Name: jew_goldstein Creation 1P: 107.77.172.50 Creation Device Type: PhoneDevice IPX Carrier Name: ATT Phone Number: 1?443-235-3 549 17. A review of the Twitter search warrant return showed the following direct messages from @jew_goldstein to other Twitter users concerning Victim#1 or the sending of the strobe GIF: Date Text 12/13/2016 at 17:41 ?[Victim#1] deserves to have his liver pecked out by a pack of emus? 12/16/2016 at 01:42 hOpe this sends him into a seizure?1 12/16/2016 at 02:30 ?Spammed this at [Victim#1] let?s see if he dies?1 12/16/2016 at 05:00 know he has epilepsy? 12/ 16/2016 at 05:33 "If I haven't been banned yet check my feed when you wake up. 18. On December 22, 2016, DPD consulted Victim#1?s neurologist who related that the strobe contained in the tweet had served as a trigger2 for his seizure. 1 These direct messages were accompanied by a linked or pasted item, such as a GIF or a photo. 2 According to ?[f]or about 3 percent of people with epilepsy, exposure to ?ashing lights at certain intensities or to certain visual patterns can trigger seizures.? Affidavit?Page 6 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 8 of 14 PageID 8 Furthermore, because of this seizure, Victim#l could experience other seizures in the near future. 19. DPD sent a request to for the telephone number associated with the Twitter account of @jew_goldstein, 1?443?235-3549. On January 15, 2017, responded and a review of the subscriber information showed the telephone number was associated with a Tracfone prepaid account with no subscriber information. However, a review of the toll records showed an associated Apple iPhone 6A Model 1586 (Apple iPhone). 20. Apple is a United States company that produces the iPhone, iPad, and iPod Touch. Apple provides a variety of services that can be accessed from Apple devices. The services include ?le storage through a service known as ?iCloud.? .21. iCloud is a ?le hosting, storage, and sharing service provided by Apple. iCloud can be utilized through numerous iCloud-connected services, and can also be used to store device backups and data associated with third-party apps. iCloud? connected services allow users to create, store, access, share, and data on Apple devices or via icloudcom on any Internet-connected device. For example, among other things, iCloud services can be used to store and manage images and videos taken from Apple devices and to store and share a variety of other ?les and documents. Apple provides users with ?ve gigabytes of free electronic Space on iCloud, and users can purchase additional storage space. Af?davit?Page 7 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 9 of 14 PageID 9 22. Apple services are accessed through the use of an ?Apple an account created during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID can be linked to multiple Apple services and devices, serving as a central authentication and syncing mechanism. 23. An Apple ID takes the form of the full email address submitted by the user to create the account; it can later be changed. Users can submit an Apple provided email address (often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to access most Apple services (including iCloud, iMessage, and FaceTime) only after the user accesses and responds to a ?veri?cation email" sent by Apple to that ?primary" email address. Additional email addresses ("alternate," "rescue,? and "noti?cation" email addresses) can also be associated with an Apple ID by the user. 24. Apple captures information associated with the creation and use of an Apple ID. During the creation of an Apple ID, the user must provide basic personal information including the user's full name, physical address, and telephone numbers. In addition, Apple captures the date on which the account was created, the length of service, records of log?in times and durations, the types of service utilized, the status - of the account (including Whether the account is inactive or closed), the methods used to connect to and utilize the account, the Internet Protocol address address") used to register and access the account, and other log files that reflect usage of the account. Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 10 of 14 PageID 10 25. On January 17, 2017, DPD sent search warrants to Apple Inc. for the iCloud account associated to telephone number 443 ?235-3549 and the associated Apple iPhone located in the toll records. On January 23, 2017, Apple responded to the search warrants and provided the following subscriber information: Apple ID: jrrivello@gmail.com (veri?ed by Apple) DS ID: 175139233 First Name: John Last Name: Rivello . Account Type: Full iCloud Account Status: Active Created On; September 21, 2012 at 06:01 (PT) Address: ?Salisbury, Maryland Telephone Number: 1-443?235-3549 Registration IP Address: 108.5043 .150 seepagewr-r' In short, John Rivello, who had this Apple iCloud account since September 2012, used the telephone number associated with the Twitter account that sent the seizure- inducing tweet to Operate his iCloud account. 