Case Document 1 Filed 07/05/19 Page 1 of 1 A0 93 (Rest W: i} ?riminai Comptaim M6 UNITED STATES DISTRICT COURT {Gig-me District 0f .I?rl'aryland United States ofAmerica v. - CaseNo. 19 ?'22 5 1 JMG Darryl Aibert'Varnumj .Qef?ndantfk) CRIMINAL 1-, ihe-?compiainant in this casea stage-that the fdilrawinjggis true to the bestinf my knowledge?and belief. On or 3me the date?s) of June in county of . 'Carro? i the Di?? ?51" 9f Maryiarid ,-th?e Befcmdanqs) vi?oiafed: Code Sam}: 5 W?me 18 use. Threatemng An official 'This mimi?a?l, dampigim ls basedlon theSe-fagtts?: v. . See attached Af?dawt OF $3939? in? Continued on me attaehed-shect, 41/4 Campiaimm! ?s signature Sean Wilson. Speciai Agent 1.1.8. Capitai'Pel?ce ?r'?nfmf name anri {Me Sworn to before me 1d signed in my presence. Elite: lim?ge is ?gmzurem? City and state: BaitimoreLMaryIand .JMar Couison, us. Magistrate Judge Prinirea? name and (My Ig??l?i??'o??g?JMQ F363 Oj?am Page 1 of 13 AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT AND APPLICATIONS FOR SEARCH AND SEIZURE WARRAN TS 1, Sean Wilson, being ?rst duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this af?davit in support of an application under Rule 41 of the Federal Rules of Criminal Procedure for the issuance of a criminal complaint against of Darryl Albert VARNUM charging him with making a threat against an of?cial and transmitting a threat in interstate commerce in violation of 18 U.S.C. 115(a)9l0(A) and 875 respectively, as well as for the issuance of warrants to search 1) the person of Darryl Albert (2) the personal residence of VARNUM, located at 313 Barnes Avenue, Westminster, MD 21157, to include the residence?s cartilage (the (3) personal vehicle, a 2006 Red Ford Pickup Truck vehicle bearing VIN number 1F TPW14V96KC99011 and MARYLAND tag# 10X607 and registered to Darryl Albert VARNUM (the and (4) an Apple iPhone 68, IMEI 3532620796897932 (the The locations to be searched are described more particularly in the following paragraphs and Attachments A-l through A-4. This af?davit is also submitted in support of a search warrant authorizing the seizure and examination of the SUBJECT DEVICE and any other electronic devices found at the SUBJECT PREMISES, and the extraction from the SUBJECT DEVICE and any other seized devices of electronically stored information. That electronically stored information, as well as the other evidence and instrumentalities to be seized, I is described more particularly in the following paragraphs and in Attachment B. 2. I am a Special Agent with the United States Capitol Police (the where I have served since January 5, 2005. I am currently assigned to the USCP Investigations Division, Threat Assessment Section I have completed hundreds of hours of training in Case 1' 9; j- Document 1-1 Filed 07/05/19 Page dfriia numerous areas of law enforcement investigation and techniques, including but not limited to the following: the Criminal Investigator Training Program and the Mixed Basic Police Training Program at the Federal Law Enforcement Training Center in Georgia; the USCP Containment Emergency Response Team Four Week Basic SWAT School; the Pentagon Force Protection Agency One Week Protective Intelligence Course; and the Metropolitan Police Department Crisis Intervention Of?cer Training Course. In the course of my employment as a Special Agent with the USCP, I have received training regarding the application for and execution of both search and arrest warrants. I have received training in assessing and managing individuals who have communicated threats and engaged in behaviors associated with targeted violence. In .my current assignment, I have participated in and conducted numerous investigations involving illegal activity including stalking and threatening communications, both locally and interstate. As a federal law enforcement of?cer, I am authorized to execute search and seizure warrants under Rule 41 of the Federal Rules of Criminal Procedure. 3. The facts in this af?davit come from my personal observations, my training and experience, and information obtained from other agents and witnesses. This af?davit is intended to show merely that there is suf?cient probable cause for issuance of the Criminal Complaint and the requested warrants and does not set forth all of my knowledge about this matter. 4. Based on the facts set forth in this af?davit, I submit that there is probable cause to believe that violations of Title 18 U.S.C. 115l(a)(1)(A)(Threatening An Of?cial) and Title 18 IU.S.C. 875(c) (Interstate Threat) have been committed by Darryl Albert VARNUM (V ARNUM). There is also probable cause to believe that evidence-and instrumentalities of those crimes, as more particularly described in Attachment B, will be found within the locations to be searched, which are described more particularly in Attachments A-l through A-4. Case Document 1-1 Filed 07/05/19 Page auto" PROBABLE CAUSE 5. On June 26, 2019, at approximately 7:23 PM EDT, 3 male person believed to be VARNUM, using phone number 443--789-9507, left a voioemail at the district office or United States Congressperson which is located in the State of Florida, The voioerrtail, which was subsequently reported to user TAS on June 28, 2019. consisted of the following: I'm onna kill your ass if you do that bill. I swear. I will - come down and kill your ass. And you're a Congressperson. that is fine I hope the- FBI, CIA, and everybody else hears this. If you're taking away my rights. This is the United States ofAmerica,- Get the-out I will come down there and personally- kill you. I am dead-erious. i wanna see on -- at my door, lfyou're legit. That HR bill youjust pushed through, ah you. I'll tell you what I'll come down to Miami- l'll- you up. Like Cubans don't even know. or An online database Search of the number 443-739-9507 revealed that the current cellular cam'er for that number is and that the associated user is VARNUM. 