UNITED STATES DISTRICT COURT FOR THE CENTRAL DISTRICT OF CALIFORNIA January 2019 oral-T 0 0 7 1,1390?) UNITED STATES OF AMERICA CR NO. v. [18 U.S.C. 371: Conspiracy; 18 U.S.C. 875(c): Threats to Injure TIMOTHY DALTON VAUGHN, in Interstate Commerce; 18 U.S.C. aka ?wantedbyfeds,? 844(e): Interstate Threats aka ?Wanted,? Involving Explosives; 18 U.S.C. aka ?Hacker_RHUS,? 1030(a)(5)(A), aka Intentionally aka ?Xavier Farbel," Damaging a Computer by Knowing GEORGE Transmission; 18 U.S.C. aka 1030(a)(7)(A), aka Interstate Threat to Damage a aka ?P13x13t,? Protected Computer with Intent to aka ?DigitalCrimes,? Extort; 18 U.S.C. Aiding and Abetting] Defendants. The Grand Jury charges: COUNT ONE [18 U.S.C. 371] A. INTRODUCTORY ALLEGATIONS 1. At all times relevant to this Indictment: a. Apophis Squad was a collective of computer hackers and swatters and other individuals located throughout the world, including the United States that conducted cyber and swatting attacks against individuals and entities including school districts in the U.S. and the United Kingdom These attacks included, among other things, the dissemination of bomb and school? shooting threats designed to cause fear of imminent danger and did cause the closure of hundreds of schools on two continents on multiple occasions. b. Defendant TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted," aka aka aka ?Xavier Farbel? resided in, and was located in Winston? Salem, North Carolina. Defendant VAUGHN was a member of Apophis Squad who used the Twitter handles @wantedbyfeds and @Hacker_R_US, and also shared the Twitter handles @ApophisSquad and @apophissquadv2 with the other members of Apophis Squad, including defendant GEORGE DUKE-COHAN. c. Defendant GEORGE aka aka aka ?P13Xl3t,? aka ?DigitalCrimeS? resided in, and was located in Hertfordshire, U.K. Defendant was a member of Apophis Squad who used the Twitter handles @DigitalCrimes, and and also shared the Twitter handles @ApophisSquad and @apophissquadvz with the other members of Apophis Squad, including defendant VAUGHN. d. Unindicted Co?Conspirator 1, aka ?PartialDuplex,? resided in, and was located in Hampshire, U.K. Unindicted Co? Conspirator was a member of Apophis Squad who used the Twitter handle @PartialDuplex. e. Twitter was an online social networking service on which users publicly post and interact with messages known as tweets. 2 Twitter users could also send private messages (called ?Direct Messages? or to one another. i. A Twitter ?handle? was the name a user selected to use on Twitter, preceded by the symbol. ii. When publishing a tweet, the user had an option to ?tag? another user by inserting the user?s Twitter handle, which would alert the tagged user to the existence of the tweet. f. ProtonMail was a Switzerland?based email provider which offered secure email accounts. 2. The following definitions apply to this Indictment: a. A ?Distributed Denial of Service attack? or attack? was a type of malicious computer activity by which an attacker causes a network of computers to ?flood? a victim computer with large amounts of data or specific commands. As a result, the victim computer is unable to handle legitimate network traffic and legitimate users are denied the services of the computer. Depending on the type and strength of the attack, the victim computer and its network may become completely disabled and unable to perform their intended functions without significant repair. b. ?Swatting? was the action or practice of harassing a victim by deceiving the victim or an emergency service into sending or causing to be sent police and emergency service response teams to the victim?s location, often by making a false report of a serious law enforcement emergency such as a murder or bomb situation at the victim?s location to trigger the deployment of the response teams. c. ?Spoofing? was the creation of email messages with a forged, faked, or otherwise inauthentic sender address. ?Catfishing? was a type of deceptive activity whereby a person would create a fake identity and/or social media presence on the internet in order to target a specific victim or victims for deception. e. ?Boxing" or ?doxxing? was the publication of a person?s personal information, usually including their true name and contact information. B. OBJECTS OF THE CONSPIRACY 3. Beginning on a date unknown to the