Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 1 of 17

AO 9l(Rev 08/09) CriminalComplaint

U NITED STATES D ISTRICT C OURT

forthe
Southern DistrictofFlorida

y
FlLgnj

ns.
,

'

RAq -8 2016

United StatesofAmerica

STEVEN M.G RIMORE

cbER6U S DIST.CT.

CaseNo. 16-8075-JMH

s.D.OFFJ
L/.-W.BB.

PrestonAlexanderMcW aters,
Defendantls)

CRIM INAL CO M PLAINT

1,thecomplainantin thiscase,state thatthefollow ing istruetothebestofmy knowledgeand belief.

Onoraboutthedatets)of 12/11/2015throuqh3/4/2016
inthecountyof
southern
Districtof
Florida
,thedefendantts)violated:

Palm Beach

inthe

CodeSection

OffenseDescription

18U.S.C.j875(c)'
,

Transmission in Interstate Commerce ofa CommunicationofThreatsto

18U.S.C.j 1038

Conveying False orMisleading lnformation Regarding an Expl

osive Device.

InjurethePersonofAnother'
,and

Thiscrim inalcomplaintisbased on thesefacts:

SEE ATTACHED AFFIDAVIT
N

W Continuedontheattachedsheet.

hl.Comp inant'
ssignature

Task Force A en ScottLiben ood FBI

Printedn eand title

Sworn to before meand signed in my presence.

Date:
.

City and state:

W estPalm Beach, Florida

Jud 'ssignature

HonorableJamesHo ins,Uni
tedStatesMa istrate
Printe nameand title

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 2 of 17

A FFID A VIT IN SUPPO RT O F A R RE ST W AR R ANT

YourAffiant,ScottLibengood,doeshereby depose and stateasfollow s:

1.

Iam a lsfederallaw enforcementofficer''within the m eaning of FederalRule of

CriminalProeedure41(a)(2)(C),thatis,a govemmentagentengaged in enforcingthe criminal

laws.lhavebeenemployedasaTaskForceOffceroftheFederalBureauoflnvestigation(FBl)
since 2015,and am currently assigned to M iam iDivision,Palm Beach Office. 1am a federal1aw
enforcementofficerwho isengaged in enforcing erim inallaws,including 18 U .S.
C.jj875and
1038,and 1am authorized by theAttorney Generalto requestan ArrestW arrant.
2.

Ihave probable cause to believe thatPRESTON ALEXANDER M CW ATERS,

white m ale,date ofbirth July 24,1990,has comm itted one orm ore offensesagainstthe United

States,thatis,18 U.S.C.j 875(c),thetransmission in interstatecommerce ofacommunication

ofthreatsto injurethe person ofanother'

,and 18 U.S.C.j 1038,conveyingfalseormisleading
informationregardinganexplosivedevice(i.e.makingfalsebombthreat).
3.

The statem ents contained in this affdavit are based in part on: inform ation

provided to me by FBlSpecialAgents;m itten reportsaboutthisand otherinvestigationsthatl

have received,directly or indirectly,from other 1aw enforcementagents;infonuation gathered
from the service of subpoenas,courtorders,and search warrants;the results of physicaland

eledronic surveillance conducted by law enforcem ent agents; independent investigation and
analysisby FBlagents/analysts and com puterforensie professionals;and m y experience, training

and background as a Task Force Agentwith the FBI. Because this affidavitisbeing submitted
for the lim ited purpose of securing authorization for the requested arrest w arrant, I have not
included each and every factknow n to m e concerning this investigation. lqstead,lhavesetforth

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 3 of 17

only the factsthatIbelieveare necessary to establish thenecessary foundation forthe requested

w arrant.

BA C K G R O UN D O F T H E IN VE ST IG A TIO N A ND PR O BA BLE C A USE

Stalking Report
O n M arch 17,2015,the Oconee County Sheriffs O ffice responded to an address

in W atkinsville,Georgia in reference to a stalking complaint.Upon anival, the deputy m etw ith

the victim Devon Kenney (hereinafterKenney)and hermotherKathryn Cooper. Kermey and

hermother made a complaintthatPreston M cW aters (hereinafter M cW aters),a former coworkerwith Kenney,wasstalking Kenney by calling her,texting her,sending hermessageson
Facebook,and hasbeen showing up attheirhouse.Kenney estimated thatM cW atershadtriedto
eontactherapproxim ately 100 timesthrough telephone orothereledronic com municationsafter
being asked to stop,and that he m ade the statem ent that if he couldn't have her, that no one
could.