26. Further review of the Apple iCloud search warrant return showed that the user of the Apple iCloud account is John Rivello. For instance, along with other . personal pictures of Rivello, Af?ant I located what appeared to be a self-photo of John Rayne Rivello posing with his Maryland driver?s license. The driver?s license listed John Rayne Rivello personal identi?ers and included his Af?davit?Page 9 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 11 of 14 PageID 11 photograph. I con?rmed that the driver?s license photograph was of Rivello and with his address. 27. Also contained in Rivello?s Apple iCloud account were additional items 3 -- concerning Victim#1. For instance, the exact seizure- inducing GIF sent to Victim#1 EIU was found in Rivello?s iCloud qt? account along with a screen capture of the GIF on Victim#1?s Twitter account with a response from his wife (see screen capture .caged asewre. I hwe your cmatm and have ca led the pa? .29 :a report the assault. on the 16ft) 28. Also contained in Rivello?s iCloud account was the below image of Victim#l ?s Wikipedia page, which had been altered to show the fake obituary date of (SN) death listed as December 16, 2017, a day after the GIF was sent to Victim#l. In addition to a date of death, the fake obituary included some anti-Semitic references. Af?davit?Page 10 Case 3:17-mj-00192-BK Document 1 Filed 03/10/17 Page 12 of 14 PageID 12 December 15131) was an Amwuan juu Comm: wN-b 4 5 3* *3 Ava-:25 ar?? n: 39:: 7 Personal ?le 7.1 an'i eany Im- 72 Epilepsy Ham i3 Fans-u Jewrorr. us. 8 "f Died 35.1, 1-3 The Marne! 10 Raft-?Mr: Mutable 52-9184? 1! f'n'w'ma' aka works ?ve unlabfe 29. An Archiveorg3 December 16, 2016 capture of the above Wikipedia page for Victim#1 shows that the page was updated on 12/ 16/2016 at 6:27am. A prior Archiveorg version of this Wikipedia page, on December 14, 2016, did not mention Victim#1?s death, and contained the accurate location of his place of birth and notable works. 30. Also contained in Rivello?s iCloud account were screen shots from a cell phone: 3. from epilepsycom with a list of commonly reported epilepsy seizure triggers; t. from an article on Vdar.com discussing photosensitive epilepsy and speci?cally discussing Victim#1?s seizure; u. from the dallasaobservercom discussing Victim#1?s report to the DPD and attempt to identify the Twitter user Ari Goldstein@jew_goldstein; 3 Per ayback Machine, Archiveorg, also known as the Wayback Machine, ?is a digital archive of the World Wide Web and other information on the Internet created by the Internet Archive, a nonpro?t organization, based in San Francisco, California.? Archiveorg captures and archives cepies of web ?les as they existed on the Internet, and records the date and time of the capture. Af?davit-Page 11 Case Document 1 Filed 03/10/17 Page 13 of 14 PageID 13 v. from courtsportal.dallascounty.org revealing Victim#1?s address in Dallas, Texas; and w. From tineye.com4 identifying sources for the strobe GIF he sent to Victim#1. 31. Several of Victim#l ?s tweets were screen captured and located in Rivello?s photo stream of his Apple iCloud account. 32. Further review of the Twitter search warrant return showed a direct message from an unknown individual on December 15, 2016 to @jew_goldstein stating, ?Awesome On December 17, 2016, another unknown individual sent a direct message to @jew_goldstein stating, ?But JR does so that?s probably why he did it.? I CONCLUSION 33. Based upon the aforementioned facts, I respectfully submit that there is probable cause to believe that between on or about December ll, 2016, to at least on or about December 17, 2016, in the Northern District of Texas and elsewhere, John Rayne Rivello, with the intent to kill, injure, harass, and intimidate, did knowingly and intentionally use an interactive computer service and an electronic communication service to engage in a course of conduct that placed a person in reasonable fear of the death of or serious bodily injury to that person and caused, 4 Per ?TinEye is a reverse image search engine developed and offered by ld?e, Inc, a company based in Toronto, Canada. It is the ?rst image search engine on the web to use image identi?cation technology rather than keywords, metadata or watermarks.? Af?davit?Page 12 Case Document 1 Filed 03/10/17 Page 14 of 14 PageID 14 attempted to cause, and would be reasonably expected to cause substantial emotional distress to that person, in Violation of 18 U.S.C. and (B). W, Nathan P. Hopp Special Agent, FBI Wt Subscribe nd sworn befo 6 me this/Q day of March 2017. TOLIVER MAGISTRATE JUDGE) Af?davitnPage l3