Grand Jury but no later than January 2018, and continuing through on or about August 31, 2018, in Los Angeles, Orange, and Riverside Counties, within the Central District of California, and elsewhere, defendants VAUGHN and together with Unindicted Co-Conspirator and others known and unknown to the Grand Jury, knowingly combined, conspired, and agreed to commit the following crimes: a. threats to injure in interstate commerce, in violation of Title 18, United States Code, Section 875(c); b. conveying false information concerning the use of an explosive device, in violation of Title 18, United States Code, Section 844(e); and c; intentionally damaging a computer by knowing transmission, in violation of Title 18, United States Code, Section 1030(a)(5)(A). C. MANNER AND MEANS OF THE CONSPIRACY 4. The objects of the conspiracy were carried out, and to be carried out, in substance, as follows: a. Using Internet communication applications such as Discord and Internet Relay Chat rooms, defendants VAUGHN and 4 and the other members of Apophis Squad, including Unindicted Co?Conspirator 1, would plan to and would send emails containing bomb and school?shooting threats to hundreds of school districts in the U.S. and the U.K., knowing that those threats were false and with knowledge that the emails would be viewed as threats. b. For some of the threats, defendants VAUGHN and COHAN and the other members of Apophis Squad, including Unindicted Co?Conspirator 1, would spoof email addresses to make it appear as if the bomb and schoolwshooting threats were sent by other entities such as the mayor of London, and Zonix. c. Defendants VAUGHN and and the other members of Apophis Squad, including Unindicted Co?Conspirator 1, would or deface the websites of entities with which they were displeased. D. OVERT ACTS 5. On or about the following dates, in furtherance of the conspiracy, and to accomplish its objects, defendants VAUGHN and as well as Unindicted Co?Conspirator 1 and others known and unknown to the Grand Jury, committed and caused others to commit the following overt acts, among others, in the Central District of California, and elsewhere: Overt Act No. 1: In or about January 2018, defendants VAUGHN and and the other members of Apophis Squad defaced the website of Colombian university Colegio Nueva Granada Overt Act No. 2: On or about January 14, 2018, defendant VAUGHN DDoSed the website belonging to Hoonigan Industries, located in Long Beach, California (hoonigan.com), for approximately three days during which the website was rendered inoperable. 5 Overt Act No. 3: On or about January 15, 2018, defendant VAUGHN bragged in an IRC chat room that he had DDoSed hoonigan.com. Overt Act No. 4: On or about January 28, 2018, defendant called the Federal Bureau of Investigation?s Omaha, Nebraska Field Office Omaha?) and asked the operator if defendant DUKE-COHAN should pack an Ebola or anthrax dispersal weapon to deploy in the lobby of the FBI, and when the operator did not respond, defendant threatened to rape and kill the operator?s wife. Overt Act No. 5: A few hours later, on or about January 28, 2018, defendant called FBI Omaha again and claimed he was going to set off a pipe bomb at Los Angeles International Airport on July 4, 2018; was going to set off a bomb at his school on January 29, 2018, because he was too excited to wait; claimed responsibility for hacking a Colombian university; and said he was going to go stab his mother. Overt Act No. 6: On or about January 29, 2018, defendant through a public posting using the Twitter handle took credit for the defacement of website. Overt Act No. 7: On or about January 29, 2018, defendant through a public posting using the Twitter handle posted a screenshot of cng.edu with a picture of Adolf Hitler holding a sign with the words ARE with the text that Website had been ?Hacked by APOPHIS SQUAD OFFICIAL APOPHIS SQUAD and THIS UP OR PEOPLE HAHA LAX 4TH July Overt Act No. 8: On or about January 29, 2018, defendant through a public posting using the Twitter handle 6 stated: ?Will they ever learn good .. I am a do not hak me! Cng.edu PWN DB leaked. @briankrebs @FBIOmaha told you I hacked them!? Overt Act No. 9: On or about January 30, 2018, defendant VAUGHN, using the Twitter handle @wantedbyfeds, stated to another Twitter user that he was catfishing a man in Cottondale, Florida. Overt