5.

Kenney advised the Sheriffs Deputy that M cW aters was outside their house

hiding and w hen K enney cam e outof the garage,M cW aters confronted her. K enney asked him

to leave and he did notuntilthey called the police. Kenney and her mother stated that his

behaviorfrightened them .
6.

The Sheriffs Office located M cW aters,who was residing atthe time, in Bogart,

Georgia. M cW atersadmitted to the SheriffsDeputy thathehad been atKenney'shome butsaid

he rang the doorbelland Kenney cam eout. Further,he adm itted to being asked severaltimesto
leave and thathe did notinitially com ply. M cW atersalleged thathe and Kenney had formally
dated and he w as trying to patch things up.He was told not to have any further contact w ith

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 4 of 17

eitherKenney orhermother. This incidentwas docum ented in a Sheriffs Office report. The

allegationsfrom Kenneyweresufticientto warrantajudgeto issue at:-rhreatProtedion Order''

which prohibitsM cW atersfrom m aking contactwith Kelmey. The Orderisstillin effectand has
been entered into the N CIC system
TwitteraccountEricM ead8z

On Decem ber 11, 2015, a Twitter account was created under the username
CtEricM ead8z''.This accountwasthen used to postseveralhoax bom b threatsto John 1. Leonard
High School and the Palm Beach InternationalAirport, both loeated in Palm Beaeh County,
Florida. Exam plesofthe postingsare asfollows:''The bombsatJohn 1. Leonard high schoolare
going to blow soon!!!M en'
y Christm asyou fucking kids!''and ''1hope palm beach intem ational

airportenjoysthebombslleh forthem l''.

EmailAccountseml8z@ usa.com andemead8z@ usa.com

8.

The Palm Beach Intem ationalA irportgeneralem ailalso received an em ailfrom

eml8z@usa.com on December30,2015,thatread ''Thebombsthatlhaveplaceatpalm beach

intem ational airport are going to blow at 9:30 pm N ew Year's Eve.

The clock is ticking...

H appy new yearfuckersl''.

O n February 2,2016,the Principalof Jupiter High Schoolin Palm Beach County

received an emailfrom emead8z@usa.com,with the following threat: ''lhaveplaced several

bombsatyourschool.They aresetto blow at2:30 pm on W ednesday 02/03/16. You w illalldie
unlessyou do aslsay. lfyou callthe copsthen Iwillhave my friendscome to you house and
they w ill kill your fam ily'
'. This em ail created a panic situation that resulted in the school

having to be evacuated,allthe parents ofthe children had to respond to the schoolto pick up
3

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 5 of 17

theirchildren,and approximately two dozen law enforcem entofficersresponded to search the

school. There was a follow up emailthe nextday stating thatitwas a hoax and the userwas
laughing atthe police.

ThePrincipalofJohn 1.LeonardHigh School,located in Greenacres, Florida,also

received an emailfxom emead8z@usa.com on February 7,2016,thatread ''Ihave placed 5

bom bs containing c4 throughom John 1.Leonard high. l willdetonate the bombs at 1pm on

02/08/16 unless you deliver $500,000 ln cash the the address below. lf you do not comply
within thattime,then lwilldetonate the bom bs and people W ILL die. You have m y demands.
M ake the smartchoice and don'tgetinnocentpeople killed by infonning the police2111W hite
PineCir,AptC GreenacresFlorida33415.''
There w asalso another em ailsentto the sam e PrincipalofJupiterH igh Schoolon

February 17,2016,from nightshade@ engineer.com thatread:''W ehaveplaced 10poundsof(24

plastie explosive around the interior of Jupiter eom munity high sehool. lf you do notbring

$10,000,000.00 in cash to 2500 Via Royale Apt.2508,Jupiter,Fl33458 by 12pm on Friday,

then we willblow up yourschooland everyone inside. Thisisnota negotiabletenn. Don'tbe
heroesand getpeoplekilled. Bring the cash and yoursehoolwillbespared the blood ofinfidels.
Allah Akbar.'' The address provided in the em ailis the realhom e address of Eric M ead and

currentaddrtss ofDevon Kenney. Devon Kenney stated she relocated to Palm Beach County
from Georgia in Aprilof2015 to live w ith herboyfriend Eric M ead.
l2.

