Case Document 2 Filed 02/25/20 Page 1 of 49 Page D# 2 IN THE UNITED STATES DISTRICT COURT FOR FB 2 5 2020 EASTERN DISTRICT OF VIRGINIA CLERK. U-S- DISTRICT COURT Alexandria Division UNITED STATES OF AMERICA UNDER SEAL v. Case No. 1:20?mj?84 JOHN CAMERON DENTON, a/k/a ?Rape? a/k/a ?Death? a/k/a ?Tormentor? Defendant. AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT AND ARREST WARRANT 1, Jonathan Myles Lund, being ?rst duly swom; do hereby depose and state as follows: Introduction and Agent Background I . I am a Special Agent with the Federal Bureau of Investigation and currently assigned to the Cyber Crime Squad of the Washington Field Of?ce. I have been employed by the FBI since 2009. 2. In the course of conducting or participating in criminal investigations, 1 have been involved in interviewing and debrie?ng witnesses and informants; conducting physical surveillance; tracing and analyzing internet protocol addresses; tracing and analyzing ?nancial transactions; analyzing telephone pen registers; collecting and analyzing evidence; and preparing and executing search warrants. I have received organizational sponsored computer training as well as computer training at the SANS institute. I have also received training in the area of computer security and network administration. ALEXANDRIA VIRGINIA Case Document 2 Filed 02/25/20 Page 2 of 49 Page D# 3 1 Case Document 2 Filed 02/25/20 Page 3 of 49 Page D# 4 3. This af?davit is submitted in support of a criminal complaint and arrest warrant, charging JOHN CAMERON DENTON with conspiracy to commit an offense against the United States; to wit, interstate threats to injure, in violation of Title 18, United States Code, Section in violation of Title 18, United States Code Section 371. 4. The facts in this af?davit are based on my investigation, personal observations, training and experience, as well as communications with others who have personal knowledge of the events and circumstances described herein. Because this af?davit is limited in purpose, I am not including all facts known to law enforcement concerning this investigation. 5. Below, I will ?rst provide background on the investigation. I will then outline some of the swatting calls that were overt acts committed in furtherance of the charged conspiracy. In particular, I willrdetail three swatting events that took place in the Eastern District of Virginia, including the swatting of Old Dominion University, the Alfred Street Baptist Church in Old Town Alexandria, and a Cabinet of?cial living in Northern Virginia. I will then present evidence that DENTON joined the conspiracy and was familiar with how the conspirators chose and swatted targets. I will explain that DENTON was angry at several journalists and ultimately asked a co- conspirator to swat a journalist living in Northern California. DENTON was on the swatting call when it was perpetrated and admitted to an undercover law enforcement officer that he swatted the journalist. De?nitions 6. The Onion Router, also known as is an open-source publicly available software that enables anonymous activity on the intemet. TOR operates on the part of the intemet that cannot be accessed using traditional intemet browsers such as Google or Bing. This area of the 2 Case Document 2 Filed 02/25/20 Page 4 of 49 Page D# 5 intemet is sometimes called the ?dark web? or ?dark net.? TOR directs traf?c through a worldwide network of computers to conceal a user?s true geographic location and online activity. ?The TOR network makes it possible for users to operate websites in a manner that conceals the true intemet protocol addresses of the computers that host the websites. TOR identi?es these websites as ?hidden Services.? Like other websites, hidden services are hosted on computer servers that communicate through IP addresses. 7. An Internet Relay Chat is similar to an intemet chat room in that it allows for both one-on-one and group communication discussion in ?forums,? also known as ?channels.? An IRC is hosted on a server. Individual participants or ?clients? connecthto the server in order to transfer communications in the form of text to other clients connected to the server. 8. Discord owns and operates a free-access, all-in-one, voice and text chat application and website of the same name that can be accessed at In order to use Discord, a user creates an account and uses the account to communicate with other Discord users. There are different features a user can access on. Discord. Discord users can exchange private messages between users messages that do not appear in any text channel, but are revealed only to the users participating in the private communication, participate in text chat room discussions, and voice chat. Discord users can also create ?servers? that are similar to message boards that can only be accessed by users who have an ?invitation link.? Within these servers, users can set up different ?text channels,? where users can type written text, upload ?les under eight megabytes, and record these communications. Additionally, within these servers, users can be categorized and given designated roles. Such categorization and designation provides users with different levels of access-to the server. Case Document 2 Filed 02/25/20 Page 5 of 49 PagelD# 6 9. ?Swatting? is a harassment tactic that involves deceiving dispatchers into believing that a person or persons are in imminent danger of death or bodily harm and causing the dispatchers to send police and emergency services to an unwitting third party?s residential address. 10. ?Doxxing? is a harassment tactic that involves researching and publishing personally identi?able information about an individual, such as the person's date of birth, address, telephone number, or other unique identi?ers, on the intemet. PH can be obtained in. a variety of 7 ways, both legal and illegal. PROBABLE CAUSE A. Overview of the Conspiracy and Role in the Conspiracy 1 1. In this section, I will provide a brief overview of the conspiracy, including its objects and ways, manners, and means. The statements included in this section will be supported by evidence in the remainder of this af?davit. 12. This conspiracy began in the fall of 201 8. At that time, John William Kirby Kelley (?Kelley?) began hosting the Deadnet IRC channel, also known by the moniker ?#Graveyard,? on the Clearnet. The Clearnet refers to the traditional World Wide Web that is accessible through Google, another search engine, and by typing in the domain. Kelley is currently charged via criminal complaint in the Eastern District of Virginia with conspiracy to commit an offense against the United States; to wit, interstate threats to injure, in violation of Title 1 8, United States Code, Section 875(c), all in violation of Title 18, United States Code Section 371 (1 :19-mj-4). 13. This Deadnet IRC channel became a gathering point for a group of conspirators, who plotted and conducted swatting calls together. For purposes of this complaint, I will regularly refer to Kelley, Co-Conspirator 1, Co-Conspirator 2, Individual 1, and DENTON. However, there were 4 Case Document 2 Filed 02/25/20 Page 6 of 49 Page D# 7 many other co-conspirators. 14. DENTON was one of the leaders of the Atomwaffen Division in Texas. Atomwaffen Division is a white supremacist organization that is present across the United States and in some other countries.. He currently resides in Teicas. i 15. Kelley was a student at Old Dominion University in Norfolk, Virginia. Prior to his arrest, he resided in Northern Virginia. 16. Co-Conspirator 1 is a foreign national, who lives outside the United States. 17. Co-Conspirator 2 is a foreign national, who lives outside the United States. 18. Individual 1 is a US. citizen and lives outside the Eastern District of Virginia. He is currently charged by state authorities for his role in this offense. 19. The swatting events discussed in this af?davit took place between November2018 and February 2019. There were swatting events both before and after the swatting events discussed in this af?davit. 20. During the course of the conspiracy, DENTON, Kelley, Co-Conspirator 1, Co- Conspirator 2, Individual 1, and many others regularly took part in chats on the Deadnet IRC channel. The conspirators would meet in this channel to conduct swatting. . 