Case 1:20-mj-02398-MBB *SEALED* Document 3 Filed 06/11/20 Page 1 of 1 $2 5HY &ULPLQDO &RPSODLQW 81,7(' 67$7(6 ',675,&7 &2857 IRU WKH District of Massachusetts BBBBBBBBBB 'LVWULFW RI BBBBBBBBBB 8QLWHG 6WDWHV RI $PHULFD Y -$0(6 %$8*+ DQG '$9,' +$59,//( &DVH 1R 0- 0%% Defendant(s) &5,0,1$/ &203/$,17 , WKH FRPSODLQDQW LQ WKLV FDVH VWDWH WKDW WKH IROORZLQJ LV WUXH WR WKH EHVW RI P\ NQRZOHGJH DQG EHOLHI 2Q RU DERXW WKH GDWH V RI 'LVWULFW RI $XJ WR 6HSW 0DVVDFKXVHWWV LQ WKH WKH GHIHQGDQW V YLRODWHG Code Section 8 6 & † 8 6 & † 0LGGOHVH[ LQ WKH FRXQW\ RI Offense Description &RQVSLUDF\ WR FRPPLW F\EHUVWDONLQJ LQ YLRODWLRQ RI 8 6 & † $ &RQVSLUDF\ WR FRPPLW ZLWQHVV WDPSHULQJ LQ YLRODWLRQ RI 8 6 & † E 7KLV FULPLQDO FRPSODLQW LV EDVHG RQ WKHVH IDFWV 6(( $77$&+(' $)),'$9,7 2) 63(&,$/ $*(17 0$5. :,/621 ✔ &RQWLQXHG RQ WKH DWWDFKHG VKHHW u Complainant’s signature )%, 63(&,$/ $*(17 0$5. :,/621 Printed name and title 6ZRUQ WR PH WHOHSKRQLFDOO\ 'DWH -XQH Judge’s signature &LW\ DQG VWDWH %522./,1( 0$66$&+86(776 +21 0$5,$11( % %2:/(5 8 6 0 - Printed name and title Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 1 of 51 AFFIDAVIT I, Mark Wilson, state: INTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application for a criminal complaint charging -DPHV Baugh (“BAUGH”) and David Harville (“HARVILLE”) with violations of federal criminal law, namely, conspiracy to commit cyberstalking, contrary to 18 U.S.C. § 2261A, and conspiracy to tamper with a witness, contrary to 18 U.S.C. § 1512(b)(3), e ach in violation of 18 U.S.C. § 371 (together, “the Target Offenses”), and for warrants to arrest BAUGH and HARVILLE. 2. I have been a Special Agent with the Federal Bureau of Investigation (“FBI”) since approximately January 2019. Before becoming a Special Agent, I worked for five years as a Staff Operations Specialist in the FBI’s Cleveland Division, providing analytic support for criminal and national security cyber investigations. I was also a member of the FBI’s Child Abduction Rapid Deployment Team, which investigates child abductions nationwide by providing cyber analysis. I was also assigned to the Cleveland Police Department’s Homicide Unit Task Force, where I implemented internet and technical analysis to investigate homicide cases. Beyond my work experience, I have also received twenty-one weeks’ formal training in investigative techniques at the FBI Academy in Quantico, Virginia. 3. I am currently assigned to the FBI Boston Division’s Cyber Crimes Squad. I am responsible for investigations involving computer system intrusions, internet fraud, and cyberstalking. Based on my training and experience, I am familiar with the means by which individuals use computers and information networks to commit these and other crimes. I am a 1 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 2 of 51 law enforcement officer of the United States within the meaning of 18 U.S.C. § 2510(7), and I am accordingly empowered by law to conduct investigations and to make arrests for federal felony offenses. 4. Based on my training and experience and the facts set forth in this affidavit, there is probable cause to believe that BAUGH, HARVILLE, Stephanie Popp, Brian Gilbert, Stephanie Stockwell, Veronica Zea, and other persons known and unknown (“the Target Subjects”) have committed the Target Offenses. 5. The facts in this affidavit come from my observations and review of records, my training and experience, information obtained from other law enforcement personnel, and information obtained through legal process, court orders, interviews, and search warrants. This affidavit is intended to show merely that there is sufficient probable cause for the requested complaint and does not set forth all of my knowledge about this matter. Statements attributed to individuals, unless otherwise indicated, are in substance and in part. THE STATUTES 6. Title 18, United States Code, Section 2261A, the federal cyberstalking statute, provides in pertinent part: Whoever—… (2) with the intent to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person, uses the mail, any interactive computer service or electronic communication service or electronic communication system of interstate commerce, or any other facility of interstate or foreign commerce to engage in a course of conduct that— (A) places that person in reasonable fear of the death of or serious bodily injury to [that] person, [an immediate family member of that person; or a spouse or intimate partner of that person]; or 2 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 3 of 51 (B) causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress to [that person; an immediate family member of that person; or a spouse or intimate partner of that person] commits a felony punishable by five years in prison and a $250,000 fine. 18 U.S.C. § 2261(b)(5). 7. Title 18, United States Code, Section 1512(b)(3), part of the federal witness tampering statute, provides in pertinent part: (b) Whoever knowingly uses intimidation, threatens, or corruptly persuades another person, or attempts to do so, or engages in misleading conduct toward another person, with intent to— (3) hinder, delay, or prevent the communication to a law enforcement officer or judge of the United States of information relating to the commission or possible commission of a Federal offense … commits a felony punishable by twenty years in prison and a $250,000 fine. 8. Under Title 18, United States Code, Section 371, if two or more persons conspire to commit any offense against the United States, including the two above, and one or more of such persons do any act to effect the object of the conspiracy, each commits a felony punishable by five years in prison and a $250,000 fine. PROBABLE CAUSE At all times relevant to this affidavit: 9. Victim 1 lived in Natick, Massachusetts. Victim 1 was a reporter and editor of an online newsletter (“the Newsletter”) that covered ecommerce companies, including eBay ,QF. Victim 1 used a Twitter account in the Newsletter’s name to promote her reporting. 10. Victim 2 lived in Natick and was married to Victim 1. He was the publisher of the Newsletter. 3 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 4 of 51 11. The investigation described below has revealed that in or about August 2019, BAUGH, HARVILLE, and the rest of the Target Subjects—all of whom were then officers, employees or contractors of eBay—engaged in an extensive harassment campaign that targeted and terrified Victims 1 and 2, causing them substantial emotional distress. The campaign included: sending anonymous, threatening communications to the Victims; ordering unwanted and disturbing deliveries to their home, including funeral wreaths and books on surviving the loss of a spouse; and BAUGH, HARVILLE, Zea, and Popp travelling to Natick to surveil the Victims at their home and in their community. 12. After the Victims spotted one of the surveillance teams, the Natick Police Department (“NPD”) investigated, connected HARVILLE and Zea to eBay, and reached out to eBay for assistance. 13. When BAUGH, HARVILLE, Gilbert, Popp, Stockwell, Zea, and others learned that the NPD was making inquiries, they interfered with the investigation, either lying to the NPD about eBay’s involvement while pretending to offer the company’s assistance with the harassment, lying to eBay’s lawyers about their own involvement, or both. As the NPD and eBay’s lawyers began to close in on the truth, the Target Subjects deleted evidence that showed their involvement, further obstructing what had by then become a federal investigation. eBay 14. According to Fortune magazine’s most recent online listing, eBay’s “multinational e-commerce platforms allow[] consumer-to-consumer and business-to-consumer transactions.” Founded in 1995 and headquartered in San Jose, California, eBay ranked 295th in the 2019 Fortune 500 with more than $10 billion in revenue and just over 13,000 employees 4 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 5 of 51 worldwide. 15. In August 2019, according to written records obtained from eBay and witnesses interviewed in connection with the investigation: a. Executive 1 and Executive 2 were members of eBay’s executive leadership team. b. BAUGH was eBay’s Senior Director of Safety & Security. He ran eBay’s Global Security and Resiliency (“GSR”) business, a company division responsible for, in general terms, the physical security of eBay’s employees and facilities worldwide. c. HARVILLE, who reported directly to BAUGH, was eBay’s Director of Global Resiliency, a unit focused on ensuring that eBay could continue to operate worldwide after business disruptions, such as security threats, political unrest, or natural disasters. BAUGH recruited HARVILLE to eBay from a security consulting firm where the two had worked together. d. Popp, a Target Subject who is separately charged in the District of Massachusetts with committing both of the Target Offenses, was eBay’s Senior Manager of Global Intelligence. She served as BAUGH’s de facto chief of staff. Before May 2019, Popp managed eBay’s Global Intelligence Center (“GIC”), an intelligence and analytics group within the GSR business that supported eBay’s security operations. e. Stockwell, a Target Subject who is separately charged in the District of Massachusetts with committing both of the Target Offenses, was an intelligence analyst in the GIC who later became its manager when eBay reassigned Popp to work directly with BAUGH. f. Zea, a Target Subject who is separately charged in the District of 5 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 6 of 51 Massachusetts with committing both of the Target Offenses, was an eBay contractor who worked as an intelligence analyst in the GIC. g. Gilbert, a Target Subject who is separately charged in the District of Massachusetts with committing both of the Target Offenses, was a Senior Manager of Special Operations for eBay’s Global Security Team. A former police captain in Santa Clara, California, Gilbert was responsible for, among other things, executive protection, special events security, and safety at eBay’s North American offices. h. Supervisor 1 was a GSR employee responsible for, among other things, safety and security at eBay’s offices outside of North America. i. Analyst 1, Analyst 2, and Analyst 3 worked in the GIC. The Newsletter 16. Based on my review of the Newsletter’s internet website, www.[Newsletter].com, the Newsletter devotes its coverage to online marketplaces, including eBay, Amazon, and Craigslist, among others. Victim 1 has focused much of her reporting on issues of interest to “sellers” (i.e., people who sell merchandise online). Examples of articles include “What is Behind Amazon Prime Shipping Delays?” and “Craigslist FINALLY Launches a Mobile App: Worth the Wait?” 17. Based on my review of text messages and emails provided by eBay and otherwise obtained during the course of the investigation, eBay executives, including Executives 1 and 2, followed the Newsletter with interest, often taking issue with the content of Victim 1’s coverage of eBay. 18. On April 10, 2019, for example, Executive 2 texted Executive 1, “We are going to 6 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 7 of 51 crush this lady,” sending along a link to the Newsletter’s coverage that day of Executive 1’s compensation. 19. On April 20, 2019, discussing the Wall Street Journal’s coverage of Executive 1, Executive 1 texted to Executive 2, “FXFN them. The journal is next on the list after [Victim 1].” 20. On May 31, 2019, commenting on the Newsletter’s coverage of eBay that day, Executive 2 texted to Executive 1, “Shockingly reasonable...” Executive 1 replied, “I couldn’t care less what she says.” Seconds later, Executive 1 added, “Take her down.” 21. In or about June 2019, eBay (at Executive 2’s direction) retained a consultancy that prepared a document entitled “Next Steps: Alternative Digital Methods for Reducing Impact of [Victim 1] and [Victim 2] and [Newsletter].” The document included the recommendation, among others, that eBay promote company-friendly content that would drive the Newsletter’s posts lower in search engine results.1 The Parody Account 22. Like many news outlets, the Newsletter offered its readers the opportunity to comment underneath Victim 1’s stories. The anonymous comments were sometimes critical of eBay and its executive leadership team. At other times, the comments amounted to namecalling. For example, a May 2015 comment called eBay executives “liars” and “thugs” who should be jailed; a May 2017 comment called Executive 1 the devil; and an April 2018 comment stated that Executive 1 was “delusional.” 