A com pany nam ed Kim ley Holm also received an em ail bom b threat from

emead8z@usa.com onJanuary27,2016,whichread ''Ihaveplaced severalpoundsofc4plastic

explosive at one of your offices. 1920 W ekiva W ay Suite 200 W estPalm Beach, Fl33411
4

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 6 of 17

you do notcomply with m y demandsthen Iwilldetonate the bom bs and bring yourbuilding to
the ground w ith everyone inside. lwant$500,000 deliverto the address2111white pine cir,apt

C in greenacres,Florida 33415. Y ou have 24 hours to com ply. lfyou callthe cops or any other
funny businessthen you willcostalotoflives. Don'tdo anything stupid orelse. . . Kaboom !!!''
This em ail resulted in the evacuation of a multi-stol.
y building with many
businesses and employees. The City of W est Palm Beach Police Department and Fire
Departm entresponded and searched the officebuilding.Nothing wasfound.

Interview ofEricM ead

14.

O n Decem ber 30,2015,a fonner A thens, Georgia butnow Palm Beach County

resident named Eric M ead was located and interviewed. M ead denied any know ledge or
involvem entin the creation orow nership of the l'EricM ead8z''Tw itteraccount. How ever,M ead

contirmed the photo attached to the tsEricM ead8z''Twitter account was him . M ead said the

address listed on the Twitterposting,2111 W hite Pine Circle, w as his m other's address.M ead
stated that he works at the Kimley Horn oftsce in W est Palm Beach, Florida, and the k82''
representsM ead'syearofbirth.
On January 21,2016,due to on-going socialmedia postings negatively affecting
hisreputation,EricM ead m adean identitytheftreportto theJupiterFloridaPolice Departm ent.
16.

Currently,EricM ead istheboyfriend ofKenney.

Twitter, Tracfone,and .
dT&T Records

17. On Febnlary 9, 2016, a judicial order requested Twitter, lnc. provide

Account/subscriberlnformation and IP Recordson the tiEricM ead8z''account. O n February 11,
2016,Tw itter,lnc.provided the requested inform ation.Upon review ing the infonnation, itw as
5

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 7 of 17

determined thatthe lEricM ead8z''Twitteraccountwas ereated on December l1, 2015,at 19:01

hours(7:01PM )using AT&T W irelessphonenumber561-797-9156.YourAffiantknowsthat

in orderto create the account,Twitterrequiresveritication by sending eitheran em ailto an email
accountoratextm essageto acellulartelephone.
Additional investigative work and subpoena compliance revealed that 561-797-

9156 was a Tracfone (a prepaid wireless service provider) with cellular phone/data services
being provided by AT&T W ireless.The 561-797-9156 num ber/account was purchased at a
W alm art store on Lexington Road in Athens, Georgia on Decem ber 11,2015 and activated on
the sam e date, and deactivated on January 11, 2016. The nam e registered on the Tracfone
account w as Eric M ead, W est Palm Beach, FL 33415, w ith an em ail address of

emead8z@ usa.com.

second Tracfone, 561-601-3416, was also purchased at the same

W almartstore on January 22,2016,and itwas activated with Tracfone and AT&T on January
24,20l6. The nam e registered on the seeond Tracfone aecount,561-601-3416, w as also Eric
M ead,W estPalm Beach,FL 33415.

19.

W hen he was interviewed, Eric M ead was asked about the first Tracfone

purchase. M ead denied making any Tracfone purchases and stated thathe did notgive anyone
permission to purchasea Tracfone in hisnam e.
20.