21. Co?Conspirator 1 and 2 were the most proli?c swatters. Co-Conspirator and 2 asked other co-conSpirators in the Deadnet IRC channel to propose swatting targets. Co-Conspirator fl and 2 then chose from the options presented to them by the conspirators. Once, Co-Conspirator 1 and 2 chose a target, the conspirators would then use the Mumble application to listen to the swatting call in real time. ?Murnble is an open source Voice over Internet Protocol cormnunication tool. Simply stated, Mumble is a conference call application. Mumble also employs for 5 Case Document 2 Filed 02/25/20 Page 7 of 49 Page D# 8 user privacy. Other co-conspirators, including DENTON, have also admitted to conducting the swatting calls. 22. Co-Conspirators chose targets for different reasons. For instance, some conspirators proposed swatting individuals who were live streaming their activities. These targets were chosen because conspirators wanted to watch the law enforcement response to the threatening phone calls. Other conspirators, including Individual 1 and DENTON, chose targets because they were motivated by racial animus. These are but a few of the reasons why targets were chosen. 23. DENTON joined the Deadnet IRC channel no later than October 2018. DENTON did not usually post in the IRC channel; instead, DENTON chose to engage in direct messaging with conspirators. However, DENTON was regularly in the IRC channel when swatting calls were conducted. DENTON also used Mumble to listen to swatting calls planned and executed through the IRC channel. 24. DENTON chose at least two targets to swat the New York City Of?ce of ProPublica, which is non-pro?t newsroom that produces investigative journalism, and an individual (the ?Victim?), who is an investigative journalist that produced materials for ProPublica. As I will explain below, DENTON was ?Jrious with ProPublica and the Victim because they published his true identity and discussed his role in Atomwaffen. 25. As I will detail below, DENTON unknowingly met with an undercover FBI special agent. During this meeting, DENTON told the undercover of?cer about his role in the charged conspiracy. He described using the IRC channel to swat victim's. DENTON stated that he used a voice changer when he made swatting calls. DENTON admitted that he swatted the of?ces of ProPublica and the Victim. He also used the real moniker of Co-Conspirator 1. DENTON went so 6 Case Document 2 Filed 02/25/20 Page 8 of 49 PagelD# 9 far as to state thatit would be good if he was ?raided? for the swatting because it would be viewed as a top tier crime. DENTON felt that his arrest could bene?t Atomwaffen Division. 26. In order to avoid detection, the conspirators used The calls were made using Google Voice with email accounts kaseybaby99.s@gmail.com, jhulxo 000@gmail.com, and other email addresses. Importantly, the swatting calls DENTON chose to execute in particular, the swatting of ProPublica and the Victim, are linked to the same accounts that were used to swat targets in the Eastern District of Virginia. B. Background on the Investigation 27. This investigation began when conspirators swatted a Cabinet of?cial, who was a United States Secret Service protectee and living in Northern Virginia, within the Eastern District of Virginia. agents quickly connected this swatting event to a swatting event at Old Dominion University in Norfolk, Virginia, also within the Eastern District of Virginia. Old Dominion University Police Department received a swatting call from an unknown number on November 29, 2018. ODUPD contacted the FBI for assistance in analyzing the forensic evidence in the case. 28. 1 During the course of this investigation, law enforcement connected the swatting of the Cabinet of?cial and ODU to a number of other swatting calls. As I will explain below, there is probable cause to believe that the ODU swatting call and the swatting call of the Cabinet of?cial were perpetrated by individuals conspiring together on two dark web sites. The Deadnet IRC channel, also known by the moniker ?#Graveyard,? was used by the conspirators to communicate about swatting calls taking place. The conspirators posted intemet links to live videos of swatting events: The conspirators also posted past swatting events for entertainment and bragging. The 7 Case Document 2 Filed 02/25/20 Page 9 of 49 Page D# 10 conspirators selected high pro?le targets including government officials, executives, and journalists. Individuals streaming live videos were also targeted because the conspirators wanted to see how law enforcement responded to the swat calls. Some of the conspirators also appeared to share racist views, with particular antipathy for African Americans and Jewish people. As I will explain below, the conspirators targeted the Alfred Street Baptist Church, which is a predominately African American church in Old Town Alexandria, Virginia. 29. The conspirators also maintained a second dark web site known as DoxBin. The site was a repository of the P11 of potential and past swatting targets. The conspirators indicated on DoxBin that an individual had been swatted by placing a gun symbol next to the name of the person swatted. The DoxBin website primarily targeted government of?cials, executives, and journalists. 30. The conspirators conducted hundreds of swatting calls across the United States, Canada, and the United Kingdom. The conspirators were able to conceal their true identity by using The calls were made using Google Voice with email accounts and other email addresses. In setting up these accounts, the conspirators used information not readily attributable to the conspirators. Google logged the calls placed by many of the accounts used for swatting calls. The accounts required an email and to access the accounts, which limited who could use the accounts. 31. Law enforcement have determined that hundreds of swatting calls are related for a number of reasons: (1) the use of email addresses which included the moniker ?kasey? and ?kayla?; (2) discussions the conspirators had in the IRC chat where they claimed credit for the calls and discussed some of the swatting events in real time; and (3) the controlled access to the Google Voice accounts used to make the calls. Case Document 2 Filed 02/25/20 Page 10 of 49 Page D# 11 32. Law enforcement have determined that the primary voices on the swatting calls belong to two of the co-conspirators (?Co-Conspirator 1? and ?Co-Conspirator who are foreign nationals living outside the United States. Co-Conspirator 2 also hosted the dark web sites Deadnet IRC and .DoxBin', which, as I explained above, conspirators used to discuss the swatting calls. DENTON used the moniker ?Rape? and ?Tormentor? on Deadnet IRC when he participated and identi?ed targets to swat. . C. 33. During the course of this investigation, law enforcement learned that the Deadnet IRC channels in question were setup not to retain chat logs. Law enforcement learned that some past participants in the IRC chose to retain chat logs, and some participants provided these chat logs to law enforcement. The chat logs cover a substantial period of the conspiracy; however, the chat logs are incomplete and do not cover the entire period. 34. Based upon a review of the IRC chat logs, I submit there is probable cause to believe that individuals using the moniker ?Co-Conspirator ?Co-Conspirator and ?carl,? among others have conspired to issue numerous threats to injure in the United States, including in the Eastern District of Virginia. ?Co-Conspirator 1? and ?Co-Conspirator 2? were not the actual monikers used; rather, I have changed the monikers in an effort to protect the ongoing investigation. Below, I will detail some of the IRC chat logs that provide an overview of the conspiracy and establish that the swatting of Old Dominion University was an overt act in furtherance of this conspiracy. . 35. Kelley used the online moniker ?carl.? Law enforcement learned that Kelley was the moderator that established the original Deadnet IRC channel on the Clearnet. The conspirators used 9 Case Document 2 Filed 02/25/20 Page 11 of 49? Page D# 12 this channel to conduct swatting. 