1 Documents do not indicate that the strategies were executed. 7 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 8 of 51 23. One commenter in particular, who went by the online nicknames “FidoMaster,” “FidoMaster1,” “Dan Davis,” or “UnsuckeBay” (collectively, “the Parody Account”)— expressed frequent and negative opinions regarding eBay. 2 In addition to commenting below the Newsletter’s articles, the anonymous author(s) of the Parody Account sometimes posted opinions critical of eBay in Twitter feeds, impersonated official eBay communications using a distorted version of the company’s logo, or sent messages that one eBay seller considered to be harassing. 24. On May 21, 2019, for example, the Newsletter reported that eBay had built on its campus an expensive replica of Walker’s—a popular Manhattan bar—noting, “It’s probably news to sellers (and shareholders?) that eBay has a pub-like lounge on campus – especially one built with what appears to be no-expenses spared.” FidoMaster1 tweeted a link to the article, noting “@[Newsletter] posted about @eBay’s beleagured [Executive 1’s] self-indulgent vanity project ‘Walker's West’ campus bar.” The tweet continued, “The bar, [Executive 1’s] recreation of iconic @WalkersBarNYC is a throwback to internet and gaming company CEO’s lavish overspending on ‘legacy’ facilities and landmarks.” FidoMaster1 also criticized Executive 1 for undertaking the project while eBay was experiencing “cost reduction, layoffs, and scrutiny by activist investors.” 25. In March 2019, in response to a request from Executive 2, the GIC prepared a report for BAUGH summarizing the Parody Account’s discussions of eBay over the last year. The report noted that FidoMaster1/Dan Davis was an “anonymous [T]witter user that posts negative content about eBay and its senior leadership.” Regarding Fidomaster1/Dan Davis’ 2 It appears that these account handles/nicknames were commonly controlled, but it is possible that more than one individual used them. 8 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 9 of 51 relationship with the Newsletter, the report noted “the owner of this account corresponds regularly with [the Newsletter] editor [Victim 1] about issues pertaining to eBay. [Victim 1] and [the Newsletter] are known for publishing negative content about eBay and its executives.” May to July 2019 – the Lead Up to the Harassment Campaign 26. In either April or May 2019, according to CW-1, CW-2, and CW-33, BAUGH summoned Popp, Stockwell, Analyst 1, and Zea to an eBay conference room. BAUGH stated that the GIC would be writing an anonymous, threatening letter to Victim 1 to get her to stop publishing articles critical of eBay. The letter, which was to be handwritten and sent from Austin, Texas so that it could not be connected to eBay, was never sent. 27. On or about June 8, 2019, Gilbert scribbled the word “Fidomaster” on the fence in front of the Victims’ home. 4 28. In or about July 2019, according to CW-3, BAUGH directed Stockwell and later 3 N None hhas any criminal history that would bear on credibility, and each has provided facts generally corroborated by the other records, documents, and interviews conducted in the investigation to date and reflected elsewhere in this affidavit. I accordingly believe each individual’s information to be reliable. 4 Gilbert had flown to Boston using tickets that CW-2 purchased for him with CW-2’s credit card. Gilbert rented a black Ford Explorer similar to one that appears in surveillance video from the Victims’ home security system that day. In the video, the driver of the Explorer approaches the Victims’ fence before returning to the SUV. 9 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 10 of 51 Zea to monitor Victim 1’s Newsletter posts, screenshot them, and forward them by WhatsApp 5 on a real-time basis, day or night, any day of the week. 29. In July and early August 2019, as described below, members of eBay’s executive leadership team and others increased pressure on BAUGH to address both the Newsletter and the Parody Account. 30. On July 10, 2019, Executive 1 received and shared with BAUGH and others an email complaint from an eBay seller that the Parody Account @unsuckeBay was harassing the seller on Twitter and answering customers’ questions that had been posted to an official eBay Twitter account. The seller asked for Executive 1’s help in addressing the problem. 31. On or about July 18, 2019, Executive 1’s spouse texted BAUGH privately about a comment underneath a Newsletter article that called Executive 1 a “con artist and thief.” The spouse wrote: “I’m not exactly thrilled with this post on my favorite [Newsletter]. The author gets people worked up with the way she skews her stories. Don’t tell [Executive 1] I sent this I’m just letting you know about it. Ok?” 32. In mid-July 2019, according to CW-1, BAUGH tasked the GIC with identifying the author of the Parody Account. BAUGH stated that identifying Fidomaster was a top priority coming from eBay’s executive leadership, including Executive 1 and Executive 2. In an email to BAUGH and Zea, Stockwell laid out several theories, including that the author of the Parody Account might have “made contact with or know” Victim 1. 33. BAUGH directed the GIC to find evidence that the Victims and the Parody 5 WhatsApp is an encrypted messaging and internet telephony application owned by Facebook. 10 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 11 of 51 Account were collaborating to publish negative content about eBay, including by using a fake social media account to attempt to trick Fidomaster into admitting a connection with Victim 1. The GIC never found such evidence. According to CW-1, however, BAUGH remained convinced that Victim 2, or possibly Victim 1, was Fidomaster. 34. On August 1, 2019, the New York Times published an article reporting that eBay had accused Amazon in a lawsuit of unlawfully poaching eBay sellers to Amazon’s online marketplace. 35. That day, at approximately 1:46 p.m., Victim 1 posted an article on the Newsletter under the headline “eBay RICO Lawsuit Meant to Curb Seller Exodus to Amazon?” Victim 1’s article reported on both Executive 1 and eBay’s lawsuit: “[Executive 1] has been unable to stop a decline in market sales, but trying to dissuade sellers from turning to Amazon (and trying to get Amazon to stop recruiting sellers) may not be the best tactic.” 36. Just half an hour later, at 2:19 p.m., Executive 1 texted Executive 2: “[Victim 1] is out with a hot piece on the litigation. If you are ever going to take her down..now is the time.” 37. Executive 2 responded shortly afterward by text message: “On it.” 38. As set forth below, a series of text messages followed between Executive 2 and BAUGH, beginning with Executive 1’s suggestion to Executive 2 that “we … take her down”: 11 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 12 of 51 BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB >(;(&87,9( V ,1,7,$/6 $1' ),567 1$0(@ 9,&7,0 >(;(&87,9( V BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB ,1,7,$/6@ 39. Executive 2 and BAUGH’s August 1, 2019 conversation continued by text, with Executive 2 committing to “embrace managing any bad fall out.” August 2019 – Planning and Executing the Harassment Campaign 40. According to CW-1, CW-2, and CW-3, BAUGH convened several meetings that included one or more of the following: HARVILLE, Gilbert, Popp, Stockwell, Zea, Supervisor 1, and Analysts 1, 2, and 3, among others. Harassing and Threatening Deliveries 41. In the first of these meetings, BAUGH directed Popp, Stockwell, Zea, and 12 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 13 of 51 Analysts 1, 2, and 3 to anonymously harass Victims 1 and 2, with the goal of distracting Victim 1 and making her uncomfortable to the point where Victim 1 would stop writing negative articles about eBay. BAUGH called the harassment a “distraction campaign” and suggested that scary masks, live insects, or embarrassing items, such as pornography and strippers, be sent to the Victims (and in some cases to their neighbors in the Victims’ names). 42. According to CW-2, BAUGH showed a clip from the 1988 movie Johnny Be Good, in which two friends arranged for the delivery, to their football coach’s home, of a series of unwanted and distracting items and people, including $283 in pizzas, an elephant, a male stripper, an exterminator, and Hare Krishna missionaries. BAUGH stated he wanted something similar to happen to the Victims and tasked the GIC’s members with brainstorming other things that could be delivered to the Victims’ home. 43. BAUGH also directed that the deliveries not be traceable to eBay. At his direction, Zea and other GIC analysts paid for the deliveries using prepaid debit cards, and made online orders using anonymous email accounts, virtual private networks, 6 and cell phones and computers specifically purchased for the harassment campaign. 44. In these meetings, BAUGH referred to having executive support for these actions and shared with one or more members of the group text messages that BAUGH claimed to have received from executive management, including ones similar to the ones between BAUGH and Executive 2 described above. 6 I am aware based on my training and experience as a cybercrime investigator that virtual private networks are leased Internet Protocol (“IP”) addresses that would obfuscate the source of the harassment. 13 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 14 of 51 45. BAUGH nevertheless stressed that the harassment campaign must remain confidential. In one of these meetings, BAUGH displayed a photograph of what he said were members of a Samoan gang. BAUGH said, in substance, that if the distraction campaign didn’t work, he would send the gang to the Victims’ home, that they were not “good guys,” and that whatever happened would be out of BAUGH’s control. Threatening Messages 46. According to CW-2, in a separate meeting during the week of August 5, BAUGH gathered Popp, Gilbert, and Supervisor 1 to plan another way to harass the Victims. Specifically, Baugh, Popp, Gilbert, and Supervisor 1 planned to send a series of anonymous tweets and Twitter direct messages. 7 According to CW-2, the purpose of the anonymous messages was to create the impression that there were eBay sellers who disapproved of the Newsletter and its content. BAUGH, Gilbert, Popp, and Supervisor 1 discussed that the messages would gradually get more aggressive, culminating in the publication of the Victims’ home address in Natick. Popp selected @Tui_Elei for the Twitter account’s handle (“the Tui_Elei Account”) and used a picture of a skull that BAUGH approved for the account profile to further intimidate the Victims. 48. By design, according to CW-2 and others interviewed in connection with the investigation, these threatening messages would allow eBay—through Gilbert and another GSR employee—to approach the Victims in Natick with an offer of assistance to investigate and stop the threatening messages, thereby earning the Victims’ trust, creating good will toward eBay, 7 Twitter posts, or “tweets,” are generally publicly displayed. Twitter “direct messages” are sent from one Twitter account to another and are generally not public. 14 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 15 of 51 and getting the Victims’ cooperation in identifying the author of the Parody Account. (This will be referred to in this affidavit as “the White Knight Strategy”). 49. BAUGH told Popp, Gilbert, and Supervisor 1 that eBay’s leadership supported these efforts. He later forwarded them the email below from Executive 2 in which Executive 2 complained about “Fidomaster” and “the [Newsletter] gal,” and suggested that eBay should do “Whatever. It. Takes” to address them: 1(:6/(77(5 50. At or around the end of that week, BAUGH showed the Leonardo DiCaprio movie, Body of Lies, to Zea. In the movie, DiCaprio’s character creates a fake terrorist plot that is intended to trick and draw an actual terrorist out of hiding. BAUGH stated that this was his current thinking regarding the Victims, which I believe was a reference to the White Knight Strategy (i.e., tricking the Victims into helping eBay by creating and then eliminating the harassment campaign). Surveillance Campaign 51. In a third set of planning meetings in early August 2019, BAUGH recruited HARVILLE and Zea to travel to Boston to physically surveil Victims 1 and 2 at their home and in their community. The purported purpose of the trip, according to CW-2 and CW-3, was to 15 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 16 of 51 find evidence that the Victims and the author of the Parody Account were collaborating to publish negative content about eBay, presumably for the purpose of discrediting both. 52. On August 11, 2019, at approximately 3:15 p.m. (PT), BAUGH messaged HARVILLE: “you and I need to fly to east coast for op. I’ll book travel arrangements off the grid.” HARVILLE replied, “copy.” 53. BAUGH instructed HARVILLE not to tell an eBay coworker that “you are going anywhere.” HARVILLE messaged: “No one knows shit,” and BAUGH replied, “You need to lie to [HARVILLE’s wife] too.” 54. BAUGH then messaged that he would be sending a screenshot to HARVILLE: “Once you read it delete this entire thread and DONT SAVE TO YOUR PHONE or we will all get fired.” 