7. subscriber records, which were provided by following an emergency disclosure request made pursuant to 18 U.S.C. 2702(c)(4) for the phone number 443- 789-9507, showed VARNUM to be the sole account user with a billing address of 313 Barnes :Ave, Westminslet. Maryland 21157 (the SUBJECT PREMISES). 8. Records provided by also identified that the telephone registered to the account is an Apple iPhone 6S, lMEl 3532620796897932 (the SUBJECT DEVICE). 9. Location information, also provided by as a result of the emergency disclosure request, showed that on June 29 and June 30, 2019, VARNUM's cell phone was in the proximity of the PREMISES in Westminster, Maryland. 10. Wage records provided by the Maryland Analysis and Coordination Center show that VARNUM is employed by Sealing Technologies, which is located in Columbia, Maryland. Case 1: 19- rgj- --02251 JMC Document 1- 1 Filed 07/05/19 Page .1. digit en- 9:55 5 arm 11. Vehicle records provided by MCAC show that VARNUM 1s the registered owner of a 2006 Ford Truck, MD Tag 10X607, VIN 1FTPW14V96KC99011. 12. Law enforcement agents in the US. Department of Defense Criminal Investigative Service have advised that VARNUM is currently working at the Defense Information Systems Agency Headquarters, located at 6914 Cooper Ave, Ft. Meade, Maryland 20755, pursuant to a contract between Sealing Technologies and DISA. DCIS further advised that because job requires him to have access to sensitive information, he is prohibited from possessing a cell phone or ?rearms while working in the DISA building. 13. Based on my training and experience and discussions with other law enforcement of?cers, I know that persons who work with sensitive information in restricted areas will often use their vehicles to store items that they may not bring into the workplace, such as cell phones and ?rearms. 14. I have reviewed a Carroll County Sheriff?s Department police report regarding an incident that occurred on May 29, 2015. According to the report, wife Jill English . Varnurn . Varnum?) contacted the police to report that VARNUM was having ?behavioral issues.? She reported that VARNUM was yelling that ISIS ?ghters were coming to-the house to ?ght him and that he had taken a ri?e with him into the garage. .1. Varnum told the police that VARNUM seemed to be intoxicated and that he owned ?numerous guns.? The report further indicated that when police arrived, VARNU told them that Taliban ?ghters were coming to his house and that he had been drinking vodka. According to the report, VARNUM was cooperative and non?violent in his interaction with the police and he was transported to a hospital for a mental health evaluation. Case Document 1-1 Filed 07/05/19 Page 5 of 13 1:2 --525,2 15. . Records provided by the Maryland State Police Firearms Licensing Of?ce show that VARNUM has registered to him a Ruger ,45 caliber pistol, model KP345PR, Serial #66420301. VARNUM does not have a concealed carry permit or any other ?rearms licenses. 16. I have located a public Facebook account in the name of ?Darryl Varnurn? with a spouse identi?ed as ?Jill Varnum.? On June 26, 2019 at EDT, approximately 12 minutes after the threatening voicemail was left at Congressperson #1 ?3 of?ce, a post appeared on the public timeline of that acebook account which included a photograph of an Anierican ?ag and the words 2527 Vaccinate All Children Act of 2019.? The post also stated the following: ?Holocaust hasbegun! I?m done with this bullshit. Time to step up or ship out!? At 8:10 pm that same day, a post appeared on the timeline stating: ?All of our guns are next, been trying for years!? 17. Open source research identi?es Congressperson #1 as a public supporter of HR. 2527. 18. Based on my training and experienCe and discussions with other law enforcement of?cers, I know that persons committing or intending to commit threat-related offenses often utilize computers, data storage devices external storage devices, ZIP disks, and CD?Roms), and other electronic communications equipment, including cellular telephones, to search the internet, to store plans and conduct research related to attacks or threat-related activities, and to communicate and transmit threats to recipients of threat-related activities. UNLOCKING ELECTRONIC DEVICES USING BIOMETRIC FEATURES ,19. I know from my training and experience, as well as publicly available materials, that systems for mobile phones and other electronic devices are becoming ever more widespread. Such systems protect the contents of these devices from unauthorized ?02251 .JMC Document 1- 1 Filed 07/0 19 Page 5555; we 5535.5 5 ?555 access by users, and render these contents unreadable to anyone who does not have the device?s password. As device becomes more commonplace, the systems implemented by device manufacturers are becoming more robust, with fewmif any-? workarounds available to law enforcement investigators. 