36. On or about November 4, 2018, Kelley participated in the Deadnet IRC channel. In the IRC channel, Kelley used the moniker ?carl.? I know Kelley used this moniker because Kelley recorded a video and referred to himself as ?carl.? In the video, Kelley discussed how he came to use the moniker ?carl.? Kelley stored the video on his 500 GB Seagate hard drive, which law enforcement later searched pursuant to a search warrant. Further, Individual 1, who is one of Kelley?s conspirators and friends, informed law enforcement that Kelley used the moniker ?carl?f on the Deadnet IRC. 37. Individual 1 has met Kelley in person. Individual 1 is cooperating with law enforcement and he is currently charged by state authorities. His charges arise out of his role in the swatting conspiracy. Individual 1 is cooperating because he hopes that the state authorities will dismiss his charges. During his ?rst interview with law enforcement, Individual 1 minimized his role and the role of others in the swatting conspiracy. However, Individual 1 has been more forthcoming in subsequent interviews. I believe the information that Individual 1 has provided is credible because I have corroborated much of his information through a review of the IRC chat logs, and with other information obtained during the course of the investigation. 3 8. After reviewing IRC chat logs, law enforcement identi?ed a number of conversations where participants in the IRC channel were coordinating and conducting swatting calls. On multiple occasions Co-Conspirator I asked the participants to identify new swatting targets, as detailed in the below conversation, which took place on November 4, 2018. [16:05] ?nd another target [l6z05] ?nd another target 10 Case Document 2 Filed 02/25/20 Page 12 of 49 Page D# 13 [16:05] ?nd another target [16:08] <~Zim> who did you swat [16:1 1] niggers [16:11] nothing yet [16:11] ive got a target though [16:11] [16:11] vape store 39. Based on my training, experience, and knowledge of this investigation, I believe Co- Conspirator 1 is making a request of everyone on the Deadnet IRC to identify a target to conduct swatting calls against. The group?s neo-Nazi ideology is apparent in the racial tones throughout the conversation logs. Prior to this conversation, Kelley left the IRC charmel and did not see the request from Co-Conspirator 1 to identify swatting targets. 40. Kelley returned to the Graveyard channel nearly two hours after Co-Conspirator I requested new targets on November 4, 2018, and without prompting provided a live streaming video feed to target for [swatting calls. [18:02] 04~carl? back [18:02] 04~carl? got new ?avors [18:02] <+saevyl> hey carl [Co-Conspirator 1] is swatting [138:02] 04~carl? for my dragon dick [18:02] 04~carl ] for real? [18:02] <+saevyl> yep [18:02] 04~carl[ is he in mumble 1 Case Document 2 Filed 02/25/20 Page 13 of 49 Page D# 14 [18:02] 04~carl? loldongs [18:02] <+saevy1> just ?shot his gf with an ar15? [18 :02] <+saevyl> [18:02] 04~carl ] ?lcing legend [18:02] 04~carl ] what mumble [18:02] just told them to get back [18:03] or else i kill the kids [18:03] 04~carl ] what [18:03] mumbleR [18:03] 04~carl ] mumble [18:03] im not in one 1 [18:03] OOF [18:03] <+saevyl> can I stream mumble through vlc? [18:03] <&zheme> hey carl [18:03] <+saevyl> does it work like that? [18:03] get in mumble, it will be funnier [18:03] 04~carl[1 sup zheme [18:03] zheme what falvor [18:03] zheme for ur vape [18:03] uhh [18:03] give me a min [18:04] ambulance loldongs 12 Case Document 2 Filed 02/25/20 Page 14 of 49 Page D# 15 [18:05] 04~carl? [18:05] 04~carl? next target 41. Based on my training, experience, and knowledge of this investigation, I believe Kelley provided a YouTube link above and identi?ed the link as the next swatting target. The YouTube link was a live video stream of the First Reformed Church of Schenectady in New York State. The co-conspirators targeted live video streams so they could view the swat response as it occurred. It is important to note Kelley was not present for the request from Co-Conspirator 1 to identify targets. Instead, it appears that Kelley made the effort to search YouTube, identify the target, and then offer it to his co-conspirators without prompting. 42. As the swatting call progressed on November 4, 2018, the group struggled to provide live audio of the swatting call. Kelley offered to help troubleshoot the issue. Once the audio was restored, Kelley asked if it was too early to record the call without being detected. [19:09] <~Co-Conspirator 1> can hear the beep [19:09] <~Zim> heard a beep [19:09] mumble address? [19:09] <~Zim> ye [19:09] cam? [19:09] Co-Conspirator 1> okay ?nally [19:09] Co-Conspirator 1> it was windows [19:09] <~Zim> loldongs [19:09] Co-Conspirator 1> privacy settings [19:10] <~Zim> what is the beep 13 Case Document 2 Filed 02/25/20 Page 15 of 49 Page D# 16 [19:10] Co~Conspirator 1> phone line [19:10] 04~carl ] ah [19:10] Co-Conspirator 1> he?ll talk soon [16:10] 04~carl ] thought it was my song [1 9: 1 0] <~Zim> hi dave [19:10] WERE HERE TO HELP YOU [19:10] <~Zim> dave is a professional negotiator [19:10] O4~carl 1 can I start recording [19:10] 04~carl? or will it pick that up [19:10] <~Zim> do it [19:10] <~Zim> ?as long as needed? [19:11] Co-Conspirator l> record [19:11] 04~carl? im going 43. Based on my training, experience, and knowledge of the investigation, the co- conspirators in the above chat are struggling with technical issues while attempting to share the audio of the swatting call. Kelley in capital letters reaf?rms that the co-conspirators on the call are all willing to help Co-Conspirator 1, who is the Voice of the swatting call. Kelley continued to engage by recording the call. This is signi?cant because the calls are often posted online for others to view; thus creating a following for the swatting calls and helping to promote the group?s neo-Nazi agenda. 44. After the swatting call ended; Kelley offered another target for the following day. Kelley offered Old Dominion University which was the university that he was attending, as a potential target to call. Co-Conspirator I asked for?Kelley?s .edu email in order to establish a 14 Case Document 2 Filed 02/25/20 Page 16 of 49 Page D# 17 Facebook account. The following conversation also took place on November 4, 2018. 45. [20:02] 41 04~carl 1 do my college tomorrow [20:04] Co-Conspirator 1> maybe [20:04] Co-Conspirator 1> carl [20:04] <&zheme sam woodwards hearing is on the 9th [20:04] Co-Conspirator 1> do know the login for the edu email have [20:06] 41 04~carl ] yeah [20:06] 04~car1 ] its in my old dm [20:06] 04~carl ] lsec [20:06] Co-Conspirator 1> use it to make a facebook account [20:06] Co-Conspirator 1> then send me the login for the fb account [20:06] Co-Conspirator 1> so i can dox younow [20:07] 04~car1 ] can you just uhh [20:07] 04~carll] use a temp email [20:07] 04~carl ] use mine [20:07] Co-Conspirator 1> no [20:08] <@wil> who tf is younow [20:08] Why do you need an edu [20:08] Co-Conspirator 1> because it will pass veri?cation [20:08] 0443qu oh alright Based on my training, experience, and knowledge of the investigation, Kelley in the above chat is offering his university, ODU, as a swatting target. The following conversation and 15 Case Document 2 Filed 02/25/20 Page 17 of 49 Page D# 18 requests from Co-Conspirator 1 focus on anonymously making the swatting call. Additionally, ?zheme? reminds the co-conspirators about a court hearing in the Sam Woodward murder case. Law enforcement believe Sam Woodward is associated with Atomwa??en Division, which is an extremist neo-Nazi group. Investigators believe Sam Woodward?s anti-Semitic views, in part, motivated him to commit murder. Kelley and other co-conspirators are af?liated with or have expressed sympathy for Atomwaffen Division. 46. On November 6, 2018, Kelley reminded participants on the IRC channel about swatting his college the next day in. order to avoid class. [04:43] 04~carl ] ?icking [94:43] 02~slimebox l fer reals [04:43] 02~slimebox? they are pist [04:43] 02~slimebox l 92 91 90 [04:43] Yeah they are [04:43] 04~carl ] good job [Co-Conspirator 1] [04:43] angy [94:43] 02~slimeboxll he dun it hard [04:44] 04~carl ] [04:44] 04~carl ] hope?illy we get a better crew next time [04:44] 02~slimebox 1 whole town shut down, the citizens all shook an scurrd now [04:44] 04~carl ] this was the best by far tho [04:44] 04~carl ] AHAHHAHAHHA 16 Case Document 2 Filed 02/25/20 Page 18 of 49 Page D# 19 [04:44] This was hilarious yeah [04:44] 04~carll norfolk next, I dont want to goto class on wed [04:44] 02~slimeboxll ok saving it 47. Based on my training, experience, and knowledge of the investigation, Kelley in the above chat is reminding the co-conspirators about his college as a future swatting target. The conversation about the swatting event is related to the call made on November 4, 2018, to a vape shop in New Hope, In response to that swatting call, local law enforcement issued a shelter in place for the small community. 