55. The following messages came next, including a copy of an earlier message that BAUGH had exchanged with Executive 2 about “neutralizing [Victim 1’s] website” and Executive 2’s response that he wanted to “see ashes”: 16 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 17 of 51 BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB >9,&7,0 V ),567 1$0(@ 56. From BAUGH’s use of a message featuring Victim 1’s name, I believe BAUGH was referring to Victim 1 as one of the “2 targets.” 57. BAUGH next sent screenshots of several July 2019 emails regarding the executive leadership team’s concerns about UnsuckeBay (i.e., the Parody Account). HARVILLE replied, “Holy crap!” 58. BAUGH then forwarded to HARVILLE a screenshot of Executive 2’s August 6, 2019 email to BAUGH and others (described above in paragraph 49), complaining about both the Parody Account’s author and Victim 1 (“the [Newsletter] gal”) and stating “I genuinely believe these people are acting out of malice and ANYTHING we can do to solve it should be explored.” 59. After sharing these screenshots, BAUGH messaged HARVILLE at 3:32 p.m.: 17 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 18 of 51 60. HARVILLE’s reply message at 3:33 p.m.: 61. Interviews with CW-1, CW-2, and CW-3 and records obtained from Apple show that BAUGH, HARVILLE, and others obtained and tested a GPS device to install on the Victims’ car in aid of the surveillance campaign. BAUGH practiced installing the device on a car in eBay’s parking lot that matched the make and model that the Victims drove. 62. On or about August 14, 2019, according to CW-2 and CW-3, BAUGH held a meeting that included HARVILLE, Popp, Gilbert, and Zea. During the meeting, BAUGH displayed a map of Natick on the wall and discussed surveillance planning. Gilbert advised the group that the harassing deliveries, which were still underway to the Victims’ home, would put the Victims on alert, could result in the Victims paying closer attention to who was approaching their home, and potentially compromise the surveillance team. BAUGH directed Zea to try to stop the package deliveries. 63. According to CW-3, on August 14, 2019, BAUGH directed Zea to go to a Target store to purchase permanent markers that could be used to write on the Victims’ fence. Zea purchased these markers at approximately 8:10 p.m. that day (as reflected in a Target receipt obtained by the FBI from eBay). 18 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 19 of 51 64. BAUGH, HARVILLE, and Zea also invented several false reasons for their trip. According to CW-2 and CW-3, these included HARVILLE and Zea’s registration for a software development conference in Boston that happened to be occurring that week. 8 65. On or about August 15, 2019, BAUGH also directed Stockwell and Zea to create a document that featured Victims 1 and 2 as eBay “Persons of Interest” (or “POIs”). While I am aware from CW-1, CW-2, and CW-3 that the GIC did track as POIs customers and sellers who threatened violence, this document falsely suggested that Victims 1 and 2 were the authors of the Parody Account, and that Victims 1 and 2 had disparaged and threatened eBay executives, including Executive 1. If police detected their surveillance and pulled them over, according to CW-2 and CW-3, BAUGH and HARVILLE could use the documents to justify, falsely, why they and Zea were in Boston—to investigate two people who had supposedly threatened eBay and its executive personnel. The Target Subjects’ Harassment Campaign 66. Beginning on August 7, 2019, as described below, the Victims began to experience what BAUGH had directed: a stream of harassing, embarrassing, and disturbing deliveries. Victim 1 similarly began to receive a torrent of tweets and direct messages directed by BAUGH, drafted by Popp, and approved by Gilbert and Supervisor 1, in furtherance of the White Knight Strategy. 67. That day, Victim 1 received a Twitter private message from an account with a 8 Records obtained from eBay and Red Hat, the sponsor of the conference, indicate that HARVILLE and Zea attempted to register for the DevConf conference on or about August 14, 2019, but also that none of the three ever attended the conference or claimed a spot off the waiting list when it was offered to them. 19 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 20 of 51 username and display name that she did not recognize, the Tui_Elei Account. The private message asked her what her problem was with eBay. 68. When Victim 1 did not respond, the private messages from the Tui_Elei Account escalated, asking “HELLO!!!!!!”; “WTF … r u there??”; “im waiting… i don’t like waiting”; “WTF whats it goin to take for u to answer me??”; and “I guess im goin to have to get ur attention another way bitch…” 69. When Victim 1 continued not to respond, more private messages followed that included explicit language: “U dont have the balls to talk to me?? Stop hiding behind ur computer screen u fuckin cunt!!!” 70. On or about August 8, 2019, at approximately 11:00 p.m. (ET), Victim 1’s email inbox was flooded over the course of an hour with dozens of emails and newsletters that she had not signed up for (for example, emails with the subjects “the Communist Party”; “the Satanic Temple”; and “Cat Faeries”). 71. On or about August 10, 2019, Victims 1 and 2 began to receive a series of home deliveries that they had not ordered. The content of messages that followed from the Tui_Elei Account caused Victims 1 and 2 to believe the person controlling the Tui_Elei Account had sent (or at least knew of) these deliveries. 72. For example, on August 10, 2019, Victim 2 received an email reporting that a “Preserved Fetal Pig” had been ordered online to be sent to the Victims’ house. 73. At approximately 4:00 p.m. that day, an Amazon.com package addressed to Victim 1 was delivered to the Victims’ home. The package contained a Halloween mask featuring a bloody pig face: 20 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 21 of 51 . 74. At 4:14 p.m., Victim 1 received a message from the Tui_Elei Account asking “DO I HAVE UR ATTENTION NOW????” 75. On August 11, 2019, Victim 1 received a series of private messages from the Tui_Elei Account. The first message stated: “Ur fat fuck pussy husband [Victim 2] needs to put u in line cunt.” The next message stated: “after he takes the plugs out of his asshole…fuckin pussies!!!” and “U are sick motha fuckers..and every one will kno! U fuckin cunt ass bitch!!” 76. On August 12, 2019, Victim 2 received from Amazon the death-themed book pictured below entitled “Grief Diaries: Surviving the Loss of a Spouse”: 21 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 22 of 51 77. The Tui_Elei Account continued messaging Victim 1 that day, asking her what her problem was with eBay. 78. On August 13, 2019, Victim 2 received a voicemail message in response to his purported interest in opening an Adam & Eve sex toys franchise. (Victims 1 and 2 reported to the NPD that Victim 2 had not expressed such interest). 79. The Tui_Elei Account continued to tweet at Victim 1 on August 13, 2019, writing “R U THERE???”, “y wont u answr me???”, and “many familys includin mine make money 2 pay 4 food cloths and rent by selling on ebay… UR stupid idiot comments r pushin buyers away from ebay and hurtin familys!! STOP IT NOW!! #ebay #ebayseller.” 80. On August 14, 2019, Victims 1 and 2 received a package from Carolina Biological Supply in Burlington, North Carolina that, according to the company, contained fly larvae and live spiders. 81. On August 14, 2019, Victims 1 and 2 also received a box of cockroaches sent from Dubia Roaches of Wichita, Kansas. 82. That day, the Tui_Elei Account tweeted “[Victim 1] wen u hurt our bizness u hurt our familys… Ppl will do ANYTHING 2 protect family!!!!” 83. In response to these deliveries and messages, Victims 1 and 2 added a security camera to their house, and the NPD—to whom the Victims had reported many of these incidents—committed to conduct extra checks near the Victims’ house in the future. 84. On August 15, 2019, pornography entitled “Hustler: Barely Legal” arrived at the homes of two of the Victims’ neighbors; the packages had Victim 2’s name on them. The contents of one of the packages is pictured below: 22 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 23 of 51 85. On August 15, 2019, a Cambridge, Massachusetts florist delivered a “sympathy” wreath to the Victims’ home, another death-themed delivery. When an NPD officer called the florist, the florist stated that the person who had ordered the wreath tried unsuccessfully to cancel the order before completing the transaction. (This information is consistent with BAUGH’s instruction to Zea on August 14 that Zea should cancel outstanding deliveries in anticipation of the surveillance campaign). Surveillance Begins and the Harassment Continues 9 86. On August 15, 2019, BAUGH and Zea flew to Boston. HARVILLE also flew to Boston, separately, the same day. 87. Once in Boston, Zea rented a black Dodge Caravan, and HARVILLE rented a blue Subaru Forester, both from Enterprise Rent-a-Car. BAUGH, HARVILLE, and Zea checked into Boston’s Ritz Carlton hotel. 88. At approximately 8:30 p.m., according to records obtained from Apple, Stockwell 9 First-hand observations of events taking place in Boston were reported to me by CW-2, CW-3, or both. 23 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 24 of 51 sent a WhatsApp message to HARVILLE providing the make, model, and license plates of the Victims’ family cars, including their Toyota Rav4. 89. On August 15, 2019, at 11:30 p.m., the day BAUGH, HARVILLE, and Zea had arrived in Boston, the three drove the Dodge Caravan to Natick, where BAUGH and HARVILLE approached the Victims’ home on foot with the intention of installing the GPS device on the Victims’ car. Zea and Popp, who joined the surveillance by conference call from San Jose, monitored the NPD dispatch over the internet to be able to warn of police presence. (Records obtained from Apple show that one of HARVILLE’s iPhones was used that morning to visit the website “Natick Police and Fire Live Audio Feed” at m.broadcastify.com). Although BAUGH and HARVILLE approached the Victims’ home, they did not install the GPS that night because the Toyota Rav4 was locked in the Victims’ garage. 90. Upon returning to the hotel, BAUGH, HARVILLE, and Zea ordered room service. HARVILLE discussed breaking into the Victims’ garage (using tape and either a paint scraper or putty knife) in order to install the GPS tracker. 91. The next day, Friday, August 16, 2019, at 3:48 p.m., according to records obtained from a Boston-area hardware store and Apple, HARVILLE purchased: (1) a slotted screwdriver; (2) a 6-in-1 painters’ tool; (3) a two-ended catspaw/pry bar; and (4) nitrile (rubber) gloves. I believe based on my training and experience that these were the tools that HARVILLE intended to use to break into the Victims’ garage. 92. On the afternoon of Friday, August 16, 2019, HARVILLE, BAUGH, and Zea returned to Natick to continue the surveillance. HARVILLE drove separately in the Subaru 24 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 25 of 51 Forester.10 93. On that same afternoon, one or both of the Victims drove by the Dodge Caravan. BAUGH started to follow the Victims. Monitoring the NPD dispatch, Zea heard the dispatcher call in the fact that the Victims were being followed. Zea and HARVILLE went back to the Ritz Carlton in the Subaru while BAUGH returned the Dodge Caravan to Enterprise. 94. As Zea heard, Victims 1 and 2 reported to the NPD that a dark-colored minivan with New York plates had circled their neighborhood and followed Victim 2. But the license plate the Victims reported was off by one letter, so the NPD was not able to identify the surveillance team’s Dodge Caravan. 