Act No. 10: On or about January 30, 2018, defendant DUKE-COHAN, assisted by defendant VAUGHN (who was communicating with defendant during the call), and posing as ?Jake Davis? from Cottondale, Florida, called FBI Omaha and took credit on behalf of Apophis Squad for the CNG defacement. Overt Act No. 11: Between on or about March 16 and 19, 2018, defendants VAUGHN and together with Co?Conspirator 1 and the other members of Apophis Squad, sent emails appearing to be sent by a company that hosts player versus player Minecraft game servers, to hundreds of schools in the U.K. in both English and Arabic threatening that a student had been sent to the school with a bomb that would detonate in three hours unless $5,000 USD was sent to Overt Act No. 12: On or about March 19, 2018, defendant COHAN, through a public posting using the Twitter handle @ApophisSquad, stated: ?We hope everyone in the UK enjoyed our email. Thanks to all who participated in this event,? and signed it with his moniker, Pl3xl3t. Overt Act No. 13: On or about March 28, 2018, defendant COHAN, together with the other members of Apophis Squad, sent emails on behalf of Apophis Squad signed with defendant moniker, threatening that a car would drive into as many 7 students as possible as they exited the school, and if the school tried to evacuate the driver would shoot. Overt Act No. 14: On or about March 28, 2018, defendant DUKE- COHAN, through a public posting using the Twitter handle @ApophisSquad, stated: ?Schools out for the Hope all you HARD working students get our emails. Do not they are we think,? and signed it with his moniker, Pl3x13t. Overt Act No. 15: In or about April 2018, defendant VAUGHN compiled a list of U.S. school districts and their email addresses and sent the list to defendant Overt Act No. 16: On or about April 8, 2018, defendant DUKE- COHAN, through a public posting using the Twitter handle @ApophisSquad, stated: ?We are holding off on UK schools till they are ALL back from holiday. We are still on track for the Overt Act No. 17: On or about April 8, 2018, defendant COHAN, through a public posting using the Twitter handle @ApophisSquad, stated: ?Shit, we sent the emails to early. Our bad on that one we were testing and we used the wrong list for the test We would like to say sorry for the small amount of evacs this has caused. We will aim to fix this soon!? Overt Act No. 18: On or about April 8, 2018, defendant COHAN, through a public posting using the Twitter handle @ApophisSquad, stated: ?The CEO of @ZonixUS and the developers took the option to make fun of us. All players staff will now be the target of Doxing Swatting. All email fallout is now pointed at Zonix and will soon not be a server,? and tagged the Twitter user with the handle @cbrady350. Overt Act No. 19: On or about April 8 and 9, 2018, defendant together with the other members of Apophis Squad, sent emails appearing to be sent by Apophis Squad with a reply email address to Zonix, a company that hosts player versus player Minecraft video game servers, to school districts in the U.S. including school districts in El Segundo, Mission Viejo, Tustin, Garden Grove, Santa Ana, Redlands, Jurupa Valley, Riverside, Chino, and Lompoc, within the Central District of California threatening that a bullied student was coming to school with three bombs and a .22? caliber handgun to shoot any staff or student member. Overt Act No. 20: On or about April 10, 2018, defendant VAUGHN created an IRC chat room with the description ?feds.apophissquad.xyz Powered by School Shootings and Bomb Threats,? in which he communicated with defendant DUKE-COHAN and Unindicted Co?Conspirator l. Overt Act No. 21: On or about April 10, 2018, defendant COHAN participated in an interview moderated by the individual using the email cbrady350?gmail.com and stated that he uses the monikers P13x13t and gave a ?shout?out? for the @apophissquadv2 Twitter handle; stated that he and the other members of Apophis Squad had accidentally sent the threat emails from April 8 and 9, 2018, early to a small number of schools; and stated that Apophis Squad was planning on ?leaking the U.S. military database.? Overt Act No. 22: On or about April 11, 2018, defendant VAUGHN bragged to an individual named Jason in an IRC chat room: have hit more then 2k schools. 