48. On or about November 29, 2018, at approximately 2:08 ODUPD received a phone call from ablocked number. The caller stated they were armed with an 5 and had placed multiple pipe bombs within the campus buildings at ODU. The caller disconnected the ?rst call with ODUPD and called back at 2:26 a.m. 49. At approximately 4:56 ODUPD received a phone call from During the call, the individual apologized for making an accidental phone call. The dispatcher then contacted the investigating of?cer about this phone call. ODUPD compared the voice in the threatening phone call to the call received at 4:56 a.m. and determined that the two calls were likely made by the same individual. ODUPD identi?ed the caller as Kelley using school records provided by Kelley, which listed his phone number. 50. In response to the swatting call, ODUPD called in every law enforcement of?cer in the department. ODUPD contacted the Virginia State Police and the Norfolk Police Department to use their K9 of?cers. The Norfolk Police Department SWAT Team was put on standby to assist with the response to the threat. ODU was closed and professors were not allowed to return to the 17 Case Document 2 Filed 02/25/20 Page 19 of 49 Page D# 20 school. There was a shelter in place issued for the students on campus and students were not allowed to leave their dorms except to visit the dining facilities. Law enforcement searched and cleared every building on the ODU campus. D. IP Addresses Used for the ODU Swatting Call Link it to the Broader Swatting Conspiracy 51. After the aforementioned bomb threat was called in to ODUPD on November 29, 2018, and the subsequent phone call by Kelley at approximately 4:56 am, ODUPD made an exigent request of Verizqn to identify the phone number used to make the bomb threat. Verizon informed ODUPD the service provider was Cox Communications. Cox Communications provided the phone number and associated IP of the calls: a.l 2:08 - 7607058888 IP 69.252.226.123z5060; and b. 2:26 - 7607058888 IP 69.241.14.21825060. 52. Both IP addresses were searched through whois.domaintools.net and returned to Comcast. Comcast informed ODUPD the phone numbers were associated with Bandwidth.com and . the phone calls in question merely passed through their servers and did not originate there. Bandwidth.com informed ODUPD the phone number in question belonged to Google. Google informed law enforcement the two phone calls were placed by the Google subscriber over at 2:08 am. and 2:26 am. to 7576834000. The Google Subscriber information provided was as follows: a. Name: Bob Smitters; and b. Email: kasevbabv99.s@gmail.com. 53. The email address is signi?cant because it follows a pattern of other email addresses l8 Case Document 2 Filed 02/25/20 Page 20 of 49 Page D# 21 used to conduct swatting events. Examples of the other email addresses are kaseykaykayx00@gmail.com, kaseyx02001xo@gmail.com, and jhullx01000@gmail.com. The email addresses were used to make swatting calls through Google Voice and are linked to the group by IP addresses used. 54. On December 4, 2018, at approximately 7:03 am, ODUPD received another phone call from a blocked number on their non-emergency line. During the call, the caller stated he was located in the Webb Center and that he was in possession of a 9mm Glock and was going to shoot everyone in the building. The caller eitherplayed a prerecorded swatting or played excerpts from the prior swatting call made to ODU on November 29, 2018. E. Kelley?s Continued Activities in urtherance of the Conspiracy 55. On December 5, 2018, the logs from the Deadnet IRC show co-conspirators discussing Kelley?s contact with law enforcement. [02:48] <+saevyl> what happened to car] [02:48] <+saevy1> did he sleep [02:48] 02~slimebox ] you guys ratted him out on the swat [02:48] 02~slimebox 1 he got busted [02:49] 5 BATTERING RAM [02:49] 5 HJOLY FUCK ITS GONNA GET REAL [02:49] 02~slimebox 1 shit got seized [02:49] cam [02:49] 02~slimebox ] hope you guys ar happy 1 9 Case Document 2 Filed 02/25/20 Page 21 of 49 Page D# 22 [02:49] 02~slimebox ] sell out ur own friend [02:49] 02~slimebox ] [02:49] 02~slimebox ] all he ever did was be nice toyou [02:49] 02~slimebox1] and this is how you repay him [02:50] 02~slimebox? he probby never getting his stuff bacvk [02:50] 02~slimebox11 [02:51] <+saevyl> they goin in [02:52] 02~slimebox1] guys still dont even car Break in IRC Included [03:05] i he burnt himself [03:05] <~slimebox> assfags [03:05] i> and we care [03:05] <~slimebox> not what he says [03 :05] <~slimebox> he says ratted him [03:05] <~slimebox> he took the fall [03:06] <~slimebox> and i believ him [03 :06] 5 >ratted [03:06] <~slimebox> feel sad for guys [03:06] <~slimebox> if ur guys [03:06] <~slimebox> check to see if got any balls still [03:06] <~slimebox> 20 Case DOCument 2 Filed 02/25/20 Page 22 of 49 Page D# 23 [03:06] -irc.superjail.org- umode q: i tried to kick you from charmel #graveyard [03:06] <~Co-Conspirator 2> loldongs [03:06] ~slimebox grieves for car] [03:06] <~slimebox> [03 :06] Co-Conspirator 2> your being a massive faggot [03:06] i slimebox are you a bint [03:06] ~slimebox gets a teardrop fag tat for fallen Car] [03:07] <~slimebox> im done [03:07] Co-Conspirator 2> Carl fucked himself over [03:07] F'slimebox sets mode: -asshole slimebox [03 :07] <+saevyl> how so [Co-Conspirator [03:07] <~slimebox> i apologize [03:07] <+saevyl> hes doing ?ne [03:07] <+saevyl> aside from the bugged apartment [03 :07] <~slimebox> he moved into a refrigerator box [03 :07] Co-Conspirator 2> he called the campus police [03 :07] Co-Conspirator 2> not me [03:07] Co-Conspirator 2> or [Co-Conspirator 1] -[03 :08] <~slimebox> his toilet is a paint can [03:08] <~slimebox> but ya hes ok - [03:08] <~slimebox> he steals mcdonalds wi? for intemet now 21 Case Document 2 Filed 02/25/20 Page 23 of 49 Page D# 24 [0:3208] Co-Conspirator 2% you just said we ratted on carl 56. Based on my training, experience, and knowledge of the investigation, I believe the co-conspirators are discussing Kelley?s contact with law enforcement after the ODU swatting took place. One of the co-conspirators ?slimebox? is accusing the others in the group of ratting out Kelley. The response from Co-Conspirator 2 summarizes the view of the co-conspirators when he said ?Carl fucked himself over.? I believe this refers to Kelley?s call to ODUPD after the swatting call. When Kelley placed this call, he did so without obscuring his identity through the Google Voice account. 57. On December 5, 2018, Kelley re-entered the Deadnet Kelley sought advice from Co-Conspirator 1 on moving the server and using a Virtual Private Network in the Netherlands for operational security. A VPN extends a private network across a public network, and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Applications running on a computing device, e. a laptop, desktop, smartphone, across a VPN may therefore bene?t from the functionality, security, and management of the private network. is a common, though not an inherent, part of a VPN connection. Within a few hours, Kelley was working to identify new swatting targets for his co-conspirators. [03:36] <~carl> slimebox: stop feeding niggas fake info [03 :37] 5 ban him [03:37] <+saevyl> earl [03:38] <+saevyl> I understand everything now [03:38] <+saevyl> Lion is the ?nal boss of the feds 22 Case Document 2 Filed 02/25/20 Page 24 of 49 Page D# 25 [03:38] <+saevyl> He?s the fed puppet master [03:38] <+saevyl> it?s the ultimate twist [03:39] <+saevy1> I guess thats them extracting them [013:42] <~carl> lmaoo thats why his opsec is so good [03:43] <+saevy1> You kill all of the feds in the lower levels of the pentagon [03:43] <+saevyl> you take the elevator back up to the war room 0 [03:43] <+saevyl> you know the one from Doctor Strangelove [03 :43] <~carl> ?never watched it [03:43] <+saevyl> nigger what [03:43] <~carl> [Co-Conspirator l] [03:43] <~carl> is .nl a good country for-vpns and shit [03:43] <+saevyl> its 70 years old how have you never seen it [03:43] <~carl> thinking of dumping this server and getting one there [03:44] <~carl> because im gay Break in IRC Included [07:48] <~carl> mornin [07:48] <~carl> slimebox: what up to [07:56] carl [08:02] <~carl> sup [08:03] <~carl> SwattedJ: [08:03] <~SwattedJ> i need a cam 1 23 Case Document 2 Filed 02/25/20 Page 25 of 49 Page D# 26 [08:03] <~SwattedJ> help me ?nd a target carl [08:04] <~carl> kk [08:04] <~carl> ever look into that shodan livemap? [08:04] <~carl> thought it was a bundle of shit 58. Based on my training, experience, and knowledge of the investigation, I believe Kelley returned to the Deadnet IRC for the ?rst time since his contact with ODUPD following the swatting call. Kelley?s ?rst communication with Co-Conspirator 1 is to determine a country that provides greater anonymity online. Kelley speci?cally asked if the Netherlands would be a good place for a virtual private network to obscure his true identity. Later in the same conversation, Kelley engaged in a conversation about identifying live video feeds to target. Shodan, a website showing unsecured video feeds, was speci?cally mentioned. I also note that the co-conspirators continue to use demeaning racial language. 