95. On the evening of August 16, 2019, BAUGH, HARVILLE, and Zea ate and drank at Boston’s Oceannaire Restaurant. (A receipt from the restaurant shows an approximately $750 tab closed out at 10:41 p.m.). During the meal, BAUGH discussed with HARVILLE and Zea that they would need to start “spamming” the Victims again. HARVILLE proposed delivering chainsaws and human feces to the Victims; BAUGH suggested a dead rat. 96. That evening, BAUGH asked Stockwell to send an emergency plumber to the Victims’ home. (Internet records from Stockwell’s eBay-issued iPhone show that it was used to look up a Boston-area emergency drain repair service on August 17, 2019 at 3:08 a.m. (ET)). Later on August 17, Stockwell also visited the website https://shamrockentertainment.net/featured-dancers (“New England’s Finest Female & Male 10 Records obtained from Apple show a saved photograph of the Victims’ home on one of HARVILLE’s iPhones at approximately 5:30 p.m. (ET) that day. 25 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 26 of 51 Exotic Dancers For Any Occasion from Mild to Wild”). 97. On Saturday, August 17, 2019, according to airline records, HARVILLE flew back to California, and Popp flew to Boston. 98. On Sunday, August 18, 2019, BAUGH, Zea, and Popp returned to Natick to conduct more surveillance in a GMC SUV that Zea rented. BAUGH again followed Victim 2 as he drove the Toyota Rav4 around Natick, but BAUGH abandoned the surveillance when he saw Victim 2 taking pictures of the GMC. Victim 2 reported to the NPD that he had been followed by a silver or gray GMC and had taken a photograph of its license plate. 99. On Tuesday, August 20, 2019, BAUGH, Popp, and Zea returned to Natick for a fourth surveillance. They abandoned it when they saw a Jeep with tinted windows parked in front of the Victims’ home. The three feared, correctly, that the NPD had sent an undercover officer there. 100. Meanwhile, as BAUGH had suggested at the Oceannaire Restaurant, the harassment campaign had resumed. On August 17, 2019, the NPD responded to the Victims’ house at 4:30 a.m. because a pizza delivery person had shown up from Boston seeking payment for $70.00 worth of pizza that Victims 1 and 2 had not ordered. 101. Later the next night, at approximately 11:30 p.m., a second pizza delivery arrived. According to Victim 1, the telephone number used to place the order was (470) 472-9158, the same number that had been used to place the “sympathy” wreath order with the florist. 102. On August 18, 2019, at 12:58 a.m. (ET), Craigslist records reveal that the following classified advertisement was posted on the company’s website featuring the Victims’ home address: 26 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 27 of 51 103. Later that day, at 1:53 p.m. (ET), the Tui_Elei Account publicly posted Victim 1’s full name and the address of the Victims’ house, asking “Dis UR address???” I am aware based on my training and experience and my conversations with other agents involved in cyberstalking investigations that the public posting of a victim’s home address or other personally identifiable information is known as “doxing,” and that doxing is a typical method of online intimidation and harassment. 104. Three minutes later, at 1:56 p.m., the Tui_Elei Account delivered a private message to Victim 1 asking “U get my gifts cunt!!??,” confirming in Victim 1’s mind that the same person was both threatening her and sending the unwanted deliveries. 105. Two minutes later, at 1:58 p.m., Craigslist records show the posting of an “Everything must go!” estate sale featuring the Victims’ address. 106. A short time later, at 3:07 p.m., Craigslist records reveal another post featuring the Victims’ home address: 27 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 28 of 51 107. In response to the doxing, either Victim 1, the NPD, or other Twitter users who know Victim 1 asked Twitter to take down the doxing posts and to suspend the Tui_Elei Account. 108. On August 20, 2019, NPD officers responded to the Victims’ house yet again. They learned from Victims 1 and 2 that people had been arriving at the Victims’ home looking for a yard sale listed on yardsalesearch.com. The advertisement on the website reported a weeklong tag sale and stated, “We are moving out of the country soon, and are trying to get rid of as many of our possessions as possible. … If we are not outside, feel free to knock on the door. Maybe we can make a deal if you see something you like.” 109. On August 20, 2019, more pornography was delivered to a third neighbor (addressed in Victim 2’s name). Threatening Messages Resume 110. On August 21, 2019, NPD officers responded to the Victims’ house again. They learned from Victims 1 and 2 that other Twitter accounts were now posting harassing messages. 111. First, on August 21, 2019, a Twitter account with the username @Elei_Tui (“the Elei_Tui Account”), only slightly different than the Tui_Elei Account, was used to post “Nice try [Victim 1]… U cant shut me down!!!” 28 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 29 of 51 112. Two other Twitter accounts also responded to the Elei_Tui Account’s August 21, 2019 harassment: a. A user named @[xxxxxxxx] (“the Mask Account”) 11 wrote, “I agree! [Victim 1] is hurting small businesses with all the negativity and pushing buyers to Amazon!” This account featured an icon of an individual pointing a finger and wearing a sinister mask: 0$6. $&&2817 b. Another account, @TopSeller13 (“the TopSeller13 Account”), also responded, stating: “[Victim 1] focuz on sumthin else and stop fuckin with our customers!!! I dunt wanna c unuther fuckin post bout #ebay… Leave our bizness alone!!!!!! @Elei_Tui.” Like the Mask Account, the TopSeller13 Account featured a menacing photograph, this one with a disturbing image of a pig: 11 The investigation reveals that there is an active eBay seller who shares the first and last name featured in the Mask Account. It is deleted here to avoid any suggestion that this eBay seller was the author of the threatening Tweets. The author was Popp, as described below. 29 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 30 of 51 c. The TopSeller13 Account went on to threaten Victim 1 directly: “WTF!!??? Hey, @Elei_Tui wats [Victim 1] adress again?? guest i hav to pay her a visit…” In response, the Elei_Tui Account posted Victim 1’s home address, just as the Tui_Elei Account had days before. 113. As described below, records obtained from Apple reveal that BAUGH, Popp, Gilbert, and Supervisor 1 agreed to have Popp direct these tweets at the Victims, in part to execute the White Knight Strategy, and in part to mislead the NPD, which had just connected the GMC that was surveilling Victim 2 to Zea. 114. Victims 1 and 2 have reported to law enforcement that the harassment caused them distress during and after the harassment campaign. Both complained of lost sleep, physical symptoms of anxiety, concern about what would happen to them next, and when in public, a fear that they were being followed. Obstruction and Witness Tampering 115. As noted above, CW-2 and CW-3 have reported that BAUGH, HARVILLE, Popp, and Zea were aware that the Victims had spotted their surveillance on August 16 and/or August 18, which is consistent with the quick return to Enterprise Rent-a-Car of both the Dodge 30 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 31 of 51 Caravan and GMC SUV on those dates. 116. Records obtained from Apple reveal that BAUGH, Popp, Gilbert, Stockwell, and Supervisor 1 also began to attempt to obstruct the NPD’s investigation as early as Tuesday, August 20, 2019. 117. On that date, Popp sent a WhatsApp message to BAUGH, Gilbert, and Supervisor 1 with a link to an audio recording of an NPD dispatcher describing the ongoing harassment of the Victims and the August 16 surveillance. Popp commented to the group: “This is from Friday.” In response, Gilbert asked, “They did not get the license plate?” Popp replied, “Doesn’t sound like it - either way, we got rid of that car the same day.” BAUGH continued: “We burned 12 another 2 days later, but again, there was no cause and and they can’t prove anything. They are seeing ghosts now. Lol.” I believe based on BAUGH’s reference to “2 days” after Popp’s reference to “Friday,” BAUGH was referring to BAUGH, Popp, and Zea’s surveillance on Sunday (August 18). 118. BAUGH forwarded the same police recording to Stockwell and Analyst 3: “A little glimpse of what all your hard work is has led too. Lol. And stuff like this around the clock..” 119. BAUGH then sent Stockwell and Analyst 3 a link to the 2003 movie Old School in which a character arrives at a home unannounced, stating: “I’m here for the gang bang.” 120. Knowing that the NPD was investigating the harassment of the Victims, Gilbert 12 Based on my training and experience as a criminal investigator, I believe BAUGH’s reference to “burning” references the return of the rental car after the Victims identified it to the NPD as having followed Victim 2. 31 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 32 of 51 stated to the group: “The more I thought about it I do think we should bring a dossiers on the [Victims] to the PD. Definitely want to make them look crazy.” BAUGH replied, “I agree,” and Popp relied, “Copy re dossiers.” 121. I believe from the context of these messages and the investigation to date that Gilbert, Popp, and BAUGH were referring to the August 15, 2019 “Person of Interest” (“POI”) document that falsely reported that the Victims had threatened eBay and Executive 1, and that Gilbert would bring the POI document to the NPD to discredit the Victims’ harassment complaints. 122. At 9:48 p.m. (ET), BAUGH stated over WhatsApp, “Just sent poi doc with [Victims] included. I had GIC send this to me last week in case we got stopped..that way would at least have something to show to PD.” A minute earlier, BAUGH emailed Gilbert the POI document that falsely reported that the Victims had threatened Executive 1, noting, “Brian - take a look at this. I think we need more details on them. Steph [Popp] is calling you. Let her know what you think.” Gilbert acknowledged receiving the false POI document and stated he would speak with Popp. 123. Meanwhile, BAUGH continued to discuss the harassment campaign, sending the Old School excerpt that he had sent to Stockwell and Analyst 3 to Popp, Gilbert, and Supervisor 1, commenting that “this has been the [Victims]’ house for the past five nights.” Awareness of the Victims’ Emotional Distress 124. At 10:13 p.m., still on August 20, BAUGH messaged Stockwell and Analyst 3, “We’ve ‘burned’ 2 of our rental cars by following them..now they are seeing ghosts, think everyone is following them and they call the police every 10 minutes.” This causes me to 32 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 33 of 51 believe that BAUGH was aware of both the NPD investigation and the emotional distress that the conspiracy’s actions were causing the Victims. 125. Similarly, at 10:34 p.m., BAUGH messaged Stockwell and Analyst 3, tasking Analyst 3 with conducting a background check on an “idiot prosecutor” in BAUGH’s hometown in Arkansas who was prosecuting BAUGH’s father. BAUGH asked Analyst 3 for “his office and cell number. His email. Wife’s name and cell/email. Kids names. Vehicle information etc. I’ve done a quick osint [open source intelligence] search and I can see that likely having an affair with at least one person.” Regarding the prosecutor, BAUGH messaged: “This is a very small town. If I gave him an ounce of what we’ve been giving the [Victims], it would be devastating to him.” Obstructing the NPD and Executing the White Knight Strategy 126. Just before midnight on August 21, 2019, Popp informed the group via WhatsApp that BAUGH had authorized Gilbert to call Victim 1, but not to leave a voicemail. “He says you can call her a few times so you have a record on your phone to show cops.” Based on the earlier meetings regarding the White Knight Strategy (as reported by CW-2), I believe the “call” was a way to begin Gilbert’s offer of assistance to help the Victims with the harassing communications, even though BAUGH, Gilbert, Popp, and Supervisor 1 knew of the NPD investigation (and the fact that they were the ones behind the harassment). 