AO 91 (Rev. 11/11) CriminalCase Complaint 2:20-mj-00140-CKD Document 1 Filed 09/14/20 Page 1 of 22 UNITED STATES DISTRICT COURT for the FILED Sep 14, 2020 Eastern District of California CLERK, U.S. DISTRICT COURT EASTERN DISTRICT OF CALIFORNIA United States of America ) v. ) ) Case No. 2:20-mj-0140 CKD ) Kristy Lynn FELKINS ) ) ) Defendant(s) SEALED CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best of my knowledge and belief. On or about the date(s) of February 2016 through May 2016 in the county of Butte in the Eastern District of California , the defendant(s) violated: Code Section Offense Description 18 U.S.C. § 1958 Use of Interstate Commerce Facilities in the Commission of Murder-for-Hire This criminal complaint is based on these facts: (see attachment) ܈ Continued on the attached sheet. V Complainant’s signature Special Agent Aron Mann Homeland Security Investigations Printed name and title Sworn to before me and signed telephonically. Date: DWDP Judge’sJudge’s signaturesignature City and state: Sacramento, California Carolyn K. Delaney, U.S. Magistrate Judge Printed name and title Case 2:20-mj-00140-CKD Document 1 Filed 09/14/20 Page 2 of 22 AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT I, Aron Mann, being duly sworn, hereby depose and state as follows: I. INTRODUCTION AND AGENT BACKGROUND 1. I am a Special Agent with Homeland Security Investigations (“HSI”) and have been so employed since June 2016. As a requirement for employment as an HSI Special Agent, I successfully completed the Criminal Investigator Training Program (“CITP”) located at the Federal Law Enforcement Training Center (“FLETC”) in Glynco, Georgia. At the conclusion of CITP, I completed an additional Homeland Security Investigations Special Agent Training Academy. As part of the training at FLETC, I received extensive instruction in the areas of immigration law, customs law, illegal narcotics, firearms, surveillance, and interview techniques. 2. As a Special Agent with HSI, part of my duties include investigating violations of federal criminal laws, including those related to the cybercrime and the dark web. As an HSI Special Agent, I am a “Federal Law Enforcement Officer,” authorized to investigate violations of the laws of the United States and to execute search and seizure warrants issued under the authority of the United States. I have prepared, executed, and assisted in numerous search and arrest warrants, including those related to violations of federal criminal laws covering cybercrime and related activities in connection with electronic communication applications such as email. 3. Among other duties, I am currently participating in an investigation related to violations of 18 U.S.C. § 1958 (Use of Interstate Commerce Facilities in the Commission of Murder-for- Hire) (hereafter, “Subject Offense”). I personally have participated in the investigation since September 2019 and am familiar with the relevant facts and circumstances. The facts and information contained in this Affidavit are based on my knowledge and observations, my training and experience, and speaking with other federal law enforcement officers familiar with this investigation. 1 Case 2:20-mj-00140-CKD Document 1 Filed 09/14/20 Page 3 of 22 4. This Affidavit is intended to show only that there is sufficient probable cause for the requested arrest warrant and does not set forth all of my knowledge about this matter. Except where otherwise indicated, communications are reproduced in summary and in part. Where dates, figures, times, and/or calculations are set forth in this Affidavit, they are approximate, unless noted otherwise. 5. Based on my training and experience and the facts set forth in this Affidavit, I submit there is probable cause to believe that a violation of federal criminal law, to wit: the Subject Offense has been committed by Kristy FELKINS, and a warrant for her arrest should be issued. II. STATUTORY FRAMEWORK 6. Murder-for-Hire occurs when (1) whoever travels in or causes another (including the intended victim) to travel in interstate or foreign commerce, or uses or causes another (including the intended victim) to use the mail or any facility of interstate or foreign commerce, (2) with intent that a murder be committed in violation of the laws of any State or the United States (3) as consideration for the receipt of, or as consideration for a promise or agreement to pay anything of pecuniary value, or who conspires to do so [violates this statute]. 18 U.S.C. § 1958. 7. Interstate Communications occur when whoever transmits in interstate or foreign commerce any communication containing any threat to kidnap any person or any threat to injure the person of another. 