59. On or about December 10, 2018, the co-conspirators on the Deadnet IRC harassed Kelley for swattin ODU. [18:12] <~Zim> First step, BOMB THREAT YOUR OWN SCHOOL [18:12] <~Zim> you hear that car] [18:12] <~Zim> [18:13] carl dummy [18: 13] <@zovix> carl [18:13] 7* +Boruvkov has quit IRC (Read error) [18:14] Co-Conspirator 2> Rule #1 If you call in a bomb threat to your own school, make sure you tell the school it was you. 24 Case Document 2 Filed 02/25/20 Page 26 of 49 Page D# 27 60. Based on my training, experience, and knowledge of the investigation, I believe the co-conspirators are harassing Kelley because he identi?ed his own university as a swatting target. F. A_dditional Sivatting Calls in the Eastern District of Virginia that are anected to this Conspiracy 61. On or about November 3, 2018, the Alexandria Police Department responded to a bomb threat made against the Alfred Street Baptist Church, which is located in Alexandria, Virginia, within the Eastern District of Virginia. 62. On- November 3, 2018, at approximately 7:02 pm, a caller used a blocked phone number to contact the Department of Emergency Communications (DEC) non-emergency administrative line. The caller identi?ed himself as ?George? and advised that he placed three pipe bombs at the Alfred Street Baptist Church and was going to ?blow it up.? The caller stated the word ?shooting? and that the caller was going to kill everyone at the church. Additionally, the caller advised he had control over the bombs and would not specify their location. The call taker from APD determined the caller sounded muf?ed and out of breath during the conversation. The call taker also advised it sounded like a middle aged, white male with a Hispanic accent. 63. APD responded to Alfred Street Baptist Church and set up a perimeter, evacuated its occupants, and used K9 units ?to sweep the interior and exterior of the building. The explosive sweep produced negative results and APD cleared the scene. After determining this was a false bomb threat, APD opened an investigation. 64. During the course of the investigation, APD obtained records from Verizon indicating phone number called DEC at 7:02 pm. on November 3, 2018. According to a law enforcement database, this number returns to Bandwidth. Further investigation revealed the 25 Case Document 2 Filed 02/25/20 Page 27 of 49 Page D# 28 telephone number is a number and all subscriber information would be available through the wholesale customer, Google Inc. 65. Google informed APD the Google email account kasevbabv99.s@gmail.com made the call to DEC. This is the same Google account used to make the swatting call against ODU. 66. On January 27, 2019, at approximately 2:44 am, an individual called the APD non- emergency line and provided an address belonging to a Cabinet of?cial and protectee. The caller stated he had an AR-15, had shot and killed his girlfriend, had her two children tied up in the laundry room and he would kill them if he did not speak to the hostage negotiator, and that he had a pipe bomb that he would detonate. The caller?s voice is muf?ed and sounds as if he is out of breath. 67. The APD contacted the who informed the APD that these events had not taken place and that there was no need to respond to the Cabinet of?cial?s home. 68. During the course of the investigation, APD obtained records from Verizon indicating phone number called DEC at 2:44 am. on January 27, 2019. According to a law enforcement database, this number returns to Bandwidth. Further investigation revealed the telephone number is a number and all subscriber information would be available through the wholesale customer, Google Inc. 69. Google informed APD the Google email account ihullx01000@gmail.com made the call to DEC. 70. IP addresses accessing kaseybaby99.s@gmail.com and jhullxo@gmail.com also accessed personal email accounts shown to pay for the dark web server supporting the hidden service DoxBin. During the time of the Alfred Street Baptist Church swatting call, Co-Conspirator 1 was logged into the kaseybaby99.s@gmail.com account using IP Address 46.246.12.44. Co-Conspirator 26 Case Document 2 Filed 02/25/20 Page 28 of 49 Page D# 29 1 was also logged into the Deadnet IRC channel using the same IP address. 71. Based on my training and experience, IP addresses are a unique identi?er of intemet access point at a point in time. Co-Conspirator 1 using the same IP address on two sites at the same point in time con?rms that he was the voice on the Alfred Street Church swatting. Further, Individual 1 confirmed that he selected the Alfred Street Church because it was an A?ican American church. Individual I explained that he and the other co-conspirators are white supremacists and are sympathetic to the neo-Nazi movement. Individual 1 con?rmed that Co-Conspirator 1 was the voice on the call. The same Google Voice was used to place the swatting calls. to ODU, the Cabinet of?cial, and countless other swatting victims. The email accounts used to make the calls had passwords limiting who would be able to access the accounts. 72. Finally, according to Individual 1, Kelley continued to take part in the IRC chats at least until law enforcement approached Individual 1 in April 2019. After this date, Individual 1 could no longer acceSs the intemet because his eleCtronics were seized during the execution of a . court-authorized search warrant. 73. There is no evidence that Kelley at any point took steps to withdraw from the conspiracy. G. Denton?s Use of the Moniker ?Rape? in the Graveyard IRC Channel and Overt Acts in Furtherance of a Conspiracy to make Threats to Iniure 74. According to Individual 1, he met DENTON on a Discord channel, where DENTON was a moderator. Discussion in the channel was focused on the group?s white supremacist views. DENTON is one of the founding members of Atomwaffen Division, which is a neo-Nazi organization that has been linked to several violent acts, including murder. DENTON encouraged 27 Case Document 2 Filed 02/25/20 Page 29 of 49 PagelD# 30 Individual 1 to join Atomwaffen Division when he turned 18 years old. Individual I learned about Siege, which is a book written by neo-Nazi James Mason. James Mason joined the channel on multiple occasions to offer the group encouragement in pursuing neo-Nazi activities and views. DENTON expected channel participants to join the channel when James Mason spoke to the group. Individual 1 also read the bomb making manuals posted on the channel by moderators and members. 75. When the lead moderator left the channel, Individual I began engaging with DENTON on a more personal level. Individual I spent several hours a week communicating with DENTON through Discord and other applications. Individual I knew DENTON to use the monikers ?Rape,? and ?Tormentor.? Individual I learned true identity after a ProPublica article published it. DENTON acknowledged to Individual 1 that he was the person named in the article. 