Further investigation revealed that Traefone number 561-797-9156 received an

SM S messagefrom 40404 (40404 isa shorteodeto allow mobilephonesto aeeessTwitter)on

December 11,2015,at 19:03 hours (7:03 PM );thiswould indicate Twitterwasverifying the

creation of the account.Cellularrecords subpoenaed from AT&T W ireless revealed that 561797-9156 sentand received SM S m essages to 40404 approxim ately sixteen tim es, approxim ately

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 8 of 17

five ofthose timeswere on December l6,2015,which isthe sam e day thatthe iEricM ead8z''
Tw itter accounthad approxim ately four postings threatening to blow up John 1. Leonard High

School.
Search Klarrants

21.

On February l2,2016,tw o StateofFlorida search warrantswere authorized. The

tirst warrant requested Twitter Inc.to disclose a1l information regarding the ktEricM ead8z''
accountand a second Twitteraceountunderthe nam e ''M eadLewis''. Both ofthese accounts
were made using the sam eprotilepidureoftherealErie M ead. The realErie M ead saidthatthe
picture may have been copied from anothersocialm edia accountthathe had created before he

moved to Florida called Linkedln. The second warrantrequested Facebook lnc. to disclose a11
inform ation regarding an ''Eric M ead''accountwhich had been created with the same profile
picture used in the fake Eric M ead Twitter accounts and was now being used to send death
threatsto K enney.

Lewis is the fonner last nam e of the real Eric M ead before he had it legally
changed.Thisnew StM eadlwewis''accountwasused to makepostingsofdeath threatsdirected at
Kenney. The ''M eadLew is'' Tw itter account w as used to send several m essages to Kenney's
Tw itter accountone of w hich read ''your going to fucking die you cuntbitch, lw antto hearyou

scream while Iskullfuck you,you psychotic whorel''. The fake Facebook ''Eric M ead''account
wasused to send severaldeath and rape threalm essagesto Kenney'sFacebook account,one of
w hich read: ''They are going to com e to your house in Florida and are going to rape and kill
you... You disgusting fuck slut. l've paid them w ell. Your gonna suffer.''U nlike the other
m essages sent,thism essage sentthrough Facebook show sthatitw asposted via m obile.

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 9 of 17

YourAffantbelievesthatthe suspectisusing both a com puterand atelephone to

send these death threats.
24.

On February 22, 2016,Tw itter lnc.provided the follow ing inform ation: a new

telephone number,561-601-3416,had been used in the creation ofthe ilM eadlwewis''accounton

January25,2016,alongwiththeemailemead8z@usa.com.
WalmartPurchasesofthe Tracfones
W almartsecurity investigatorshave been able to identify the store security video
of the tinaneialtransadions for the purehases of the two Tracfones. They have supplied the
transadions and the video to the FBI. Upon looking atthe stillphotographs ofthe individual
m aking the purchases,the suspectappears to be a w hite m ale, m edium build,20 to 30 yearsof
age,w ith slightfacialhair. He appears to be w earing the sam e hatin both ofthese transactions,

possibly a tan colored baseballhatwith the University of Georgia em blem on it. ln the first

transaction,heappearsto bewearing aratheruniquejacket,onethatisablack and camouflage

pattern. ln the second transaction,the suspectcan be seen leaving the store driving a newer
m odelreddish in colorChevroletCam aro.
26.

On February 24,2016,W alm artsecurity from Athens, Georgia contacted the FBI.

They had been instructed to be on the lookoutforthe individualreturning to the W alm art. O ne
ofthe security officersthathad reviewed the video tape and waslooking outforthe suspectwas

outsideW almartataShellgasstationatCollegeRoad andBarnet'tSholasRoad inAthens(Your

Affiant knows thatthis road is near the subdivision where M cW aters resides). The security
officer observed the individual at that gas station/store and identitied him from the video
surveillance from W almart. The security officertook a picture ofhim and his carwith the tag
8

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 10 of 17

number and sentitto the FBI. ltshould be noted thatW almartseeurity personnelwere never
advised of the suspect's name,Preston M cW aters or the tag num ber of M cW aters Chevrolet
Cam aro. W alm artsecurity m ade the identification on theirow n. Thetag num berofthe vehicle

that they identified is identical to M cW aters' tag number,Georgia plate num ber CEG9185.
Georgia DM V records show that this tag is registered to Preston M cW aters and his mother
AnnettePhelabaum ,155 SnapfingerLane,Athens,Georgia.
27.