400+ in uk. 2k+ in us. more stuff coming Friday.? Overt Act No. 23: On or about April 12 and 13, 2018, defendants VAUGHN and together with Co?Conspirator 1 and the other members of Apophis Squad, sent emails appearing to be sent by Apophis Squad from Mineplex, a company that hosts player versus player Minecraft video game servers, to school districts in the U.S. and the U.K. including school districts in Burbank, El Segundo, La Verne, Anaheim, La Habra, Huntington Beach, Fullerton, Tustin, Riverside, Fillmore, Santa Maria, and Lompoc, within the Central District of California threatening that a student with two bombs made of ammonium nitrate/fuel oil would go to school and set off the bombs, and included a photograph of a plastic bottle ANFO bomb. Overt Act No. 24: On or about April 12, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquadv2, retweeted a tweet about the school bomb threat, which included the photograph of the plastic bottle ANFO bomb. Overt Act No. 25: On or about April 12, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquadv2, stated: ?Email scraping has just hit 52k emails found, UK We got our servers ready but do you? Just think 24k to the UK clear 400 schools, 1k to the U.S closed like 30m 52k is just going to be MEMES. Overt Act No. 26: On or about April 12, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquadv2, stated: ?We take request for school clear outs lockdowns. If you want to SKIP a lesson? Maybe not do that exam? Email us your school: apophissquad?tuta.io we do it free easy." 10 Overt Act No. On or about April 12, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade, stated: ?Tango down U.S UK Schools We are Apophis Squad and we are HERE to stay! We 100% going dark nowm Hope the U.S and UK enjoy it, if we get arrested then oops we must of messed up at some point." Overt Act No. 28: On or about April 12, 2018, defendant COHAN told defendant VAUGHN to ?go get a fuck ton of US school emails! ONLY US schools this time. nothing else. UNDERSTAND THAT. NOTHING to which defendant VAUGHN replied, ?will do." Overt Act No. 29: On or about April 13, 2018, defendant COHAN called FBI Omaha, identified himself as the caller who had previously threatened to rape the operator's wife, reiterated his bomb threat on LAX, and asked questions about the bomb threats made on U.S. schools. Overt Act No. 30: On or about April 13, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade, stated: ?We are OPEN for request for school lockdowns evacs. Send us your request to apophissquad@tuta.io Overt Act No. 31: On or about April 15, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade, posted a screenshot of a live web chat between him and the Hertfordshire Police in the U.K., in which he stated: ?You have not caught any of us and we plan on hitting the UK US schools today and clarified that ?we" meant Apophis Squad. Overt Act No. 32: On or about April 15, 2018, defendant DUKE- COHAN, through a public posting using the Twitter handle 11 @apophissquade, stated: ?We plan on hitting as many schools as we can on Monday! We hope anyone that just wants to have a day off or maybe get out of the math test you have! Will email us any schools we are working hard on getting 100k emails!? Overt Act No. 33: On or about April 15, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade, stated: ?This is how we get in the mood before we build our bombs send the emails," and included a link to the song labeled ?Foster The People Pumped Up Kicks columbine Overt Act No. 34: On or about April 17, 2018, defendant VAUGHN possessed a copy of the image of the plastic bottle ANFO bomb on his computer. Overt Act No. 35: On or about May 5, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquadv2, stated: ?Request open for schools! Email us or DM us. Send in dem emails! WE BACK Overt Act No. 36: On or about May 7, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquadvz, stated: ?Little hint in the email is used, stand for Apophis Squad if the media did not know.? Overt Act No. 37: On or about May 7 and 8, 2018, defendants VAUGHN and DUKE-COHAN, together with the other members of Apophis Squad, sent emails to school districts in the U.S. and the U.K. including school districts in Beverly Hills, Redondo Beach, Glendora, La Verne, Mission Viejo, and Thermal, within the Central District of California w? appearing to be sent by either the