127. The same WhatsApp group (BAUGH, Popp, Gilbert, and Supervisor 1) tracked the interference with the NPD investigation within moments of its next significant development, the August 21 arrival in the lobby of the Ritz Carlton of an NPD detective, who asked to speak with Zea. (The NPD had in fact connected the GMC’s license plate to Enterprise, Zea, and the 33 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 34 of 51 hotel). A portion of the WhatsApp exchange UHIHUULQJ WR =HD DV 5RQQLH is depicted below: 128. Over the WhatsApp chat, Gilbert asked whether Zea could be connected to eBay. Popp noted to the group that Zea’s LinkedIn profile connected her to eBay, and that Popp had instructed Zea to “take it down in case they [i.e., the NPD] do social media research.” 129. As BAUGH, Gilbert, and Popp discussed whose credit cards had been used to pay for the room stays at the hotel and the travel to Boston, Popp reported that Zea had booked BAUGH’s room. BAUGH replied, “Whatever - fuck them. I’ll get [Zea] on the plane and I’ll come back and deal with them.” BAUGH instructed Popp to stay in her room and not talk to anyone. 130. At 9:44 a.m. (ET), Gilbert proposed to the group a false explanation they could provide to the NPD: “[Zea] was driving around looking for antiques. Must have got lost and they picked up her plate by accident. Can they visually identify her?” BAUGH replied that he was in an Uber with Zea on the way to the airport and that the NPD could not identify her, adding that the NPD detective had been “polite and clueless” when BAUGH spoke to him (i.e., when BAUGH impersonated Zea’s husband). 131. At 9:48 a.m., Gilbert replied, “Good. This is fine. The cops obviously have 34 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 35 of 51 nothing else to do in Natick. We known the targets have been very impacted by this op. Perfect time for next phase.” By “next phase,” I believe Gilbert was referring to executing the White Knight Strategy by contacting the Victims and the NPD to offer help with the harassment and surveillance, despite the Target Subjects being responsible for it. 132. BAUGH replied, “Bring out bad boy out please; these people are wasting our time. It’s go time.” Continuation of the Harassing Tweets 133. Popp messaged BAUGH, Gilbert, and Supervisor 1 that she had tried unsuccessfully to purchase additional followers for her Twitter account and requested, “Am I clear to start tweeting [Victim 1] even without followers?” At 11:22 a.m., Popp added, “Brian [Gilbert] - you’re running out of time so I’m going to go ahead and start the public tweets so you can call her before your flight...” Gilbert agreed. 134. At approximately 12:08 p.m., Popp shared a screenshot of tweets she had posted moments earlier underneath one of the Newsletter’s tweets: 1(:6/(77(5 9,&7,0 1(:6/(77(5 0$6. $&&2817 35 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 36 of 51 1(:6/(77(5 9,&7,0 9,&7,0 9,&7,0 9,&7,0 9,&7,0 9,&7,0 135. Based on the investigation to date, these public tweets were intended to continue to harass the Victims in furtherance of the White Knight Strategy, and to deceive the NPD into accepting Gilbert’s help with the harassment campaign. Gilbert replied to the group: “Good to 36 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 37 of 51 go. Will make the calls.” 136. Minutes earlier, Popp sent the same screenshots from her eBay email account to Gilbert, copying BAUGH. Popp wrote: “Brian - FYI, she's really bringing out some angry Twitter users.” I believe based on the fact that Popp, Gilbert, and BAUGH had discussed Popp writing these very Tweets, that the email itself was intended for either the Victims or the NPD in furtherance of the White Knight Strategy. In other words, the email is intended to make it seem like Popp discovered the tweets, not that she had written them at the direction of BAUGH and Gilbert. The use of their eBay email accounts itself is significant as well—the Target Subjects took care to avoid discussing their harassment campaign and obstruction efforts over corporate email; I believe the use of corporate email in this limited instance was intended to create false documents that would support the White Knight Strategy. 137. Approximately thirty minutes later, at 12:34 p.m. (ET), BAUGH forwarded Popp’s email of Popp’s threatening tweets to HARVILLE, and separately to the GIC. 138. At 1:03 p.m., Popp emailed BAUGH and Gilbert several documents: (1) the false POI document featuring the Victims as eBay’s two top Persons of Interest along with selections from the Newsletter’s comments critical of or mocking eBay and Executive 1; (2) an eBay POI list that did not include the Victims but did include a POI that the Victims had mentioned to the NPD; (3) screenshots of the unsuckEbay Parody Account; and (4) a selection of the tweets that Popp had written targeting the Victims. 139. At 2:46 p.m., after speaking with the Victims, Gilbert wrote: “Just made phone contact with [Victim 1] and [Victim 2]. They are totally rattled and immediately referred me to Natick PD Detective [omitted]. [Victim 1] was a bitch, [Victim 2] wanted to talk to me and was 37 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 38 of 51 receptive. [Victim 1] said talk to the detective and then hung up the phone.” 140. At 4:04 p.m., BAUGH sent to Gilbert and Popp a copy of an August 15, 2019 email confirming that Zea was eligible to come off the waitlist for the DevConf.US 2019 conference in Boston. (As noted above, Red Hat records show that Zea never claimed this spot or attended the conference). In the private group chat, BAUGH responded: “I’m looking at the docs that Steph put together..there’s good stuff there we can use, specifically the screenshot of the Victims’ address being posted.” Gilbert replied, “Agreed. We just need to explain away [Zea] and Dave’s [HARVILLE’s] activities. Adamantly deny any deliveries and put focus on the POIs.” 141. At 4:10 p.m. (ET), Gilbert reported to the group that he had spoken to the NPD: “The detectives involved are [omitted] and [omitted]. I spoke to [omitted] and he [g]ave up everything. Initially the PD was disregarding the reports as Paranoia. But when they gave the an accurate license plate number the detectives tracked it back to Veronica Zea. They also identified the pizza delivery to coming from a gift card purchased in Santa Clara. They learned [Zea] lives in In Santa Clara. The rental car was turned into the ritz Carlton which led the detectives to the Ritz. Checking with hotel they learned Zea was currently staying there. PD also discovered that David Harville is staying at the Ritz. They contact someone at eBay and confirmed Zea is with the global intel center and Harville is with the global security resiliency unit. Now PD thinks there is a connection.” 142. Gilbert continued: 143. Based on the investigation to date, several of Gilbert’s statements to the detective were false. Specifically, Gilbert falsely told the detective that: (1) he did not know Zea or 38 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 39 of 51 HARVILLE despite having met with both at eBay within the previous week; (2) that there was a legitimate investigation underway; and (3) that there had been an “accidental” order of pizzas for surveillance that was sent to the Victims’ house. 144. Gilbert also emailed the NPD with other false statements, specifically that he had planned travel in Toronto and New York City that he would change plans to be able to meet the NPD in Boston. According to his flight itinerary, Gilbert was, in fact, on the plane to Boston as he wrote that he would try to move around other trips. 9,&7,06 145. In response to Gilbert’s suggestion “to make sure none of the other deliveries can be tracked back to Zea and Santa Clara,” Popp stated that the GIC had intended to order pizza COD (payable on delivery) so that the delivery person would ask the Victims for cash. Gilbert directed Popp to confirm the use of a payment card: “The detective said the debit card used for the pizza was purchased at a Safeway in Santa Clara. [Zea’s] drivers license comes back to an address in Santa Clara.” 146. Popp acknowledged that the GIC had in fact purchased a “bunch of gift cards” at a Safeway in Santa Clara (as video surveillance of Zea and Analyst 3 obtained by the NPD 39 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 40 of 51 showed). 147. In response, BAUGH, Popp, Gilbert, and Stockwell set out to concoct an explanation for the gift card purchases that would lead the NPD away from the Target Subjects. 148. Specifically, at 4:33 p.m. (ET), Gilbert proposed that the group “pin the deliveries to a POI in the San Jose or Santa Clara Area. Most of ebay employees live in San Jose or Santa Clara. So that’s just a coincidence.” 149. At 4:40 p.m., BAUGH instructed Popp to “find a local POI.” Popp acknowledged the request by stating that she had called Stockwell and asked for “all POIs in Bay Area since I don’t have visibility to those anymore. She will email you and me a report. I didn’t tell her why just said you would talk to her about it later.” 150. BAUGH later messaged Stockwell privately on WhatsApp: “Cops traced the gift card from the pizza delivery back to Safeway in Santa Clara.” BAUGH then asked Stockwell if Popp had requested “Santa Clara poi’s from [Stockwell].” Stockwell replied: “Yes, I’m still compiling the list.” BAUGH stated: “We need to pin the Safeway card on one of them.” Stockwell replied: “Copy. I figured as much.” 151. At 5:05 p.m. (ET), Gilbert proposed creating a “Samoan POI”: “If needed we create a Samoan POI in Santa Clara. Then he becomes our primary suspect. This actually might help the entire op.” I believe Gilbert was referring to an attempt to link the Santa Clara debit cards and the harassing deliveries to the harassing messages from Samoan-sounding Twitter accounts, @Tui_Elei and @Elei_Tui. 152. At 5:10 p.m. (ET), picking up on Gilbert’s suggestion, BAUGH instructed Popp to “create another Tui that’s in San Jose.” Popp acknowledged the request. BAUGH continued: 40 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 41 of 51 “Security had reason to believe they were in the area,” referring to the Victims’ harasser (@Elei_Tui). BAUGH also proposed that the group not forget about “Fidomaster and the fence..prob a good angle to play there somewhere.” Gilbert replied that “they” (NPD) did not know about the fence, and that Gilbert would have to wait for the NPD to raise the issue, because Gilbert did not know whether or not the Victims had reported the Fidomaster fence vandalism. See para. 27 & n.4 above. BAUGH suggested that Gilbert could say eBay’s GIC learned about the fence on a random internet forum. 153. BAUGH, Popp, and Gilbert continued to discuss what Gilbert would say to the NPD at the meeting Gilbert had scheduled for the following morning. Gilbert stated, “it’s going to be difficult not acknowledging [HARVILLE and Zea] were conducting an investigation. I can say their investigation was compartmentalized and not known to the rest of global security. Then we come up with why they were watching the [Victims].” 154. BAUGH replied, telling Gilbert about the alibi that BAUGH, HARVILLE, and Zea had selected: “defcon conference in Boston.” BAUGH continued: “I don’t think we deny we investigating, but we are not send omg pizzas to there house that would be silly.” 155. BAUGH also proposed that the “investigation is there to find Tui or chuck , etc” (i.e., to help the Victims with the harassment). This was the White Knight Strategy. 156. Gilbert, the former police captain, proposed blaming the Victims for the problems that the Target Subjects had created: “All that I told the Det I was looking into POIs and someone posting the [Victims’] home address. We can say [Zea] and Harville were looking into the Tui case. That investigation is confidential and details weren’t shared with Special Ops [Gilbert’s unit]. I’ll give brief the cops on the [Victims’] background and make them look like 41 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 42 of 51 the problem. The cops just want a logical legitimate reason for Ronnie [Zea] and Harville being here.” 157. BAUGH’s reply summed up the White Knight Strategy for the NPD meeting: “Regardless, we are here to help.” 158. At 6:17 p.m. (ET), Gilbert proposed another story: “How does this sound for [Zea] and [HARVILLE]: - they were in Boston for the conference (if we can prove it) - they already were tracking Tui and were aware he was targeting the [Victims] - Tui has not been identified but GIC and Resiliency was investigating - Spec Ops became aware of home address post and other POIs today. I cold called the [Victims] for a welfare check.” 159. BAUGH replied, “I don’t think we need to mention that Resiliency [i.e, HARVILLE’s department] was investigating.” 