Y our A ffiant has review ed the G eorgia Driver's License photograph of Preston

M cW aters,white male date ofbirth July 24,1990,and compared itto the photos ofthe susped
purchasing the phones at W alm art. The suspect looks like M cW aters. Investigation has also

revealed that the house located at 155 Snaptsnger Lane in Athens, Georgia, is ow ned by
M cW aters'mother,Phelabaum ,however,M cW atershasthisaddressashisplaceofresidence in
num erous databases.

Surveillance OfSUBJECT PREM ISES

28.

On or about February 22, 2016, the FBI in Athens conducted a drive by

surveillance ofthishouse and located M cW aters red Camaro atthis address. Your Affianthas
conducted a googlem aps search and hasdeterminedthatthere are threeW almartsin the Athens,
Georgia area. The W alm arton Lexington Road where the Tracfones w ere purchased is the
closestone to M cW aters house,itisapproxim ately 5 m ilesaw ay.

29.

On February 29,2016,FBI Agents conducted surveillance of 155 Snapfinger

Lane. D ue to the ruralnature of the neighborhood,the A gents w ere unable to setup directly in

frontofthehome. TheAgentswere ableto seefrom adistancethatasubjectwho matchesthe

description ofPreston MeW aters,(and based upon a1ltheknown facts,YourAftiantbelievesis
9

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 11 of 17

McW aters),did comeoutoftheresidenceand droveawayin McW aters'red in colorChevrolet

Camaro atapproxim ately 5:15 am . TheAgentsfollowed him to theUniversity ofGeorgiawhere
hestayed forthe day apparently working. They then followed him back to 155 SnapfingerLane
thatafternoon.

EmplovmentofM cWaters

YourAffianthasalso learned through the University ofGeorgia (UGA)Police

Departm entthat M cW aters works atUGA in the dining hall in Athens, G eorgia. The U GA
police have provided a copy ofM cW aters work schedule and itshowsthathe worksas early as
5:55 am .

CellSiteLocation from Tracfones

On February 22,2016,a Florida state courtorder requested thatAT& T provide
tollrecordsand cellular site location data forthe tirsttargettelephone, 561-797-9156. On that
sam e day,A T& T responded w ith the requested inform ation. The FBl conducted a cell phone

analysisofthe data and provided the following response: The resultswere thattargettelephone
561-797-5156 connected to the cellular towers 28 tim es. O f those 28 tim es, 24 times (on

12/11/2015and 12/15/2015)thecelltowerlocation data showed thatthetargettelephonewasin

the geographicalarea of 155 SnapfingerLane,Athens,Georgia. The remaining 4 times(on

12/16/2015),the targettelephone wasin the geographicalarea ofthe University ofGeorgia in

Athens. Those dates are significant because D ecem ber 11th 2015 w as the date the phone was

purchased,activated,and used to create the fake ''EricM ead8z''Twitteraccount. D ecem ber 15tb5
2015 was the date that the firsttw o m essages w ere posted on the ''EricM ead8z''account which
were generalin nature and it appeared that the suspectw as testing the account. D ecem ber 16th5

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 12 of 17

20l5 issignitseantbecause thatwasthe date thatthe firstbom b threatsto John 1.Leonard High
Schoolwereposted.
32.

On February,25,2016,a state courtorderrequested thatAT&T provide cellsite

records on the second Tracfone, 561-601-3416. These records show that the target telephone
connected to Tw itter via textm essaging to 40404 tw o tim es on January 25,2016, which w asthe

creation dateofthe second fake Eric M ead Twitteraccount''M ead Lewis''.The FBIconducted a
cellphoneanalysisofthe data and provided the following response: The resultswere thattarget
telephone 561-601-3416 connected to the sam e cellular tow ers as did the previous target
telephone,this tim e a totalof 14 tim es on January 24,2016, and onee on January 29,2016. Of
the 14 tim es on January 24th, the ce11tow er location data show ed thatthe targettelephone w as in
the geographical area of 155 Snapfinger Lane,Athens,G eorgia. The rem aining one tim e, the
phone w as in a geographicalarea south w estofAthens.
IP Addresses
33.