76. After Discord chat logs were shared with journalists, Individual 1 and the group attempted to ?nd a more secure form of communication. A friend of Individual 1, who used the moniker ?Lion,? encouraged Individual 1 to transition their communications to the Deadnet IRC to avoid law enforcement attention. Individual I invited DENTON and other Atomwaffen members to communicate on the Deadnet IRC. The Deadnet IRC became a gathering place for swatting activity and expressions of white supremacist neo-Nazi views. This is the same channel where the swatting events set forth above were planned. . 77. Below is an excerpt from the Deadnet IRC on December 7, 2018, where participants are discussing DENTON, Who used the moniker Rape. Both Individual 1 and another conspirator have stated that DENTON used Rape as his online moniker. In the comments below, job appears to be associated with funerals. [ll2z34] <+saevyl> also zheme wheres rape at 28 Case Document 2 Filed 02/25/20 Page 30 .of 49 Page D# 31. i [12:34] <+saevy1>I havent seen him in like 2 weeks now [12:34] <~Zheme> hes busy at work [12:34] <~Zheme> they make him wake up at 5 am [12:34] <~Zheme> dumb funerals [152:35] <+saevyl> Its annoying to go on furaf?nity to look for cool nazi furry shit [12:35] <+saevyl> and seeing a bunch of autistic like ?Nazi furs fuck off" posters [12:35] <+saevyl> why can't nazis and furries just live in peace [12:35] <+saevyl> i [12:36] <~Zheme> nazi furs 11le off [1:2136] <~Zheme> Thats a reference to a ?icking gas ass punk song [1?2:36] <~Zheme> and that punk song literally sucks [1:2136] ?+saevyl> Yeah, I know it is <~Zheme> rape is retarded and doesnt think that it means ?nazis suck? [12:36] <+saevyl> what does he think it means?? [12:37] <~Zheme> he thinks it just means nazis at shows who ?ght [12:37] <~Zheme> though no one but him thinks that [1;2:39] <~Zheme> one of the things i disagree with him with [12:39] <~Zheme> he used to be a skinhead [12:40] <+saevyl> I disagree-with him not being a snow leopard [12:41] <~Zheme> he is though [12:41] <~Zheme> wanna piss him off? [12:41] <+saevyl> sure 29 Case Document 2 Filed 02/25/20 Page 31 of 49 Page D# 32 [12:41] <~Zheme> ill make Something real quick [12:42] <+saevyl> a drawing of snow leopard rape? [12:42] <~Zheme> yes [12:42] <+saevyl> can draw? [12:45] <~Zheme> no [12:45] <+saevyl> fug 78. Based on my training, experience, and knowledge of the investigation, the participants appear to know personal details about DENTON and his employment in a mortuary. He is referred to as ?Rape? in the chat; however, the participants appear to know who DENTON is. Further, law enforcement have [con?rmed that DENTON did work at a mortuary. 79. Further, according to my review of the chat logs, the online moniker Rape was present when several swatting events were planned on the IRC Deadnet. According to Individual 1, DENTON also joined Mumble calls during several of the swatting events. Mumble is an open source communication tool. Simply stated, Mumble is a conference call application. Mumble also employs for user privacy. The conspirators used Mumble during swatting calls, so that they could hear the calls to law enforcement live as one of the conspirators actually made the call. Thus, DENTON was aware of how the co-conspirators planned and executed the swatting calls. 80. Below is an excerpt from the Deadnet on November 18, 2018, where participants are conducting swatting calls. Kelley invites a participant, saevyl, into a Mumble call. [22:01] hi saevyl [22:01] 04~car1ll want to join mumble? [22:02] <~Co-Conspirator 2> 3O Case Document 2 Filed 02/25/20 Page 32 of 49 Page D# 33 [22:02] <+saevyl> yeah, I can, but my audio will be shitty [22:02] <+saevyl> let me set up my noise ?lter [22:02] 02~slimebawx? everybodys doin it, [22:05] 02~slimebawx1 i keep hearin help in the background [22:05] 02~slimebawx1] ya well i keep hearin, 39.95 PLEASE [22:05] 02~slimebawx? FLOYD AR HEAR [22:06] <+saevyl> damn why do all of you people have such good mic quality [22:06] <+saevyl> its not fair [22:06] 02~slimebawx 1 ghost hunting relies on BAD MIC QUALITY [22:07] <+saevyl> mics muted While I try to make sure audio ?lter works [22:07] <+saevyl> its unbearable with the noise [22:08] Co-Conspirator 2> [22:09] <+saevyl> he's right, im not a physical entity, just a manifestation [22:10] Co-Conspirator 2> thanks for the hookup [Co-Conspirator 1] [22:11] Co-Conspirator 2> drink all the booz [22:11] Co-Conspirator 2> ?sh and the things [22:11] Co-Conspirator 2> i'm fucked [22:11] Co-Conspirator 2> i took a sleeprr [22:12] Co-Conspirator 2> gn fags [22:12] Co-Conspirator 2> swat again tomorrow [22:13] <+saevyl> rip [22:15] Co-Conspirator 2> gn all 31 Case Document 2 Filed 02/25/20 Page 33 of 49 Page D# 34 02[22:16] Quits: Co-Conspirator 2 ([Co-Conspirator 2] (Quit: Leaving? [22:17] Quits: Co-Conspirator 1 ([Co-Conspirator (Ping timeout: 180 secondsl] 1 [22:18] Joins: Co-Conspirator 1 ([Co-Conspirator 1 [22:18] george sets mode: +v Co-Conspirator 1 [22:19] 04~carl ] [22:22] 02~slimeba?vx? I LOVE NOM NOMS AND I CANNOT LIE [22:23] 02~slimebawx1] fag swat [22:23] <11 02~slimebawx ] SWAG FATS [22:25] Co-Conspirator 1> bint said she will fuck me if i buy her booze [22:25] Co-Conspirator 1> wat [22:25] Co-Conspirator 1> fuck off [22:25] Co-Conspirator 1> ill just rape her with no booze [22:27] O2~slimebawx ] RAPE RAPREE [22:27] <11 02~s1imebawx ] take one for the fat team Co-Conspirator 1> that is so grimy [22:28] Co-Conspirator 1> she prob said that to everyone lmao [22:47] Quits: Co-Conspirator 1 ([Co-Conspirator 1] (Ping timeout: 180 seconds? [22:48] Joins: Co-Conspirator 1 ([Co-Conspirator 1] 32 Case Document 2 Filed 02/25/20 Page 34 of 49 Page D# 35 [22:48] george sets mode: +v Co-Conspirator 1 [22:59] Joins: pellegri [22:59] george sets mode: +o pellegri [23 :03] <+zheme> [23:03] <@pellegri> [23:24] <+saevyl> [23:28] Joins: GLITCH [23:28] george sets mode: +qo GLITCH GLITCH [23:35] Co-Conspirator 1> Rob Ford crack video released [23:36] Quits: +zheme (zheme@BAWX- (Quit: Lost terminal? [23:43] <+saevyl> [q 84 i [23:43] 84 I SWALLOWED THE BOMB, AND ATE THE BABY, AND IM COMING FOR NEXT DAVE [23:49] Quits: Co?Conspirator 1 ([Co-ConSpirator 1] (Quit: Leavingl] [23:54] 04~carl? lmao [Co-Conspirator 1] [23:54] <+saevyl> lmao [23:54] <+saevyl> angry 33 Case Document 2 Filed 02/25/20 Page 35 of 49 PagelD# 36 [23:54] its back now [23:54] tell rape to come back [23:54] <+saevyl> its a different rsa cert [23 :54] <+saevyl> should it be trusted? [23:55] alright lmao [23:55] <+saevyl> is [Co-Conspirator 1] throwing a ?t [23:55] im gonna setup a server [23:56] <+saevyl> ok set up a server 81. Based on my training, experience, and knowledge of the investigation, the co- conspirators in the above chat are using the audio application Mumble as they conduct the swattings. Due to technical dif?culties, DENTON appears to leave the swatting call. Kelley asks the other co- conspirators to ?tell rape to come back.? 82. Below is an excerpt from the Deadnet IRC on November 18, 2018, where a co- conspirator using the moniker zheme communicates a request for Kelley to enter a Mumble call. [01218] <+zheme> carl: get on mumble [01:18] <+zheme> rape wants to talk to you [01:18] <+zheme> carl_ [01:18] <+zheme> carl_ [01:18] <+zheme> carl_ [011:18] <+zheme> carl_ [01:18] <+zheme> carl_ 34 Case Document 2 Filed 02/25/20 Page 36 of 49 Page D# 37 [01 :18] <+zheme> car1_ [01 :19] <+zheme> carl_ [01:36] <&Toast> [Co-Conspirator is a stupid nigger who can't' even hack billboards [01 :36] <&Toast> !last Toast [01 :36] 0 seconds ago, you said '!last Toast? [01:36] <&Toast> wow okay [01:36] <&Toast> !aq [Co-Conspirator is a stupid nigger who can't even hack billboards [91:36] Quote #132 has been added. [01:36] <&Toast> !q 132 [01:36] 132 [Co-Conspirator is a stupid nigger who can't eVen hack billboards [91:36] <&Toast> !dq 132 [01:36] Deleted quote #132. [91:36] <&Toast> /ignore this dick nigga [01 :42] <+zheme> 905 .webm [01:43] <+zheme> car1_ [01:43] <+zheme> car1_ [01:43] <+zheme> carl_ [01:43] <+zheme> car1_ [01:44] <&Toast> car1_ 35 Case Document 2 Filed 02/25/20 Page 37 of 49 Page D# 38 [01:44] <&Toast> car1_ [01:44] <&Toast> carl__ [01:44] <&Toast> car1__ [01:44] <&Toast> carl_ [01:44] <&Toast> car1_ [01:44] <&Toast> car1__ [01:44] <&Toast> car1_ [01 :45] <+zheme> [01;45] <+zheme> carl_ [015:45] <+zheme> car1_ [01:45] <+zheme> car1__ [01:45] <+zheme> carl_ [01:45] <+zheme> car1_ [01:45] <+zheme> carl_ [01:45] <+zheme> car1_ [011:45] <+zheme> Carl_ 01 [01 :45] 02~slimebawx? child loose alerty [01;45] <+zheme> carl_ [013:45] <+zheme> car1_ [01;45] <+zheme> carl_ [01:45] <+zheme> carl_ [01:45] <+zheme> carl_ 36 Case Document 2 Filed 02/25/20 Page 38 of 49 PagelD# 39 [01:45] <+zheme> carl_ [011:45] <+zheme> carl__ [01:45] <+zheme> carl_ [01:45] <+zheme> 83. Based on my training, experience, and knowledge of the investigation, including statements made by Individual 1 and another co?conspirator, DENTON would avoid actually typing in the #Graveyard IRC channel. Above, DENTON enlists a co-conspirator using the moniker zheme to contact Kelley about entering a Mumble audio chat with DENTON. DENTON used Mumble to communicate privately with individuals without having to leave written statements. 