160. Gilbert replied at 6:19 p.m., “I’m going to push the idea that ebay is a massive company and have no interest in the [Victims]. The idea we would send shit to their house is ridiculous.” BAUGH replied, “I agree,” but noted that HARVILLE knew “almost” nothing about the Victims or their history. 161. At 6:39 p.m., BAUGH wrote to Gilbert and Popp and Supervisor 1: “And just remember, [Executive 2] said this has to stop even if there ebay takes on some risk (which we have). If I need to bring in and ebay attorney to talk to cops, I have that in my back pocket.” BAUGH added that HARVILLE did not know that the NPD had his name, “but he will scream violation of his privacy..lol.” At 6:46 p.m., BAUGH added that his “main thing” was that he did 42 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 43 of 51 not want Zea “talking to a detective.” 162. Gilbert responded: “Agreed. I hope to resolve it with they were doing a confidential proprietary info investigation. If we give the detectives enough info they will shut down. Most important we have to make sure there are no other connections to the deliveries.” 163. Separately, at 6:57 to 6:59 p.m., BAUGH messaged Stockwell and told her to make sure no one was “using those debit cards that were purchased.” 164. At 8:22 p.m., BAUGH added: “For [HARVILLE’s] cover..since he is business continuity, we could just tell them we are reopening our Boston office - which is confidential. he was also registered for that conference too.” 165. Gilbert continued his suggestions: “How about this; [Zea] was at the conference with [HARVILLE] when she got instructions to check to see if the [Victims’] address was correct. She was told this is a confidential case and just asked to validate the address. [Zea] is not a trained investigator and that’s why all the suspicious movements. [HARVILLE] was just there for the conference.” BAUGH replied, “I think that is perfect.” 166. At approximately 9:30 p.m., POPP emailed Gilbert a Bay Area POI report so that Gilbert could attribute the pizza delivery to a POI unrelated to the GIC. Popp also messaged Gilbert the same information via WhatsApp. Popp continued over WhatsApp, “Let me know if you’re good with the info on there or if you want more / less...” 167. In reply to the WhatsApp chain, at 9:47 p.m. and 9:48 p.m., Supervisor 1 replied: “Copy all. Good plan and cover. Brian, important to be convincing so they don’t start looking to find video of who purchased the gift cards. Don’t think they would go that far but is a little concerning. If I was the Detective I would ask you for a local PD context to go get video. Might 43 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 44 of 51 want to have a friendly in mind.” Gilbert replied: “I was thinking the same thing. If they bring it up I might volunteer to assist with that. Then we can control the local cop and maybe provide a video from a different Santa Clara Safeway.” 168. At 10:06 p.m., Supervisor 1 replied with two thumbs up, and at 10:15 p.m., BAUGH added: “They were in a bit of disguise when they bought them. Would be a lot of work and extremely hard to prove.” I believe based on my review of the video surveillance in the investigation, BAUGH is referring to Zea, who wore a baseball cap in that recording, and Analyst 3. 169. At 11:52 p.m., having arrived in Boston, Gilbert asked the group: “If asked tomorrow who is [Zea’s] supervisor? Just in case they want to verify what I’m saying.” BAUGH replied that Stockwell was Zea’s eBay supervisor, but an individual at eBay’s contractor was Zea’s actual supervisor. Gilbert clarified: “I guess I should say who do we want it to be? I’m leaning toward Popp being the person if the detectives want to verify my story about [Zea].” BAUGH agreed to having a member of the conspiracy be Zea’s supervisor if the detectives wanted to speak to one: “Yep. I agree. Popp would have been the one requesting that she verify that the address posted online is a real address.” BAUGH added that Gilbert could also use him as a supervisor. 170. Supervisor 1 added: “Agreed. Good idea. No mention of [Zea’s actual manager] in my opinion and [Popp] can handle this well.” 171. At 12:15 a.m., BAUGH noted: “The [Victims] have a lot of enemies and they are also equally crazy.” 172. At 12:27 a.m., ending the discussion for the day, BAUGH asked, in an apparent 44 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 45 of 51 suggestion that the operation against the Victims continue, “Is there a chance in hell we are even gonna try to put this tracker on at this point?” Gilbert replied: “They couldn’t be more on guard than right now. If we can calm them down and win them over maybe. Right now I would not risk an attempt.” 173. BAUGH added, referring to a post that Victim 1 had made that evening to the Newsletter: [Victim 1] is such a cunt - that 20 year anniversary article about journalism and integrity came out of nowhere. I assume it’s for the cops. These people are scum. I think we could still get [the tracker] on the car, bu[t] My concern with the tracker is that you guys patch things up and build a rapport with the local cops tomorrow then [either Victim 1 or Victim 2] finds it next month during an oil change and we lose credibility with PD.” August 22, 2019 – Gilbert’s Meeting with the NPD 174. On August 22, 2019, according to NPD representatives, Gilbert claimed that eBay had no role in the harassment of Victims 1 and 2. He falsely stated that HARVILLE and Zea had traveled to Boston to attend a conference and that Zea had gone to Natick on her own. Despite knowing that eBay employees and contractors were harassing the Victims, Gilbert offered eBay’s assistance to the NPD in looking into the harassment. 13 175. Both immediately before and just after the meeting, NPD officials had contacted and briefed the FBI regarding the harassment targeting the Victims and the possible involvement of eBay personnel. Thereafter, after consulting with representatives of the U.S. Attorney’s 13 Although Popp and BAUGH had equipped Gilbert with the documents described above, Gilbert did not show any of them to the NPD. 45 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 46 of 51 Office, the FBI opened an investigation into the commission of a federal criminal offense, namely cyberstalking. 176. Even ZKLOH Gilbert ZDV meeting with WKH NPD, at approximately 12:12 and 12:20 p.m. (ET), Popp, at BAUGH’s direction, continued to taunt and threaten Victim 1 using the TopSeller13 Account: 1(:6/(77(5 1(:6/(77(5 August 23-26, 2019 – Further Obstruction 177. On Friday, August 23, 2019, at approximately 8:15 p.m. (ET), BAUGH sent the following text message to Executive 2. 46 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 47 of 51 (;(& (;(& 178. Over the weekend of August 24, 2019, and August 25, 2019, according to both CW-2 and CW-3, BAUGH directed Popp to take down any accounts that had been used to contact the Victims, including any accounts registered with the Newsletter. 179. On the morning of August 26, 2019, BAUGH, HARVILLE, Popp, Gilbert, Zea, and others gathered in an eBay conference room. According to CW-2 and CW-3, all present discussed that the NPD was investigating the criminal harassment and stalking of the Victims. They were also aware that eBay’s legal department was attempting to investigate in response to the NPD’s request for assistance. 180. According to CW-2 and CW-3, HARVILLE was furious that both the Ritz Carlton and Enterprise had invaded his privacy by giving his information to the NPD. He swore and screamed about suing the NPD for putting his name in the request to eBay for assistance. 181. According to CW-3, BAUGH directed the group not to talk to anyone and to keep Executive 1 and Executive 2’s names out of any conversations. 182. During the August 26, 2019 meeting, according to CW-2 and CW-3, eBay’s legal department interviewed HARVILLE. HARVILLE, who left the call on speakerphone for the group to hear, falsely stated that he had attended the conference that Zea, HARVILLE, and 47 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 48 of 51 BAUGH had earlier planned to use as an alibi with the police. HARVILLE also reviewed the conference schedule just prior to his call with counsel. HARVILLE also falsely told eBay’s legal department that he had rented a car to be able to visit his sister, who lived in the area. 183. Popp also had an interview with eBay’s lawyers over speakerphone in front of the group in which she falsely stated that Zea had traveled to Boston at BAUGH’s direction to go to the conference. 184. According to both CW-2 and CW-3, BAUGH directed Popp to monitor Zea’s and Stockwell’s interviews with eBay’s legal department. Popp listened to both interviews on speakerphone and gave prompts to Zea that helped her get the conference cover story out. Popp provided similar support to Stockwell. 185. According to more than one participant in the meeting, BAUGH directed Popp, Gilbert, Zea, Stockwell, and HARVILLE to delete their WhatsApp communications and phone data. BAUGH also directed Popp to make sure that Gilbert’s phone and the WhatsApp messages on them were deleted. 186. Records obtained from Apple reveal that HARVILLE sent a message to Zea on or about August 26, 2019, at approximately 8:00 p.m. (PT) stating: “Hey - I’m not gonna let you speak to [inhouse counsel for eBay] anymore. He has had enough time with you. Let me know if he reaches out to you. If he does, I will brief [redacted] and he will represent you. Great work…you’re awesome!” (BAUGH had similarly stated that the “main thing” was that Zea not speak to the NPD). 187. On August 29, 2019, beginning at 8:27 p.m. (PT), BAUGH, HARVILLE, Popp and Gilbert exchanged WhatsApp messages regarding the NPD investigation and eBay’s 48 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 49 of 51 corresponding investigation. The group discussed emails they received in which eBay lawyers had directed each of them to appear for an interview with eBay’s outside lawyers the next day at eBay’s headquarters. In sum and substance, the WhatsApp group chat included: a. BAUGH proposing that he, HARVILLE, Popp and Gilbert refuse to meet with counsel for eBay to send “a strong message that we are not fucking around.” b. HARVILLE’s statement that a meeting would permit eBay counsel to “form an opine and provide a recommendation for punitive action pending any additional information from PD and or negative media.” c. Popp’s statement that “we all have each other’s back. That’s all that matters. They are fucked.” HARVILLE immediately replied: “Agree”. d. HARVILLE’s statement that “The paper trail leads no where All their findings are speculative and they have to confer with police to get anything substantive which they probably would not be given.” e. Popp’s sharing with HARVILLE, BAUGH, and Gilbert her email to eBay legal acknowledging that there was an “active criminal investigation” in refusing to meet with eBay’s outside lawyers without her own attorney. f. BAUGH’s acknowledgement to an eBay lawyer’s statement that “you have indicated that there is a possible ongoing criminal investigation, in which my colleagues have been named.” 188. On August 30, 2019, at 12:08 p.m. (PT), HARVILLE forwarded to the same WhatsApp group (including BAUGH) an email from an eBay lawyer requiring HARVILLE to turn in his eBay-issued cell phone: 49 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 50 of 51 189. Immediately after sharing this email with BAUGH and the others, HARVILLE asked the group: BAUGH’s iPhone record indicates that BAUGH received and read the message at 12:44 p.m. (PT) the same day. 190. Popp instructed HARVILLE to “stand by” in response, and BAUGH stated, “Don’t do anything until we speak to an attorney” [but] “Don’t turn phone in either”—requests that HARVILLE acknowledged by stating, “Copy.” HARVILLE stated at 1:23 p.m. (PT), “I’m just finished and will give them my eBay phone since they know I have it here.” 191. On August 30, 2019, eBay placed BAUGH, HARVILLE, and Popp on administrative leave. 