During the course ofthe investigation,subpoenas and search w arrants have been

directed to variouscompaniesin an attemptto identify the internetprotocol(IP)addressfrom

where the emailm essagesare being sent. One ofthe companies identified is 1& 1,who is the

domain holder of numerous free email accounts including @ usa.com, @techie.com, and
@ engineer.eom. The response from Facebook showed thatthe aceountwascreated using an
emailaddressoferic8z@ techie.com . Alloftheresponsesfrom l&1,Facebook,Twitter,and
Tracfone have been traced by IP address back to a com pany nam ed London TrustM edia dba
privateinternetaccess.com . This com pany isan anonym izing com pany whose pum ose isto allow

users ofthe internetto m ask their originalIP address w here they are sending m essages from .

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 13 of 17

subpoena was senttt?London TrustM edia and the only information they eould provide isthat
the cluster of IP addresses being used w as from the east eoast of the U nited States. How ever,

London Trustdid providethatthey acceptpaym entfortheirservicesthrough creditcard with a

vendorcompany ofStripe and/orAmazon. They also acceptforms ofpaym entonline through
paypal,bitpay,bitcoin,cashyou,ripple,ok pay,and pay garden.
Although the investigation hasnotrevealed any paymentby M cW atersto London
Trust, he did m ake a purchase from AnchorFree 1nc on O ctober 23, 2015. A nchorFree,

according to their website,is a HotspotShield VPN (virtualprivate network) service that

itprotectsyourIP address,enabling you to surftheweb anonym ously and privately''.
BankRecords
On February 29,2016,a subpoena w as sentto the FirstM adison Bank in Athens,

Georgia requesting banking records for Preston M cW aters. FirstM adison responded with the
requested infonnation. The banking records show thatM cW aters listed his address as the 155
Snaptinger Lane in Athens, Georgia. The banking records also show that on Decem ber 11,

2015,M cW aters m ade a cash withdrawalof $80.00 and on January 22,2016,he m ade a cash
withdrawalof$60.00. These datesaresigniticantbecause these are the exactsame datesthatthe
prepaid Tracfonesdiscussed previously in thisafidavitwere purchased from W alm artin Athens

with eash. On the January 22,20l6,transaction,thecashtendered attheregisterwas$60.00,the

exad am ount that M cW aters withdrew from his bank account that day.First M adison also
provided video surveillance photos of M cW aters m aking the withdrawals on those two dates.
On Decem ber 11tb, the photo show s M cW aters face directly in front of the cam era m aking the
w ithdraw alat 11:44 am . In the photo you can also see thathe isw earing sunglasses, ablack and

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 14 of 17

camouflagecoloredjacket,andabaseballstylehatwiththeUniversity ofGeorgiaemblem on it.

H e is driving a dark eolored Jeep SU V . This elothing m atches the deseription of the clothing

worn by the suspectpurchasing the firsttracfone referred to in this affidavit,561-797-9156, at

the W alm artstore on this sam e date at 12:11 pm . Therefore,your A ffantbelieves that it was

M cW aters who purchased the Tracfone on December 11,2015. The FBltook a picture of 155
Snapfinger Lane while conducting surveillance on February 29,20l6. M cW aters'red in color

Cam aro and a dark colored Jeep SUV were parked in the drivew ay. The video surveillance
photos also show the transaction that occurred on Janual'y 22,2016. A t 8:14 am .M eW aters

dxivesup lo the ATM in hisred in colorCam aro.The camera angle did notcapture a picture of
his face because the vehicle sits too low to the ground. How ever, the vehicle m atches the

description ofthe vehicle thatthe suspectdrove to W alm arton thatsame day to purchase the
second Tracfone referred to in this aftidavit, 561-601-3416, at 10:04 am . Based on the

surveillanee video from the bank and W alm art,yourAffantbelievesthatitwasM cW aterswho

purchased the second Tracfone on January 22,2016.
Activity O rl-etpp.e
.