Director?General of the U.K.'s National Crime Agency or the Chief Executive Officer of the Marz Media, and threatening that three bombs l2 placed under school transport vehicles and one in the school would explode unless $5,000 USD was paid to cbrady350@gmail.com. Overt Act No. 38: On or about May 8, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade, stated: ?Oops @cbrady350 you about to get $5,000 USD in ur paypal! HEHEHE Better pay up bois or school could go Overt Act No. 39: On or about May 8, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquadv2, stated: ?First Email work. Now we wait for the second to work its magic.? Overt Act No. 40: On or about June 26, 2018, defendants VAUGHN and and the other members of Apophis Squad, sent emails signed to school districts in the U.S. and the U.K. including school districts in Buena Park and Santa Paula, within the Central District of California appearing to be sent from the mayor of London threatening that two rocket?propelled grenade heads placed under two school buses and four land mines placed on the sports field and around its entrance would detonate unless school was cancelled because they are ?not happy? with the way that the schools ?let these boys and girls dress and not worship Alah the God? and allow girls to be educated. Overt Act No. 41: On or about June 26, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquadv2,-tweeted at the mayor of London: ?Hit us up when you wish to comment on why you sent bomb threats? Apophis Team is and tagged defendant VAUGHN's Twitter handle @Hacker?R_US. l3 Overt Act No. 42: On or about June 27, 2018, defendants VAUGHN and DUKE-COHAN, on behalf of Apophis Squad, began a week?long attack on the computer servers of ProtonMail. Overt Act No. 43: On or about June 27, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquadv2, tweeted at @ProtonMail: DDOS @ProtonMailHelp your website is Can?t take 200gbps SSDP attack. Overt Act No. 44: On or about June 27, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade, tweeted at the Chief Technology Officer of ProtonMail: ?Say sorry for calling us clowns and we will allow your network backup!" Overt Act No. 45: On or about June 28, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade, tweeted at ProtonMail: ?We will down your network no matter who your with. . . . [WJait till you leave and then we will strike and it will Overt Act No. 46: On or about August 9, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade: 7 US Marshalls just tried to Raid @Hacker_R_US [defendant bitch did not have a search warrent! Come back later You aint got Feds can?t touch us!? Overt Act No. 47: On or about August 9, 2018, defendant COHAN, assisted by defendant VAUGHN, called San Francisco International Airport Operations while United Airlines flight 949 949") from London Heathrow to SFO was in the air, claiming to be the father of a passenger on that flight who had communicated l4 him mid?flight that the plane had been hijacked by four men with weapons and explosives. Overt Act No. 48: On or about August 9, 2018, defendant COHAN, through a public posting using the Twitter handle @apophissquade: ?One thing to say! UAL949 Grounded bitch! Don?t try and raid our members next time! 4 guys 1 bomb back of the 9/11 remake! ~Wanted Overt Act No. 49: On or about August 9, 2018, defendant COHAN, assisted by defendant VAUGHN, called San Francisco Police Department?s Airport Bureau continuing to claim to be the father of a passenger on UAL 949, adding that the passengers were being forced to the back of the airplane, and providing his phone number and the email address as his contact information, causing the plane to be sent to a quarantined area upon landing in San Francisco where it remained for hours until security Checks could be conducted. 