20. also know that many electronic devices, particularly newer mobile devices and laptops, offer their users the ability to unlock the device through biometric features in lieu of a numeric or alphanumeric passcode or password. These biometric features include ?ngerprint scanners and iris recognition features. Some devices offer a combination of these biometric features, and the user of such devices can select which features they would like to utilize. 21. If a device is equipped with a ?ngerprint scanner, a user may enable the ability to unlock the device through his or her ?ngerprints. Examples of devices providing a ?ngerprint unlocking capability are several models of Apple?s iPhone. Apple iPhones may be ?ngerprint unlocked using a function called Touch ID, which during setup allows for registering as many as ?ve (5) ?ngerprints to unlock the device. The number of electronic devices providing a ?ngerprint unlocking capability, including both smart phones and laptops, is growing continually. 22. If a device is equipped with an iris recognition feature, a user may enable the ability to unlock the device with his or her irises. For example, on certain Microsoft devices, this feature is called ?Windows Hello.? During the Windows Hello registration, a user registers his or her irises by holding the device in front of his or her face. The device then directs an infrared light toward the user?s face and activates an infrared-sensitive camera to record data based on patterns within the user?s irises. The device can. then be unlocked if the infrared?sensitive camera detects the registered irises. Iris recognition features found on devices produced by other Case Documep; 1-1 Filed 07/05/19 Page 7 of 13 Ili?i 2, 2: a} i. ti?a?gg 1.9 5 5 MG manufacturers have different names but Operate similarly to Windows Hello. 23. - In my training and experience, users of electronic devices often enable the above- mentioned biometric features because they are considered a more convenient way to unlock a device than by entering a numeric or alphanumeric passcode or password. In some instances, biometric features are considered a more secure way to protect a device?s contents. This is particularly true when the users of a device are engaged in criminal activities and thus have a heightened concern about securing the contents of a device. 24. Related to the above discussion regarding if a forensic examination is . not conducted shortly after seizing the device while it is in an unlocked state, or unlocking the device using biometric features immediately upon seizing it, law enforcement investigators may 00mpletely lose the ability to forensically examine the device, assuming the device?s owner refuses to disclose the password. The passcode or password that would unlock any such device subject to search under these warrants is not known to law enforcement. Thus, law enforcement personnel may not otherwise be able to access the data contained within the device, making the use of biometric features necessary to the execution of the search authorized by these warrants. 25. Biometric features will not unlock a device in some circumstances even if such - features are enabled. This can occur when a device has been restarted, inactive, or has not been . unlocked for a certain period of time. For example, Apple devices cannot be unlocked using - Touch ID when: 1) more than 48 hours has elapsed since the device was last unlocked; or 2) when the device has not been unlocked using a ?ngerprint for eight (8) hours and the passcode or password has not been entered in the last six (6) days. Thus, in the event law enforcement personnel encounter a locked device equipped with biometric features, the Opportunity to unlock the device through a biometric feature may exist for only a short time. 1.19 2 t1-1 Pa e8of13 Case fig-Q l1pf?men 91:5? ?gigs; 26. Due to the foregoing, if law enforcement personnel encounter a device that is subject to seizure pursuant to these warrants and may be unlocked using one of these biometric features, the warrants I am applying for would permit law enforcement personnel to: 1) press or swipe the ?ngers (including thumbs) of any individual, who is reasonably believed by law enforcement to be a user of the device(s), to the ?ngerprint scanner of the device(s); and/or 2) hold the device(s) in ?'ont of the face of those same individuals and activate the iris recognition feature, for the purpose of attempting to unlock the device(s) in order to search the contents as authorized by these warrants. In the event that law enforcement is unable to unlock the subject device(s) Within the number of attempts permitted by the pertinent operating system, this will simply result in the device(s) requiring the entry of a password or passcode before it can be unlocked. 