On M arch 4,2016,at 1:03 am ,the principalofa Palm Beach County Elem entary

schoolreceived anemailfrom DevonKenneyg4@ mail.com thatstatedthefollowing: kWehave

plaeed 13 chemicalweaponsthroughoutyourfacilities.They willdetonate at10:30 a.m .M arch

7,2016 ifyou do noteomply with ourdemands and bring $20,000,000.00 to 2500 Via Royale
Apt.2508.Jupiter,FL 33458 by the tim e ofdetonation. lfyou even try to contactthe authorities
and alertthem to the situation then w e w illdetonate the w eapons early and everyone of your
students w illdie. You have 4 days.Do not fuck w ith us!W e are w atching you kkLeslie Bolte''

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 15 of 17

and yourfam ily.''

Search ofResidence
37.

On M arch 7, 2016, a federal search warrantwas signed by a United States

M agistrate Judge in the M iddle Districtof Georgia authorizing the search of 155 Snapfinger
Lane in A thens, Georgia. O n M arch 8, 2016, FB I A gents executed the search w arrant.

M cW aterswaslocated in hisbedroom and in hispossession washisApple iphone.Upon gaining

aeeessto the iphone,a mobile application forPrivate InternttAccess (PIA)was discovered.

Private IntenwtAccessisa VPN (VirtualPrivateNetwork)providerthatspecializesin secure,
encrypted VPN tunnels which create several layers of privacy and security.Private Internet
Access is affiliated with London TrustM edia.A11em ailaddresses responsible for the emailed
bom b threatswere em ailaddresses owned by London TrustM edia.A search ofM cW aters'red
Chevrolet Cam aro revealed tw o LG m odel=ar chargers.These car chargers are notcom patible

with M cW atersiphone and are believed to be the carchargersforthetwo TracFonespurchased

by M cW aters. Also in the vehicle was a note with the following information: PlA .com

U sem am e:p6808444,Passw ord:ZPDN 9YhkAe.M cW aters'w allet,to include his identification,

wasin thered Cam aro.

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 16 of 17

CONCLUSION
38.

Based on theforegoing,there isprobableeauseto believe thatthefederalerim inal

statutes cited herein have been violated by PRESTON ALEXANDER M CW ATERS and that
suftivientevideneehasbeen presented to authorize an arrestwarrant. lrespectfully requestthat
this Courtissue an arrestw arrantforPRESTON A LEXA N D ER M CW ATER S.

Respectfu y subm itted,

g

ScottLlben OX

Task Force O fticer

FederalBureau oflnvestigation

subscribedandswol.
ntobeforemeonthis S''dayofMarch,2016

y
N O RA BLE JA M ES M . PKIN S
UN ITED STA TES M AG ISTR ATE JU DG E

Case 9:16-mj-08075-JMH Document 1 Entered on FLSD Docket 03/08/2016 Page 17 of 17

U N ITED STA TES D ISTR IC T C O U R T

SOUTH ERN DISTRICT OF FLORIDA
C ase N o.:16-80754 M 11

FILED BY

UNITED STATES OF AM ERICA,

MA2 23 21s

V.

STEVEN M.1.
.
/91:408E
CLERK U.
S DIST CT,
S.D OF FLA ,i%PB

PRESTO N A LEX AN D ER M CW AT ER S,
D efendant.

COVER SHEET
Didthism atteroriginatefrom am atterpendingintheNorthern RegionoftheUnited States
Attorney'sO ffice priorto O ctober 14,20032
Y es
X
No
2.

D id this m atteroriginate from a m atterpending in the CentralRegion ofthe United States

Attorney'sOfficepriorto September1,2007?
Yes
X
No
Respectfully subm itted,
W IFREDO A .FERRER
UN ITED STATES ATTO

EY

By:
*
Edw ard C.N ucci
A ssistantU nited StatesA ttorney

FloridaBarNo.794406
United StatesAttorney'sOffice
Southern D istrictofFlorida
500 S.A ustralian A venue,Suite 400
W estPalm Beach,Florida33401

Teleghone:(561)820-871l
Facslmile:(561)805-4986

Em ail:Edward.Nuccirg,usdoi.gov

D.C.