84. The IRC logs for deadnet.org contained IP addresses used by chat participants to log into the forum. Most participants in the forum used VPNs and other anonymization techniques to access and participate in the chats. Investigators with the Los Angeles Police Department reviewed the logs and determined that user ?Rape? a/k/a ?Tormentor? logged in from non- anonymized IP address on October 21, 2018. LAPD subsequently issued a subpoena to Suddenlink, the internet service provider having control of this IP address and authority to assign it to a Suddenlink customer, requesting subscriber information for the period during which user ?Rape? a/k/a ??Tormentor? logged into deadnet.org. Suddenlink responded that IP address this IP address had been assigned to DENTON. The address associated with the account is known address in Texas. 85. Some conspirators also chatted in the IRC channel #Siege Culture. The #Siege Culture channel Was for co-conspirators with white supremacists views. In an effort to limit who saw communications, DENTON communicated primarily in the #Siege Culture channel. 37 Case Document 2 Filed 02/25/20 Page 39 of 49 Page D# 40 The swatting conspiracy was also executed in this channel. The #Siege Culture channel is referenced in the below Deadnet IRC chat, which took place on October 24, 2018. [03:08] <+zheme> please carl [03 :08] <+zheme> you know i need this [03 :09] 04~carl ] loldongs [03:09] <+zheme> my balls are already sore from tonights beating of the cock [03:09] toast, did car] just get you? [03:09] <+zheme> i have used almost 2 cups worth of lube [03 :09] damn son [03:09] em eh [03:09] topjej [03:09] <+zheme> and im too lazy to take a shower, so i smell like baby lotion [03:09] <+zheme> i will use baby lotion to fuck a baby-sized pocket pussy [03:09] O4~carl[l !aq zhemel] 06>[l my balls are already sore from tonights beating of the Cock? 3 [03:09] Quote #49 has been added. [03:10] 04~carl? zheme: rape is shittalkin min #30 [03: 10] <+zheme> im thinking of taking zinc and magnesium to make my cum pearly white [03:10] saying how bad you are at chess [03:10] <@saevyl> I wonder if I can make my voice into monokuma with a neural net 38 Case Document 2 Filed 02/25/20 Page 40 of 49 Page D# 41 [03:10] O4~carl l into what [03: 1 1] <@saevy1> monokuma 86. Based on my training, experience, and knowledge of the investigation, DENTON is communicating with Kelley in the Siege Culture IRC channel. Above, Kelley comments to zheme that DENTON ?is shittalkin min I know #sc to refer to the #Siege Culture channel of the IRC. H. Concern after Kelley is Approached by Law Enforcement 87. On December 5, 2018, concern about Kelley being arrested is discussed in the IRC. There are also comments on the use of Mumble as another form of communication. This corroborates Individual 1?s statements that the conspirators often used Mumble during the swatting calls. [15:3 7] [93] for any questions or concerns about New Hope's SWAT situation capabilities, please email George LolDongs: newhopeswateval@hotmail.com [15:37] <+zeem> !rq [15:3 7] Initializing public quotes system fOr the 2>saevyl . [15:45] <+zeem> why was the irc down all morning Co-Conspirator 2 [15:46] Co-Conspirator 2> No idea [15:46] no [15:46] Co-Conspirator 2> It was online 39 Case Document 2 Filed 02/25/20 Page 41 of 49 Page D# 42 [15:46] <+zeem> why couldnt i connect then [15:46] Co-Conspirator 2> Just wouldn't let anyone reconnect [15:46] <+zeem> [15:46] <4 Co-Conspirator 2> Yeah same [15:46] <+zeem> it is a conspiracy [15:46] Co-Conspirator 2> Mumble was been online all night [15:46] <+zeem> was been [15:46] Co-Conspirator 2> yeah [15:47] <+zeem> i need something to read [15:47] <+zeem> i dont wanna read that march of the titans because im bored of history [15:47] <+zeem> rape is afraid that carls gonna get arrested [15:57] <@wil> by the mounties? loldongs [15:58] <+zeem> yes [15:59] <+zeem> wil [16:12] <+zeem> god 88. Based on my training, experience and knowledge of the investigation, I believe DENTON and other members of the Deadnet IRC are expressing concern that law enforcement will be able to track the swatting calls back to the group because Kelley unintentionally called the ODU police after the swatting call. 89. In February 2019, after law enforcement arrested Kelley on drug charges, the conspirators moved the Deadnet IRC to TOR. According to Individual 1, this was an effort to make 40 Case Document 2 Filed 02/25/20 Page 42 of 49 Page D# 43 it more dif?cult for law enforcement to identify the conspirators. I. Anger at a. Journalist and Swatting of Journalist 90. DENTON expressed his hatred for journalists and the media to Individual 1 and others. More speci?cally, DENTON expressed hatred for speci?c journalists and media outlets whose articles discussed white supremacist groups and individuals associated with the groups. DENTON expressed frustration about how neo-Nazis were being portrayed. DENTON was particularly angry with a select ,few journalists, who had identi?ed DENTON as a member of Atomwaffen. 91 . Individual 1 introduced DENTON to Co-Conspirator 2 online. Co-Conspirator 2 was motivated by his own racist views when he selected targets to swat. DENTON discussed with Co- Conspirator 2 speci?c journalists that he was angry with because of the negative articles these journalists wrote about neo-Nazi groups. According to Individual 1, DENTON wanted the Victim, who was a journalist, doxed so that the group could then swat the Victim. 92. According to Individual 1 and other evidence in this case, DENTON targeted the Victim because the Victim wrote an article in ProPublica, which identi?ed DENTON as a leader of Atomwaffen Division. DENTON was also angry because the Victim approached DENTON at a music festival in Texas for a then upcoming news series. J. Swatting of ProPublica?s New York City Of?ce and a ProPublica Journalist 93. On December 14, 2018, the New York City of?ce of ProPublica was swatted. The swatting caller identi?ed himself as James Mason and stated that he was af?liated with Atomwaffen Division. The caller said he had multiple pipe bombs, an AR 15, one hostage, and a dead body. The caller said he would begin shooting at police once they arrived. 41 Case 1:20-mjf00084-IDD Document 2 Filed 02/25/20 Page 43 of 49 Page D# 44 94. The City of New York Police Department responded to the ProPublica of?ces with approximately a dozen of?cers. The initial responding of?cers determined that the threat did not appear credible. As a result, NYPD chose to limit its response to the initial responding of?cers. NYPD of?cers cleared the 13th ?oor, which is where the purported threat was located. During the operation, NYPD found a single employee in the of?ce. This employee was visibly shaken by the threat and police response. Through interviewing the employee and additional investigative steps, NYPD of?cers determined that ProPublica was a publishing company that had conducted investigative reporting on Atomwaffen Division. 95. As stated above, DENTON wanted the Victim doxed because he wanted to swat the' Victim. After Co-Conspirator 2 successfully doxed the Victim and located his address, DENTON, Individual 1, and Co?Conspirator 2 swatted' the Victim. 96. On February 8, 2019, DENTON, Individual 1, and Co-Conspirator 2 swatted the Victim, who was a journalist with ProPublica. DENTON, Individual 1, and Co-Conspirator 2 used the Mumble application during the swatting call. DENTON and Individual I listened to the call, while Co-Conspirator 2 called the Richmond Police Department, who are located in Northern California. Co-Conspirator 2 identi?ed himself as the Victim and stated that he shot his wife with an M16. Co-Conspirator 2 initially refused to answer questions and stated that he was holding a loaded M16 and planned to shoot any of?cers that approached the residence, and then himself. 