15 COUNT TWO [18 U.S.C. 875(c); On or about April 8 and 9, 2018, defendants TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted," aka ?Hacker_RHUS," aka aka ?Xavier Farbel? and GEORGE COHAN, aka aka aka ?Pl3X13t," aka ?DigitalCrimes,? each aiding and abetting the other, with the purpose of issuing a threat and with knowledge that the communication would be viewed as a threat, knowingly transmitted in interstate commerce to school districts in El Segundo, Mission Viejo, Tustin, Garden Grove, Santa Ana, Redlands, Jurupa Valley, Riverside, Chino, and Lompoc, in Los Angeles, Orange, Santa Barbara, and Riverside Counties, within the Central District of California, the following communication containing true threats to injure the person of another: Hello, you have made a choice to not listen to us. I got bullied at this school and you did nothing. Now you will understand the true mean of pain. I am coming into school with 3 bombs, and a .22 hand gun. If I see any staff or student I will shoot them and kill them. When I run out of bullets, I will slit there throats and watch them bleed out on the floor. If I see any police at the school I will blowup the bombs. 16 COUNT THREE [18 U.S.C. On or about April 12 and 13, 2018, defendants TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted,? aka aka aka ?Xavier Farbel? and GEORGE COHAN, aka aka aka ?Pl3xl3t,? aka ?DigitalCrimes,? each aiding and abetting the other, with the purpose of issuing a threat and with knowledge that the communication would be viewed as a threat, knowingly transmitted in interstate commerce to school districts in Burbank, El Segundo, La Verne, Anaheim, La Habra, Huntington Beach, Fullerton, Tustin, Riverside, Fillmore, Santa Maria, and Lompoc, in Los Angeles, Orange, Santa Barbara, and Riverside Counties, within the Central District of California, the following communication containing true threats to injure the person of another: Hello, a male student will be sent into your campus as you start the day, he will look normal but what is in his bag is a bomb. The explosive that is in the two plastic bottles is called ANFO it is a very powerful explosive. The point is that when you put the school on lockdown this student will set off the bomb, and will kill EVERY student in the room and maybe the rooms next to it. It has an LDR which is used to stop bag searchs. It will exploded if any light hits the sensor. We follow in the foot steps of our two heros who died in the Columbine High School shooting. Natural selection is coming and we plan on being the onse to start it off. We understand that you may want to contact the FBI or Law enforcement but note, that we have pick 5 schools to do this to, your school could could be a lucky one and gets to be picked at a different time. The point is nobody but us will know which school is to be hit. We also have pressure plated pipes at the exists with 12 gauge shot guns shells so if anyone steps on them it will shot through the student. We will have a sniper watching the exits with concreate with a ruger 10/22. 17 COUNT FOUR [18 U.S.C. On or about May 7 and 8, 2018, defendants TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted,? aka ?Hacker_R_US,? aka aka ?Xavier Farbel" and GEORGE COHAN, aka aka aka ?P13x13t,? aka ?DigitalCrimes,? each aiding and abetting the other, with the purpose of issuing a threat and with knowledge that the communication would be viewed as a threat, knowingly transmitted in interstate commerce to school districts in Beverly Hills, Redondo Beach, Glendora, La Verne, Mission Viejo, and Thermal, in Los Angeles, Orange, and Riverside Counties, within the Central District of California, the following communication containing true threats to injure the person of another: I will make this simple. Tuesday 05/08/2018 3 PVC pipe bombs placed under school transport will explode. I will then set off the main pipe bomb hidden in the school. This is what you get for not listening to me. See you all in HELL. Or pay us $5,000 USD Via paypal to cbrady350@gmail.com. 18 COUNT FIVE [18 U.S.C. On or about June 26, 2018, defendants TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted,? aka ?Hacker_R_US,? aka aka ?Xavier Farbel? and GEORGE COHAN, aka aka aka aka ?DigitalCrimes,? each aiding and abetting the other, with the purpose of issuing a threat and with knowledge that the communication would be viewed as a threat, knowingly transmitted in interstate commerce_ to school districts in Buena Park and Santa Paula, in Los Angeles and Ventura Counties, within the Central District of California, the following communication containing true threats to injure the person of another: We are not happy with the way you let these boys and girls dress and not worship Alah the God. We have planted 2 RPG heads under 2 school busses and 4 land mines on the sports field and around the If you cancel the school we will not blow it up, if you keep school on and allow girls to be educated we will blow up the bomb and come in school every girl in the school including teachers. Any sign of POLICE we will kill each student one by one. We have members in the school who are students they have orders to SHOOT if you try and evacuate the school. Simple. Follow the rules or be killed. 