192. In connection with the investigation, eBay collected HARVILLE’s iPhone and determined much of its data had been deleted. The FBI later obtained the phone itself and confirmed through forensic analysis that there had been deletions on HARVILLE’s work-issued 50 Case 1:20-mj-02398-MBB *SEALED* Document 3-2 Filed 06/11/20 Page 51 of 51 device, including, among other records: (1) all of the phone’s iMessages from before August 29, 2019 at 12:47 p.m. (PT); (2) all of the phone’s contacts; (3) web browsing activity related to both “defcon boston”—the conference that was to serve as HARVILLE’s alibi for the surveillance campaign—and a website associated with “Natick Police and Fire Live Audio Feed.” 193. On August 30, 2019, at 9:08 p.m. (PT), BAUGH messaged Stockwell and stated, “It’s all good...you just need to stay clean and you and I never spoke.” CONCLUSION 194. Based on the information described above, there is probable cause to believe that BAUGH and HARVILLE committed the Target Offenses. The requested Complaint and accompanying arrest warrants for both men should issue. Respectfully submitted, MARK WILSON Special Agent Federal Bureau of Investigation Sworn to me telephonically on June 11, 2020 HONORABLE MARIANNE B. BOLWER United States Magistrate Judge 51 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 1 of 16 UNDER SEAL UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS ) ) ) ) ) ) ) ) ) ) ) UNITED STATES OF AMERICA v. BRIAN GILBERT, STEPHANIE POPP, STEPHANIE STOCKWELL, and VERONICA ZEA, Defendants Criminal No. 20-cr-10098 Violations: Count One: Conspiracy to Commit Cyberstalking (18 U.S.C. § 371) Count Two: Conspiracy to Tamper with a Witness (18 U.S.C. § 371) INFORMATION At all times relevant to this Information: General Allegations 1. eBay was a multinational ecommerce business listed on the Fortune 500. eBay operated marketplaces that connected online sellers and their customers. 2. James Baugh (“BAUGH”), a coconspirator not charged as a defendant in this Information, lived in San Jose, California. BAUGH was eBay’s Senior Director of Safety & Security. He ran eBay’s Global Security and Resiliency (“GSR”) business, a company division responsible for, in general terms, the physical security of eBay’s employees and facilities worldwide. 3. Defendant Stephanie Popp (“POPP”) lived in San Jose, California. POPP was eBay’s Senior Manager of Global Intelligence. She served as BAUGH’s de facto chief of staff. Before May 2019, POPP managed eBay’s Global Intelligence Center (“GIC”), an intelligence and analytics group within the GSR that supported eBay’s security operations. 1 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 2 of 16 4. Defendant Stephanie Stockwell (“STOCKWELL”) lived in Redwood City, California. STOCKWELL was an intelligence analyst in the GIC who became its manager in mid-2019, when eBay assigned POPP to work directly with BAUGH. 5. Defendant Veronica Zea (“ZEA”) lived in Santa Clara, California. ZEA was an eBay contractor who worked as an intelligence analyst in the GIC. 6. Defendant Brian Gilbert (“GILBERT”) lived in San Jose, California. GILBERT was a Senior Manager of Special Operations for eBay’s Global Security Team. A former police captain in Santa Clara, California, GILBERT was responsible for, among other things, executive protection, special events security, and safety at eBay’s North American offices. 7. David Harville (“HARVILLE”), a coconspirator not charged as a defendant in this Information, lived in Gilroy, California. HARVILLE, who reported directly to BAUGH, was eBay’s Director of Global Resiliency, a unit focused on ensuring that eBay could continue to operate worldwide after business disruptions, such as security threats, political unrest, or natural disasters. 8. Victim 1 lived in Natick, Massachusetts. Victim 1 was a reporter and editor of an online newsletter (“the Newsletter”) that covered ecommerce companies, including eBay. Victim 1 used a Twitter account in the Newsletter’s name to promote her reporting. 9. Victim 2 lived in Natick and was married to Victim 1. He was the Publisher of the Newsletter. 10. Several eBay executives perceived a threat to eBay’s public image in the Newsletter’s coverage. 11. The defendants and their coconspirators knew that some in eBay’s senior 2 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 3 of 16 leadership disliked both the Newsletter’s content and comments that the Newsletter’s readers posted underneath Victim 1’s articles. 12. In August 2019, as described below, the defendants and their coconspirators engaged in an extensive harassment campaign targeting Victims 1 and 2. The campaign included sending threatening communications to the Victims, ordering unwanted and disturbing deliveries to their home, and ZEA, HARVILLE, BAUGH, and POPP travelling to Natick to surveil the Victims in their home and community. 13. After the Victims spotted one of the surveillance teams, the Natick Police Department (“NPD”) investigated, connected ZEA and HARVILLE to eBay, and reached out to eBay for assistance. 14. When BAUGH, GILBERT, HARVILLE, POPP, STOCKWELL, and ZEA learned that the NPD was making inquiries, they took steps described below to prevent the NPD from learning about the harassment campaign. Overview of the Cyberstalking Conspiracy 15. Beginning on or about August 5, 2019 and continuing through at least August 23, 2019, defendants GILBERT, POPP, STOCKWELL, and ZEA conspired with BAUGH, HARVILLE, and others to harass Victim 1 and Victim 2 through repeated and hostile Twitter messages, deliveries of unwanted—and in some instances disturbing—items to the Victims’ home, and physical surveillance. The defendants and their coconspirators intended to cause the Victims distress and to distract them from publishing the Newsletter. After they caused such distress, GILBERT contacted Victim 1, identified himself as an eBay employee, claimed that the company had seen and was concerned by the online harassment of the Victims, and offered 3 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 4 of 16 eBay’s help. In essence, the plan was for eBay to arrive to “rescue” the Victims from the very harassment that the defendants and their coconspirators had themselves created in order to earn the Victims’ good will (hereinafter referred to as the “White Knight Strategy”). The defendants and their coconspirators believed that the cyberstalking campaign would curtail both the Newsletter’s coverage of eBay and the anonymous comments beneath it, and thereby please eBay’s senior management. Object and Purpose of the Cyberstalking Conspiracy 16. The object and purpose of the conspiracy was to engage in a cyberstalking campaign targeting the Victims, to harass them, and to create an opportunity for eBay (through GILBERT) to approach the Victims, offer assistance, and create a positive impression of eBay that would be reflected in Victim 1’s reporting in the Newsletter. Manner and Means of the Cyberstalking Conspiracy 17. Among the manner and means by which defendants GILBERT, POPP, STOCKWELL, and ZEA conspired with BAUGH, HARVILLE, and others to carry out the cyberstalking conspiracy were the following: a. Creating Twitter accounts in false names and using them to send harassing messages to and about Victim 1 and the Newsletter. b. Selecting ominous Twitter account names and profile photos. c. Sending private and threatening direct messages (“DMs”) to Victim 1’s Twitter account. d. Publicly posting the Victims’ home address on Twitter, while suggesting in a threatening manner that eBay sellers who were angry about the Newsletter’s coverage should visit the Victims’ home. e. Sending unwanted and scary items and services to the Victims’ home, and items intended to embarrass the Victims to their neighbors’ addresses. 4 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 5 of 16 f. Posting online advertisements for fictitious events at the Victims’ home to encourage others to visit them there. g. Signing the Victims up for unwanted emails and online newsletters. h. Traveling to Boston and to Natick to surveil the Victims in their home and in their community. i. Disguising their role in the conspiracy by ordering the harassing deliveries with burner cell phones and laptops, VPN services, overseas email accounts, and prepaid debit cards purchased with cash. Overt Acts in Furtherance of the Cyberstalking Conspiracy 18. From on or about August 5, 2019 and continuing through at least August 23, 2019, defendants GILBERT, POPP, STOCKWELL, and ZEA, along with BAUGH, HARVILLE, and others, committed and caused to be committed the following overt acts, among others, in furtherance of the conspiracy: a. On August 6, 2019, at a San Jose, California Best Buy, STOCKWELL purchased a laptop computer for use in the harassment campaign. b. On August 6, 2019, POPP created a Twitter Account in the name of “@Tui_Elei” that used a picture of a skeleton mask as a profile picture. c. On August 7, 2019, POPP sent the following DMs to Victim 1’s Twitter account: • “[Victim 1’s First Name]…whats your problem w/ebay? You know that’s how we pay rent.” • “HELLO!!!!!!!” d. On August 8, 2019, ZEA purchased prepaid debit cards with cash at a Safeway in Santa Clara, California for use in ordering harassing deliveries. e. On August 9, 2019, POPP sent the following DMs to Victim 1’s Twitter account: • “WTF…whats it goin to take for u to answer me??” 5 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 6 of 16 • I guess im goin to have to get ur attention another way bitch… • U don’t have the balls to talk to me?? Stop hiding behind ur computer screen u fuckin cunt!!!” f. On August 9, 2019, STOCKWELL used a Protonmail account created for the conspiracy to order online live spiders for delivery to the Victims’ home. g. On August 9, 2019, one or more members of the conspiracy ordered a subscription for pornographic magazines in the name of Victim 2 to be sent to the Victims’ neighbors. h. On August 9, 2019, one or more members of the conspiracy ordered a pig fetus for delivery to the Victims’ home. 1 i. On August 10, 2019, one or more members of the conspiracy ordered a Halloween Pig Mask for delivery to the Victims’ home. j. On August 10, 2019, POPP sent the following DM to Victim 1’s Twitter account: • k. “DO I HAVE UR ATTENTION NOW????” On August 11, 2019, POPP sent the following DMs to Victim 1’s Twitter account: • “Ur fat fuck pussy husband [Victim 2’s first name] needs to put u in line cunt.” • “after he takes the plugs out of his asshole…fuckin pussies!!!” l. On August 12, 2019, one or more members of the conspiracy sent a book titled “Grief Diaries: Surviving Loss of a Spouse” to the Victims’ home. m. On August 12, 2019, POPP used the “@Tui_Elei” Twitter account to post to Victim 1’s Twitter account “[Victim 1]…wats ur problem with ebay??” n. On August 12, 2019, POPP used the “Tui_Elei” Twitter account to post to Victim 1’s Twitter account “many familys including mine make money 2 1 The delivery was flagged by the retailer, who called the Victims’ home, asking about their purchase. When the Victims denied making the purchase, it was cancelled. 6 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 7 of 16 pay 4 food cloths and rent by selling on ebay…UR stupid idkiot comments r pushin buyers away from ebay and hurtin familys!!! STOP IT NOW!!” o. On August 13, 2019, one or more members of the conspiracy used a prepaid debit card to order a funeral wreath for delivery to the Victims’ home. p. On August 14, 2019, one or more members of the conspiracy ordered roaches for delivery to the Victims’ home. q. On August 14, 2019, POPP used the @Tui Elei Twitter account to post a public message to Victim 1’s Twitter account, “[First name of Victim 1] wen u hurt our bizness u hurt our familiys…Ppl will do ANYTHING 2 protect family!!!!” r. On August 14, 2019, ZEA booked hotel rooms at the Ritz Carlton hotel in Boston, Massachusetts and rented vehicles in Boston, Massachusetts. s. On August 14, 2019, BAUGH, HARVILLE, ZEA, GILBERT, and POPP met to discuss the trip to Boston to surveil the Victims. t. On August 15, 2019, BAUGH, HARVILLE, and ZEA flew from California to Boston, Massachusetts. u. On August 17, 2019, one or more members of the conspiracy called a Boston, Massachusetts restaurant that is open 24 hours and ordered pizza to be delivered to the Victims’ home at 4:30 a.m., for payment upon delivery. v. On August 17, 2019, one or more members of the conspiracy called a suburban restaurant near the Victims’ home and ordered pizza to be delivered at 11:00 p.m. w. On August 18, 2019, POPP sent the following DM to Victim 1’s Twitter account: • “U get my gifts cunt!!??” x. On August 18, 2019, POPP replied to a public tweet on Victim 1’s Twitter account using the @Tui Elei account and stated: “Dis ur address???”. The message was followed by information about Victim 1, accurately stating her name, age, address, and telephone number. y. On August 18, 2019, one or more members of the conspiracy posted an advertisement on Craigslist claiming to be a married couple seeking a sexual partner or partners, and providing the Victims’ home address. 