97. The Contra Costa County Sheriffs Of?ce contacted Verizon to determine the physical location of the phone call. The call was determined to come from a landline in Jersey City, New Jersey. Jersey City Police responded to that address and found a couple at home. Both individuals said they had no knowledge of the call being placed from their home. 42 Case Document 2 Filed 02/25/20 Page 44 of 49 Page D# 45 98. Local law enforcement responded to the Victim?s home. Both the Victim and his wife were removed from their home and placed in separate police cruisers. The Victim?s young son and another relative were left in the 'home. The Victim explained that he had been receiving threats because he was a journalist that wrote about white supremacists. Law enforcement released the Victim and his wife and then let them reenter their home. The Victim and his family were shaken by these events. 99. On December 13, 2018, one day prior to ProPublica being swatted, the Deadnet IRC logs shows DENTON engaging with other co-conspirators online. [03:19] -irc.phear.ca- Client connecting: Rapist (Rape@r74-193-8- 198.cnrocmta01 .conrtx.t1.dh.suddenlink.net) [74.193.8.198] {clients} [secure ECDHE-RSA-AES25 6-GCM-SHA3 84] 100. Google con?rmed that the kayla000887@gmai1.com account was used to call the Richmond Police Department. This is an account known to be used by the co-conspirators on the Deadnet IRC when conducting swattings. . 101. Further, the same Google Voice number that was used to swat ODU, the Alfred Street Baptist Church, and the Cabinet, was also used to swat ProPublica?s of?ce. This same Google Voice number was also used to call the Richmond Police Department on the same day that the Victim was swatted. K. FBI Undercover Law Enforcement Meeting with DENTON 102. On January 9, 2020, DENTON unknowingly had a meeting with an undercover FBI special agent in his home. During the conversation, DENTON said he got his foot in the door with Deadnet conducting swatting calls. DENTON stated that he used a voice changer during calls, and 43 Case Document 2 Filed 02/25/20 Page 45 of 49 Page D# 46 that other conspirators silenced their microphones to listen. 103. DENTON stated that he swatted journalists who had reported on DENTON. DENTON explained that he was able to view some of the swatting incidents on street cameras as the swattings unfolded. This is consistent with the evidence in the case, including video recordings of past swatting events recovered from Kelley and Co-Conspirator 2?s electronic devices. Thus, co- conspirators are capable of viewing and recording swatting events. 104. DENTON also speci?cally mentioned the swatting of ProPublica to the undercover agent. DENTON stated that he swatted ProPublica and the entire building had to be evacuated. He also told the undercover agent that he participated in the swatting of the Victim?s home. 105. DENTON said if he was ?raided? for swatting ProPublica then it would be good for Atomwaffen Division because the swatting would be seen as a top-tier crime. DENTON stated that he did not expect the media to report on particular swatting events because of fear of how neo-Nazi followers might respond. He also speculated that such reports might encourage copycat swat calls. 106. DENTON said he learned the technical computer skills he has from individuals on Deadnet. DENTON stated that he and other conspirators that he met on Deadnet were planning to conduct sophisticated cyber-attacks against corporate targets with the intention of denying access to their accounts. DENTON indicated that he was not doing the computer programing. 107. DENTON wanted to swat a journalist in the United Kingdom for writing articles about neo-Nazis and identifying DENTON as a member of Atonwaffen Division. Individual 1 said that DENTON and conspirators settled on sending this journalist harassing messages because they were unable to locate the journalist?s home address 108. During meeting with the FBI undercover agent, DENTON stated that he 44 Case Document 2 Filed 02/25/20 Page 46 of 49 Page D# 47 was able to take down a United Kingdom journalist?s website that he targeted with Deadnet co- conspirators. DENTON explained that they targeted this journalist because of articles he had written about DENTON and his af?liation with Atomwaffen Division and neo-Nazis. L. Other Swatting Events Linked to this Conspiracy 109. The below table lists some of the swatting calls that enforcement believes were committed by the conspirators in this case. The calls were primarily made in November and December of 20 8 and impact 134 different law enforcement agencies. The below list purposefully excludes some ofthe swatting calls that law enforcement believes are part of the charged conspiracy. Agency State/Prov Agency State/Prov Banff RCMP AB Fort Lee PD NJ Edmonton PD AB Manasquan PD NJ Lethbridge PD AB Montclair NJ Florence PD AL Monmouth County SO NJ Gulf Shores PD AL Albuquerque PD NM Kamloops RCMP BC Las Vegas Metro SO NV Anaheim PD CA Little Valley SO NY El Cajon PD CA NYPD NY Hesperia PD CA Onondaga County SO NY Los Angeles PD CA Sag Harbor PD NY Los Angeles SD CA Schenectady PD NY Mun'ieta PD CA Southampton PD NY Palo Alto PD CA Suffolk County SO NY Richmond PD CA Syracuse City PD NY county CA Yorkville Village PD NY San Bernardino Ca CA Cincinnati PD OH San Bernardino SO CA Cleveland PD OH San Francisco PD CA Columbus PD OH San Jose PD CA Dayton PD OH Santa Clarrg REACT CA Deshler PD OH. Santa Rosa PD CA Fairborn PD OH 45 Case Document 2 Filed 02/25/20 Page 47 of 49 Page D# 48 Agency State/Prov Agency State/Prov Denver PD CO Henry County SO OH Boca Raton PD FL Hilliard City PD OH Deltona PD FL Marion PD OH Ft. Myers PD FL North Kingsville PD OH Jackson Beach PD FL Norwalk PD OH Key West Fire FL Warren PD OH Miami Beach PD FL Zanesville PD OH Oakland Park PD FL Oklahoma City FAA OK Orlando PD FL Oklahoma City PD OK Sanford PD FL Bancroft PD ON Stuart PD FL Grand Sudbury PD ON Volusa County SO FL Ontario Prov. Police ON Americus PD GA Toronto PD ON Atlanta PD GA Ashland PD OR Dekalb County SO GA Bend PD OR Douglasville PD GA Eugene PD OR Eatonton PD GA Malheur County SO OR GA Portland PD OR Lithonia PD GA Borough of Kutztown PD PA Honolulu PD HI Bristol Township PD PA Lewiston PD ID New Hope PD PA Chicago PD 1L Stroudsburg PD PA Elrnhurst PD IL Tobyhanna Township PD PA Hinsdale PD IL Montreal PD QB Mills County SO lL Quebec City PD QC Angola PD IN Sioux Falls PD SD Crawford PD IN Sturgis PD SD Kansas City Police KS Arlington PD TX Cadiz PD KY Hardin County PD TX Barnstable PD MA Harris County SO enton PD MI Houston PD TX Prince George MD P?ugerville PD TX Jackson PD MI San Antonio PD TX Linden PD MI Summit County SO UT lemgst?ig County MI Alexandria PD VA 46 Case Document 2 Filed 02/25/20 Page 48 of 49 Page D# 49 Agency State/Prov Agency State/Prov Muskegon County SO M1 Chesapeake PD VA Oakland County SO MI Henrico SO VA Ottawa County SO Ml Norfolk PD VA Trenton PD MI Old Dominion Univ PD VA Villa 6 of Fruit ort Prince William Coun PD MI PD ty VA Zeeland Fire MI Seattle PD WA Grand Rapids PD MN Middleton PD WI St. Louis Metro PD MO Pleasant Prairie PD WI Codiac RCMP NB Marion County SO WV Boone Fire NC Laramie PD WY Charlotte? Mecklenburg NC Grand Island PD NE Conway PD NH 47 Case Document 2 Filed 02/25/20 Page 49 of 49 PagelD# 50 Sam 110. Based on the facts set forth above, I submit there is probable cause to believe that, JOHN CAMERON DENTON, did unlawfully, knowingly, and willfully, combine, conspire, confederate, and agree with persons known and unknown to commit an offense against the United States, that is, to transmit in interstate commerce communications containing threats to injury the person of another, and that DENTON or others did an act to effect the object of said conSpiracy, in violation of Title 18, United States Code, Section 875(0), all in violation of Title 18, United States Code Section 371. Jonaythati?Myle/s L?i?cf/ Special Agent Federal Bureau of Investigation 1 Sworn and subscribed to by telephone this day of February, 2020. {a QCEL, Isl Ivan D. Davis United States Magistrate Judge 48