19 COUNT SIX [18 U.S.C. 844(e), On or about April 8 and 9, 2018, defendants TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted,? aka ?Hacker_R_US,? aka aka ?Xavier Farbel" and GEORGE COHAN, aka aka aka ?P13x13t,? aka ?DigitalCrimes,? each aiding and abetting the other, by email and other instrument of commerce, willfully made a threat, and maliciously conveyed false information knowing the information to be false, to the school districts in El Segundo, Mission Viejo, Tustin, Garden Grove, Santa Ana, Redlands, Jurupa Valley, Riverside, Chino, and Lompoc, in Los Angeles, Orange, Santa Barbara, and Riverside Counties, within the Central District of California, concerning an alleged attempt being made, or to be made, to kill, injure, and intimidate an individual and to damage and destroy property by means of fire and an explosive, namely: Hello, you have made a Choice to not listen to us. I got bullied at this school and you did nothing. Now you will understand the true mean of pain. I am coming into school with 3 bombs, and a .22 hand gun. If I see any staff or student I will shoot them and kill them. When I run out of bullets, I will slit there throats and watch them bleed out on the floor. If I see any police at the school I will blowup the bombs. 2O COUNT SEVEN [18 U.S.C. 844(e), On or about April 12 and 13, 2018, defendants TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted,? aka ?Hacker_R_US,? aka aka ?Xavier Farbel" and GEORGE COHAN, aka aka aka ?Pl3x13t,? aka ?DigitalCrimes,? each aiding and abetting the other, by email and other instrument of commerce, willfully made a threat, and maliciously conveyed false information knowing the information to be false, to the school districts in Burbank, El Segundo, La Verne, Anaheim, La Habra, Huntington Beach, Fullerton, Tustin, Riverside, Fillmore, Santa Maria, and Lompoc, in Los Angeles, Orange, Santa Barbara, and Riverside Counties, within the Central District of California, concerning an alleged attempt being made, or to be made, to kill, injure, and intimidate an individual and to damage and destroy property by means of fire and an explosive, namely: Hello, a male student will be sent into your campus as you start the day, he will look normal but what is in his bag is a bomb. The explosive that is in the two plastic bottles is called ANFO it is a very powerful explosive. The point is that when you put the school on lockdown this student will set off the bomb, and will kill EVERY student in the room and maybe the rooms next to it. It has an LDR which is used to stop bag searchs. It will exploded if any light hits the sensor. We follow in the foot steps of our two heros who died in the Columbine High School shooting. Natural selection is coming and we plan on being the onse to start it off. We understand that you may want to contact the FBI or Law enforcement but note, that we have pick 5 schools to do this to, your school could could be a lucky one and gets to be picked at a different time. The point is nobody but us will know which school is to be hit. We also have pressure plated pipes at the exists with 12 gauge shot guns shells so if anyone steps on them it will shot through the student. We will have a sniper watching the exits with concreate with a ruger 10/22. 21 COUNT EIGHT [18 U.S.C. 844(e), On or about May 7 and 8, 2018, defendants TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted," aka ?Hacker_R_US,? aka aka ?Xavier Farbel? and GEORGE COHAN, aka aka aka ?Pl3x13t,? aka ?DigitalCrimes,? each aiding and abetting the other, by email and other instrument of commerce, willfully made a threat, and maliciously conveyed false information knowing the information to be false, to the school districts in Beverly Hills, Redondo Beach, Glendora, La Verne, Mission Viejo, and Thermal, in Los Angeles, Orange, and Riverside Counties, within the Central District of California, concerning an alleged attempt being made, or to be made, to kill, injure, and intimidate an individual and to damage and