18 U.S.C. § 875(c). III. TECHNICAL BACKGROUND 8. Based on my training and experience, I am aware of the following concepts: a. The “dark web,” also sometimes called the “darknet,” “dark net” or “deep web,” is a colloquial name for a number of extensive, sophisticated, and widely used criminal marketplaces operating on the Internet, which allow participants to buy and sell illegal items, such as drugs, firearms, and other hazardous materials with greater anonymity than is possible on the traditional Internet (sometimes called the “clear web” or simply “web”). These online black- market websites use a variety of technologies, including the Tor network (defined below) and 2 Case 2:20-mj-00140-CKD Document 1 Filed 09/14/20 Page 4 of 22 other encryption technologies, to ensure that communications and transactions are shielded from interception and monitoring. A famous dark web marketplace, Silk Road, operated similar to legitimate commercial websites such as Amazon and eBay, but offered illicit goods and services. Law enforcement shut down Silk Road in 2013. Currently operating, popular dark web marketplaces are Monopoly, Dark Market, and White House. b. Cellular “smart phones” can connect to the internet, including the dark web, and can be utilized to manage a drug vendor account as well as conduct digital currency transactions. c. “Vendors” are the dark web’s sellers of goods and services, often of an illicit nature, and they do so through the creation and operation of “vendor accounts.” Customers, meanwhile, operate “customer accounts.” It is possible for the same person to operate one or more customer accounts and one or more vendor accounts at the same time. d. “The Onion Router,” “Tor network,” or simply “Tor,” is a special network of computers on the Internet, distributed around the world, that is designed to conceal the true Internet Protocol (“IP”) addresses of the computers accessing the network, and, thereby, the locations and identities of the network’s users. Tor likewise enables websites to operate on the network in a way that conceals the true IP addresses of the computer servers hosting the websites, which are referred to as “hidden services” on the Tor network. Such “hidden services” operating on Tor have complex web addresses, generated by a computer algorithm, ending in “.onion” and can only be accessed through specific web browser software, including a major dark web browser known as the “Tor Browser,” designed to access the Tor network. One of the logos, or “icons,” for the Tor Browser is a simple image of the Earth with purple water and bright green landmasses with bright green concentric circles wrapping around the planet to look like an onion. e. Some software used to access the dark web does not permanently store images of the websites and or other data that are visited on the computer that is running the software. f. Digital currency (also known as crypto-currency or virtual currency)1 is generally defined as an electronic-sourced unit of value that can be used as a substitute for fiat currency (i.e., currency created and regulated by a government). Digital currency exists entirely on the Internet and is not stored in any physical form. Digital currency is not issued by any 1 For purposes of this affidavit, “digital currency,” “crypto-currency,” and “virtual currency” address the same concept. 3 Case 2:20-mj-00140-CKD Document 1 Filed 09/14/20 Page 5 of 22 government, bank, or company and is instead generated and controlled through computer software operating on a decentralized peer-to-peer network. Digital currency is not illegal in the United States and may be used for legitimate financial transactions. However, digital currency is often used for conducting illegal transactions, such as the sale of controlled substances. g. “Bitcoin” (or “BTC2”) is a type of online digital currency that allows users to transfer funds more anonymously than would be possible through traditional banking and credit systems. Bitcoins are a decentralized, peer-to-peer form of electronic currency having no association with banks or governments. Users store their bitcoins in digital “wallets,” which are identified by unique electronic “addresses.” A digital wallet essentially stores the access code that allows an individual to conduct Bitcoin transactions on the public ledger. To access Bitcoins on the public ledger, an individual must use a public address (or “public key”) and a private address (or “private key”). The public address can be analogized to an account number while the private key is like the password to access that account. Even though the public addresses of those engaging in Bitcoin transactions are recorded on the public ledger, the “Blockchain,” the true identities of the individuals or entities behind the public addresses are not recorded. If, however, a real individual or entity is linked to a public address, it would be possible to determine what transactions were conducted by that individual or entity. Bitcoin transactions are, therefore, described as “pseudonymous,” meaning they are partially anonymous. h. Although they are legal and have known legitimate uses, Bitcoins are also known to be used by cybercriminals for money-laundering purposes and are believed to be the most oft- used means of payment for illegal goods and services on “dark web” websites operating on the Tor network.