7 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 8 of 16 z. On August 20, 2019, one or more members of the conspiracy caused strangers to arrive at the Victims’ home by posting an advertisement on yardsalesearch.com that the Victims were “moving out of the country soon and are trying to get rid of as many of our possessions as possible. … If we are not outside, feel free to knock on the door. Maybe we can make a deal if you see something you like.” aa. On August 20, 2019, after Twitter suspended the coconspirators’ @Tui_Elei account for posting the Victims’ home address, POPP created a second Twitter account, @Elei_Tui, and used it to post more threatening messages on Victim 1’s Twitter account. bb. On August 20, 2019, POPP also created two other Twitter accounts, including one that used the name of a prominent eBay seller. These new accounts, which used an image of a pig mask and an image of a screaming mask as profile pictures, exchanged threatening public tweets about Victim 1 with the @Elei_Tui account, all to give the impression that several eBay sellers were upset with the Victims over the Newsletter’s coverage of eBay. cc. On August 21, 2019, GILBERT sent WhatsApp communications to POPP proposing threatening messages that could be sent from the newly created Twitter accounts described above. dd. On August 21, 2019, POPP used two of the Twitter accounts that she had created to have a public “conversation” on Twitter, asking one what Victim 1’s address was, and responding as the other “guest I hav to pay [Victim 1] a visit.” ee. On August 21, 2019, consistent with the White Knight Strategy, GILBERT called the Victims, identified himself as an eBay employee, and offered eBay’s assistance. ff. On August 22, 2019, POPP used one of the new Twitter accounts to post “@[Newsletter] 20 yrs of lies n distroin familys... dunt b proud of dat u wurthless BITCH!!! i wil distroy ur family n bizness 2... C how u like it...\n\n@Elei_Tui wen r we goin 2 visit her in natik???” gg. On August 23, 2019, one or more members of the conspiracy caused a woman to visit the Victims’ home and identify herself as an “early bird” for a yard sale the next day. 8 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 9 of 16 Overview of the Obstruction Conspiracy 19. From on or about August 16, 2019 and continuing through at least on or about September 6, 2019, defendants GILBERT, POPP, STOCKWELL, and ZEA conspired with BAUGH, HARVILLE, and others to obstruct the Natick Police Department’s investigation. Object and Purpose of the Obstruction Conspiracy 20. The object of the conspiracy was to obstruct justice by engaging in misleading conduct toward law enforcement officers in the Natick Police Department with intent to hinder, delay, or prevent the communication to a law enforcement officer of the United States of information relating to the commission and possible commission of a federal offense. The purpose of the conspiracy was to prevent law enforcement from uncovering the coconspirators’ and eBay’s connection to the cyberstalking campaign and related conduct. Manner and Means of the Obstruction Conspiracy 21. Among the manner and means by which defendants GILBERT, POPP, STOCKWELL, and ZEA conspired with BAUGH, HARVILLE, and others to carry out the obstruction conspiracy were the following: a. making false statements to NPD personnel who were investigating the threatening communications, harassing deliveries, and surveillance of the Victims; b. communicating by WhatsApp regarding how to respond to the NPD investigation; c. having GILBERT speak, email, text message, and meet with the NPD, to deflect through false statements any connection between eBay and the cyberstalking campaign; d. creating and sending to GILBERT a “dossier” of documents that he could use in an NPD meeting, both to support the White Knight Strategy and to deflect investigative attention from eBay; 9 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 10 of 16 e. Exchanging ideas as to how best to thwart the NPD investigation, including creating false suspects, continuing the harassing deliveries, fabricating cover stories, and intervening with any San Jose area police that the NPD contacted to further its investigation; and f. Deleting the contents of cell phones, text messages, and social media accounts that evidenced the cyberstalking campaign and the defendants’ and coconspirators’ efforts to obstruct the NPD investigation. Overt Acts in Furtherance of the Obstruction Conspiracy 22. From on or about August 16, 2019 and continuing through at least September 6, 2019, defendants GILBERT, POPP, STOCKWELL, and ZEA, along with BAUGH, HARVILLE, and others, committed and caused to be committed the following overt acts, among others, in furtherance of the conspiracy: a. On August 21, 2019, ZEA and BAUGH made false statements to an NPD detective who arrived at the Boston hotel (where the surveillance team was then staying) to investigate ZEA and HARVILLE’s connection to the cyberstalking campaign. b. On August 21, 2019, defendants and their coconspirators made the following statements in a group discussion over WhatsApp: • GILBERT: “The more I thought about it I do think we should bring a dossiers on the [Victims] to the PD. Definitely want to make them look crazy. • BAUGH: “I agree.” *** • POPP: “Copy re dossiers” *** • BAUGH: Natick detective is in lobby looking for Ronnie [ZEA]. I’ve taken her away from hotel headed to airport. Detective called 10 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 11 of 16 her cell. I answered just now as her husband and played dumb. Told him if he had questions he could talk to me. • GILBERT: Copy. She used just [name of eBay contractor] stuff no eBay? • BAUGH: Correct. • POPP: But her LinkedIn says EBay so I told her to take it down in case they do social media search. *** • GILBERT: “Ronnie was driving around looking for antiques. Must have got lost and they picked up her plate by accident. Can they visually identify her?” *** • BAUGH: “They cannot ident her…I spoke with investigator. He was polite and clueless.” *** • GILBERT: “Good. This is fine. The cops obviously have nothing else to do in Natick. We known the targets have been very impacted by this op. Perfect time for next phase.” *** • c. BAUGH: “Bring out bad boy out please; these people are wasting our time. It’s go time.” On August 21, 2019, GILBERT, who was on a plane bound for Boston, spoke, text messaged, and emailed with the law enforcement officer who was handing the investigation into the harassment of the Victims. GILBERT falsely claimed not to know ZEA or 11 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 12 of 16 HARVILLE and falsely stated that he had to travel to Toronto and New York but would instead attempt to come to Boston to meet with the NPD. d. On August 21, 2019, after GILBERT spoke to the NPD, defendants and their coconspirators made the following statements in a group discussion conducted over WhatsApp: e. • GILBERT: The detective is looking to close this out but can’t until he answers this ebay connection. I told the detective I don’t know a Zea or Harville but they might be in other unites of global security. I told them that it possible other units are conducting legitimate investigations. I think the best explanation is that intel was attempting initial investigation into POIs [Persons of Interest] and panicked when they got burned. They accidentally ordered pizzas for the surveillance and got sent to the target house. We need to make sure none of the other deliveries can be tracked back to Ronnie [ZEA] and Santa Clara… The detective said the debit card used for the pizza was purchased at a Safeway in Santa Clara…” • POPP: “Intel unit definitely purchased a bunch of gift cards at Safeway in San Jose.” • BAUGH: “I don’t think we deny the investigating, but we are not send omg pizzas to there house that would be silly.” • GILBERT: “I’ll give brief the cops on the [Victims] background and make them look like the problem. The cops just want a logical legitimate reason for Ronnie [ZEA] and Harville being here…I told the det I don’t know a Veronica Zea or David Harville. Can we confirm our org chart not public so we don’t look like idiots when we deny knowing them again? … We just need to explain away Ronnie [ZEA] and Dave’s activities. Adamantly deny any deliveries and put focus on the POIs.” • GILBERT: “I’m going to push the idea that ebay is a massive company and have no interest in the [Victims.] The idea we would send shit to their house is ridiculous.” On August 21, 2019, after learning that the NPD was investigating a prepaid debit card obtained in Santa Clara and used to send pizza to the Victims, BAUGH and POPP 12 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 13 of 16 directed STOCKWELL to prepare a list of eBay “Persons of Interest” in the San Francisco Bay Area that could be used (as part of GILBERT’s “dossier”) to deflect attention from ZEA. f. On August 21, 2019, STOCKWELL created the document that BAUGH requested for GILBERT’s “dossier”—“Bay Area POIs_August 2019.docx”—and emailed it to POPP and BAUGH, who immediately emailed it on to GILBERT for use in the NPD meeting. g. On August 22, 2019, GILBERT and another eBay employee met with three members of the NPD. During the meeting, GILBERT falsely stated that: h. • ZEA and HARVILLE had come to Boston to attend a conference; • GILBERT was not aware of the harassment of the Victims but was willing to assist in the investigation. • POPP was ZEA’s supervisor; and • POPP had assigned ZEA to a Person of Interest investigation regarding the Victims, and that ZEA had driven to Natick “on her own”. On or after August 26, 2019, ZEA, HARVILLE, POPP, GILBERT, and others deleted and attempted to delete data from their phones that evidenced the cyberstalking and obstruction conspiracies, including the WhatsApp messages. i. On or about September 6, 2019, POPP posted five new Tweets to one of the Twitter accounts that the defendants and their coconspirators had used to harass the Victims, to suggest that those responsible for harassing the Victims were still at large. 13 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 14 of 16 COUNT ONE Conspiracy to Commit Cyberstalking (18 U.S.C. § 371) The U.S. Attorney charges: 23. The U.S. Attorney re-alleges and incorporates by reference paragraphs 1 through 22 of this Information. 24. From on or about August 5, 2019 and continuing through at least August 23, 2019, in the District of Massachusetts and the Northern District of California, the defendants, BRIAN GILBERT, STEPHANIE POPP, STEPHANIE STOCKWELL, and VERONICA ZEA, conspired with each other and with others known to the United States Attorney to commit an offense against the United States, to wit, cyberstalking, that is, to, with intent to harass and intimidate, use an interactive computer service and an electronic communications service and electronic communication systems of interstate commerce, and any other facility of interstate and foreign commerce, specifically Twitter messages, online delivery orders, and online postings, to engage in a course of conduct that caused, attempted to cause, and would be reasonably expected to cause substantial emotional distress to Victim 1 and Victim 2, in violation of 18 U.S.C. § 2261A(2)(B). All in violation of 18 U.S.C. § 371. 14 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 15 of 16 COUNT TWO Conspiracy to Tamper with a Witness (18 U.S.C. § 371) The U.S. Attorney further charges: 25. The U.S. Attorney re-alleges and incorporates by reference paragraphs 1 through 22 of this Information. 26. From on or about August 16, 2019 and continuing through at least September 6, 2019, in the District of Massachusetts and the Northern District of California, the defendants, BRIAN GILBERT, STEPHANIE POPP, STEPHANIE STOCKWELL, and VERONICA ZEA, conspired with each other and with others known to the U.S. Attorney to commit an offense against the United States, to wit, obstruction of justice through tampering with a witness, that is, to knowingly engage in misleading conduct toward another person, to wit, law enforcement officers of the Natick Police Department, with intent to hinder, delay, and prevent the communication to a law enforcement officer of the United States of information relating to the commission and possible commission of a Federal offense, in violation of 18 U.S.C. § 1512(b)(3). All in violation of 18 U.S.C. § 371. 15 Case 1:20-cr-10098-WGY *SEALED* Document 1 Filed 05/22/20 Page 16 of 16 Respectfully submitted, ANDREW E. LELLING United States Attorney By: ________ ________________ DAVID J. D’ADDIO SETH B. KOSTO ASSISTANT UNITED STATES ATTORNEYS DISTRICT OF MASSACHUSETTS Date: May 22, 2020 16