destroy property by means of fire and an explosive, namely: I will make this simple. Tuesday 05/08/2018 3 PVC pipe bombs placed under school transport will explode. I will then set off the main pipe bomb hidden in the school. This is what you get for not listening to me. See you all in HELL. Or pay us $5,000 USD Via paypal to cbrady350@gmail.com. 22 COUNT NINE [18 U.s.c. 844(e), On or about June 26, 2018, defendants TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted," aka ?Hacker_R_US,? aka aka ?Xavier Farbel" and GEORGE COHAN, aka aka aka ?P13x13t,? aka ?DigitalCrimes,? each aiding and abetting the other, by email and other instrument of commerce, willfully made a threat, and maliciously conveyed false information knowing the information to be false, to the school districts in Buena Park and Santa Paula, in Los Angeles and Ventura Counties, within the Central District of California, concerning an alleged attempt being made, or to be made, to kill, injure, and intimidate an individual and to damage and destroy property by means of fire and an explosive, namely: We are not happy with the way you let these boys and girls dress and not worship Alah the God. We have planted 2 RPG heads under 2 school busses and 4 land mines on the sports field and around the If you cancel the school we will not blow it up, if you keep school on and allow girls to be educated we will blow up the bomb and come in school every girl in the school including teachers. Any sign of POLICE we will kill each student one by one. We have members in the school who are students they have orders to SHOOT if you try and evacuate the school. Simple. Follow the rules or be killed. 23 COUNT TEN [18 U.S.C. 1030(a) (5) (Aabout January 14, 2018, in Los Angeles County, within the Central District of California, and elsewhere, defendant TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted,? aka ?Hacker_R_US,? aka aka ?Xavier Farbel? knowingly caused the transmission of a program, information, code, and command, and as a result of such conduct, intentionally and without authorization impaired the integrity and availability of data, a program, a system, and information on a protected computer, as that term is defined in Title 18, United States Code, Section lO30(e)(2)(B), that is, the computer servers of Cogeco Peer 1, which hosted the website hoonigan.com belonging to Hoonigan Industries (?Hoonigan?), thereby causing a loss to Hoonigan, aggregating at least $5,000 in value during a one?year period beginning on or about I January 14, 2018. 24 COUNT ELEVEN [18 U.S.C. 1030(a)(7), On or about January 14, 2018, in Los Angeles County, within the Central District of California, and elsewhere, defendant TIMOTHY DALTON VAUGHN, also known as ?wantedbyfeds,? aka ?Wanted," aka ?HackerHR_US,? aka aka ?Xavier Farbel? with intent to extort from any person any money or thing of value, transmitted in interstate and foreign commerce the following communication containing a threat to impair the integrity and availability of data, a program, a system, and information on a protected computer, as that term is defined in Title 18, United States Code, Section 1030(e)(2)(B), that is, the computer servers of Cogeco Peer 1, which hosted the website hoonigan.com belonging to Hoonigan Industries: You have 24 hours to pay 1.5 BTC to [the Bitcoin wallet address ending in Glxg] to stop the attacks on you website. If you do not pay within the 24 hours the payment to stop the attacks will be 2 btc. This is not a joke and this is to be taken seriously. You can Proudly Direct Message me When you have paid on twitter @Wantedbyfeds Or When i completely receive the payment i will see it and stop the attacks. We have the ability to avoid any DDOS mitigation tactics you might pay to be deployed. We have dumped your clients database and if try to avoid paying 25 will release all your customers information. We have Emails, Name, address, and full details on the payment methods and payment details! A TRUE BILL Foreperson NICOLA T. HANNA United States Attorney .. an. ?gr??f . . a, msr'?ijSS PATRICK R. FITZGERALD Assistant United States Attorney Chief, National Security Division RYAN WHITE Assistant United States Attorney Chief, Cyber Intellectual Property Crimes Section JENNIE L. WANG Assistant United States Attorney Deputy Chief, Cyber Intellectual Property Crimes Section 26