27. Due to the foregoing, I request that the Court authorize law enforcement personnel to press the ?ngers (including thumbs) of VARNUM or any other individual who is in possession of the SUBJECT DEVICE, and any other individuals who may be present during the search of the SUBJECT PREMISES, to unlock the SUBJECT DEVICE and any other electronic devices that may be seized at the SUBJECT PREMISES so that investigators may conduct the search and examination as described in this Af?davit and Attachment B. I COMPUTERS, ELECTRONIC STORAGE. AND FORENSIC ANALYSIS 28. As described above and in Attachment B, this application seeks permission to search for records that might be found on the SUBJECT PREMISES, the SUBJECT VEHICLE and person, in whatever form they are found. One form in which the records might be found is data stored on a computer?s hard drive or other storage media such as hard disks, RAM, ?oppy disks, ?ash memory, CD-ROMs, and other magnetic or opticalmedia. Thus, the 8 Case Document 1-1 Filed 07/05/19 Page 9 of 13 f7?. ?r :l 555saga are is a 2 5 5 late a. warrants applied for would authorize the seizure of electronic storage media or, potentially, the copying of electronically stored information, all under Rule 29. Probable cause. I submit that if a?computer or storage'medium is found on or in the SUBJECT PREMISES or SUBJECT VEHICLE, or on person, there is probable cause to believe those records will be stored on that computer or storage medium, for at least the following reasons: a. Based on my knowledge, training, and experience, I know that computer ?les o'r remnants of such ?les can be reco'vered months or even years after they have been downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic ?les downloaded to a storage medium can be stored for years at little or no cost. Even when ?les have been deleted, they can be recovered months or years later using forensic tools. This is so because when a person ?deletes? a ?le on a computer, the data contained in the ?le does not actually disappear; rather, that data remains on the storage medium until it is overwritten by new data. b. Therefore, deleted ?les, or remnants of deleted ?les, may reside in free space or slack space-?that is, in space on the storage medium that is not currently being used by an active ?le?for long periods of time before they are overwritten. In addition, a computer?s operating - system may also keep a record of deleted data in a ?swap? or ?recovery? ?le. 0. Wholly apart from user-generated ?les, computer storage media?in particular, computers? internal hard drives??contain electronic evidence of how a computer has been used, what it has been used for, and who has used it. To give a few examples, this forensic evidence can take the form of operating system con?gurations, artifacts from operating system or application operation, ?le system data structures, and virtual memory ?swap? or paging ?les. Computer users typically do not erase or delete this evidence, because special software is typically required for. that task. However, it is technically possible to I delete this information. Case 1' 235 Document 1-1. Filed 07/05/trad d. Similarly, ?les that have been viewed via the Internet are sometimes autOmatically downloaded into a temporary Internet directory or ?cache.? 30. Forensic evidence. As ?thher described in Attachment B, this application seeks permission to locate not only computer ?les that might serve as direct evidence of the crimes described on the warrant, but also for forensic electronic evidence that establishes how - computers were used, the purpose of their use, who used them, and when. There is probable cause to believe that this forensic electronic evidence will be on any storage medium in the SUBJECT PREMISES or SUBJECT VEHICLE or on person, because: a. Data on the storage medium can provide evidence of a ?le that was once on- the storage medium but has since been deleted or edited, or of a deleted portion of a ?le (such as a paragraph that has been deleted from a word processing Virtual memory paging systems can leave traces of information on the storage medium that show what tasks and processes were recently active. Web browsers, e-mail programs, and chat programs store con?guration information on the storage medium that can reveal information such as online nicknames and passwords. Operating systems can record additional information, such as the attachment of peripherals, the attachment of USB ?ash storage devices or other external storage media, and the times the computer was in use. Computer ?le systems can record information about the dates ?les were created and the sequence in which they were created, although this information can later be falsi?ed. b. Forensic evidence on a computer or storage medium can also indicate who has used or controlled the computer or storage medium. This ?user attribution? evidence is analogous to the search for ?indicia of occupancy? while executing a search warrant at a residence. For example, registry con?guration ?les, user pro?les, e- mail, e-mail address books, ?chat,? instant messaging logs, photographs, the . presence or absence of malware, and correspondence (and the data associated with the foregoing, such as ?le creation and last-accessed dates) may be evidence of who used or controlled the computer or storage medium at a relevant time. 10 ?rmware 1-1 Filed 07/05/19 Page 11 of 13 C. A person with appropriate familiarity with how a computer works can, after examining this forensic evidence in its proper context, draw conclusions about?how computers were used, the purpose of their use, who used them, and when. The process of identifying the exact ?les, blocks, registry entries, logs, or other forms of forensic evidence on a storage medium that are necessary to draw an accurate conclusion is a dynamic process. While it is possible .to specify in advance the records to be sought, computer evidence is not always data that can be merely reviewed by a review team and passed along to investigators. Whether data stored . on a computer is evidence may depend on other information stored on the computer and the application of knowledge about how a' computer behaves. Therefore, contextual information necessary to understand other evidence also falls within the scope of the warrant. Further, in ?nding evidence of how a computer was used, the purpose of its use, who used it, and when, sometimes it is necessary to establish that a particular thing is not present on a storage medium. For example, the presence or absence of counter-forensic programs or anti-virus programs (and associated data) may be relevant to establishing the user?s intent. 31. Necessity of seizing or copying entire computers or storage media. In most cases, a? a thorough search of a premises for information that might be stored on storage media often requires the seizure of the physical storage media and later offesite review consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes possible to make an image copy of storage media. Generally Speaking, imaging is the taking of a complete electronic picture of the computer?s data, including all hidden sectors and deleted ?les. Either seizure or imaging is. often necessary to ensure the accuracy and completeness cf data recorded on the storage media, and to prevent the loss of the data either from accidental or intentional destruction. This is true because of the following: The time required for an examination. As noted above, not all evidence takes the form of documents and files that can be easily 11 Case Dognment 1-1 Filed 07/05/19 Page 12 of 13 ?2 if: cl 13.: a: 2 2 5 5; LEMG viewed on site. Analyzing evidence of how a computer has been used, what it has been used for, and who has used it requires considerable time, and taking that much time on premises could be unreasonable. As explained above, because the warrant calls for forensic electronic evidence, it is exceedingly likely that it will be necessary to thoroughly examine storage media to obtain evidence. Storage media can store a large volume of information. Reviewing that information for things described in the warrant can take weeks or months, depending on the volume of data stored, and would be impractical and invasive to attempt on?site. b. Technical requirements. Computers can be con?gured in several different ways, featuring a variety of different operating systems, application software, and con?gurations. Therefore, searching them sometimes requires tools or knowledge that might not be present on the search site. The vast array of computer hardware and software available makes it dif?cult to know before a search what tools or knowledge will be required to analyze the system and its data on the Premises. However, taking the storage media off-site and reviewing it in a controlled environment will allow its examination with the preper tools and knowledge. c. Variety of forms of electronic media. Records sought under this warrant could be stored in a variety of storage media formats that may require off-site reviewing with specialized forensic tools. 32. Nature of examination. Based on the foregoing, and consistent with Rule the warrants I am applying for would permit seizing, imaging, or otherwise copying storage media that reasonably appear to contain some 'or all of the evidence described in the warrants, and would authorize a later review of the media or information consistent with the warrants. The later review may require techniques, including but not limited to computer-assisted scans of the entire medium, that might expose many parts of a hard drive to human linSpection in order to determine whether it is evidence described by the warrants. 12 CaSj Mg Document 1- 1 Filed 07/05/19 Page 13 of 13 22 5 a 2222 Aoruommrron REQUEST 33. - Based on the foregoing, I respectfully submit that there is probable cause to believe that VARNUM threatened to kill Congressp'erson #1 in violation of 18 U.S..C. 115 and?that VARNUM transmitted his threat~ via telephone ?om his location in Maryland to the office in Florida in violation of 18 U.S.C. 875(c). I request that a criminal complaint, arrest warrant and sear-ch and seizure warrants be issued, as prayed. I REQUEST FOR SENDING 34. I further request that the Court order that the af?davit in support of the criminal complaint and search warrants be sealed until further order of the Court. These documents discuss an ongoing criminal investigation that is neither public nor known to the target of the investigation. Accordingly, there is gOOd cause to seal these docu?rnents because their premature- disclosure may seriously jeopardize that investigation, including by giving the individual under investigation an opportunity to destroy or tamper with evidence, Change patterns of behavior, notify confederates, and ?ee horn prosecution. - Respectfully submitted, If!? 5 f2, ,4 Rx". {a are" Sean Wilson Special Agent US. Capitol Police C. Subscribed and sworn to before me on July; ,2019 . If I) :57 r?d if Kr; If} ft}! The Honorable Mark Coulson United States,Magistrate Judge j: . 13