Dezenove cidadãos brasileiros foram acusados por meio de queixas criminais de envolvimento em uma conspiração em todo o país para criar contas fraudulentas de motoristas com várias empresas de serviços de compartilhamento de viagens e entrega usando identidades roubadas e de alugar contas ou vender para motoristas que de outra forma não se qualificariam para dirigir. Quadrilha ainda buscava vender “bot” para pegar melhores corridas, veja íntegra da investigação abaixo.
O esquema alegado também envolveu o uso de contas fraudulentas para explorar os programas de bônus de referência da empresa e o uso de “bots” automatizados e tecnologia de falsificação de GPS para aumentar a receita obtida com as contas de motorista fraudulentas. O governo estima que as identidades de mais de 2.000 vítimas foram roubadas e usadas como parte do esquema.
Vítimas
Se desejar determinar se um 1099 foi emitido em seu nome, você pode utilizar a página da web do IRS, https://www.irs.gov/individuals/transcript-types-and-ways-to-order-them, para Solicite uma Transcrição de Salários e Receitas de documentos que identifiquem se um 1099 foi emitido em seu nome.
As informações do ano fiscal atual podem não estar completas até julho. Se você descobrir que um 1099 foi emitido em seu nome de forma fraudulenta e deseja determinar se ele está associado ao caso, envie um e-mail para USAMA.VictimAssistance@usdoj.gov e forneça seu nome e melhores informações de contato e um membro da Victim Witness Unit entrará em contato com você a respeito deste caso.
Status do caso
As informações sobre os processos judiciais serão atualizadas nesta página à medida que se tornarem disponíveis ao público.
7 de maio de 2021 –
Os réus presos hoje farão uma primeira aparição virtualmente no distrito onde foram presos. Se você deseja ver o processo que está ocorrendo no Tribunal Distrital dos Estados Unidos do Distrito de Massachusetts, você deve se inscrever usando o link abaixo.
https://forms.mad.uscourts.gov/courtlist.html
5 de maio,
2021 – Wemerson Dutra Aguiar foi detido após sua prisão e comparecimento inicial no Tribunal Distrital dos Estados Unidos do Distrito Norte de Illinois.
Como evitar ter seus dados utilizados
O Ministério Público dos Estados Unidos gostaria de informar que você não é obrigado a permitir que um entregador tire uma foto de sua identificação se você tiver entrega de álcool.
Embora os motoristas de entrega possam ser solicitados a verificar sua idade, não é obrigatório que eles tirem uma fotografia da frente de sua carteira de motorista ou de identificação para que você receba a entrega.
Certifique-se de revisar as políticas individuais da loja para entrega e entre em contato com a empresa da qual você fez o pedido, caso acredite que a entrega não ocorreu conforme o esperado.
Você pode aprender mais sobre as maneiras de evitar o roubo de identidade em identitytheft.gov.
Quem são os brasileiros presos
Os seguintes réus foram presos e acusados por ação criminal com uma acusação de conspiração para cometer fraude eletrônica:
- Wemerson Dutra Aguiar, 25, brasileiro residente em Lynn e Woburn, Massachusetts;
- Priscila Barbosa, 35, brasileira residente em Saugus, Massachusetts;
- Edvaldo Rocha Cabral, 41,um brasileiro residente em Lowell, Massachusetts;
- Clovis Kardekis Placido, 37, brasileiro residente em Citrus Heights, Cali.;
- Guilherme Da Silveira, 28, brasileiro residente em Revere, Mass.;
- Flavio Candido Da Silva, 35, brasileiro residente em Revere, Massachusetts;
- Altacyr Dias Guimarães Neto, 34,brasileiro residente em Kissimmee, Flórida;
- Bruno Proencio Abreu, 28, brasileiro residente em Saugus, Massachusetts;
- Jordano Augusto Lima Guimarães, 34, brasileiro residente em Salem, Massachusetts;
- Alessandro Felix Da Fonseca, 25, brasileiro residente em Revere, Massachusetts;
Investigação na íntegra, em inglês.
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 1 of 68
AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT AND SEARCH WARRANTS
I, TERRENCE DUPONT, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
- I have been a Special Agent with the Federal Bureau of Investigation (“FBI”) since
April 2013. I am currently assigned to the Economic Crimes squad with the Boston Division of
the FBI. Prior to this assignment, I spent two years on the Health Care Fraud squad and four and
a half years on the Philadelphia Division’s Public Corruption squad. During my time in the FBI,
I have participated in investigations relating to mail and wire fraud, money laundering, and
aggravated identity theft. I have also been the affiant on numerous complaint and search warrant
applications. - I am currently investigating the following individuals (collectively, the
“defendants”) for various federal crimes, including mail fraud, wire fraud, and conspiracy to
commit those crimes, in violation of Title 18, United States Code, Sections 1341, 1343 and 1349,
respectively; aggravated identity theft, in violation of Title 18, United States Code, Section 1028A;
and money laundering and conspiracy to commit money laundering, in violation of Title 18, United
States Code, Sections 1956 and 1957 (collectively, the “TARGET OFFENSES”):
a. PRISCILA BARBOSA, a Brazilian national residing in Saugus,
Massachusetts;
b. EDVALDO ROCHA CABRAL, a Brazilian national residing in Lowell,
Massachusetts;
c. CLOVIS KARDEKIS PLACIDO, a Brazilian national residing in Citrus
Heights, California; Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 2 of 68
d. Defendant D , a Brazilian national formerly
residing in Burlington, Massachusetts;
e. GUILHERME DA SILVEIRA, a Brazilian national residing in Revere,
Massachusetts;
f. Defendant F , a Brazilian national currently residing in
Boca Raton, Florida, and who previously resided in Revere, Massachusetts;
g. Defendant G , a Brazilian national who previously
resided in Revere, Massachusetts;
h. FLAVIO CANDIDO DA SILVA, a Brazilian national residing in Revere,
Massachusetts;
i. ALTACYR DIAS GUIMARAES NETO, a Brazilian national residing in
Kissimmee, Florida;
j. Defendant J , a Brazilian national
residing in Daly City, California;
k. Defendant K , a Brazilian national residing in Daly City,
California;
l. Defendant L , a Brazilian national residing in
Hercules, California;
m. BRUNO PROENCIO ABREU, a Brazilian national residing in Saugus,
Massachusetts;
n. JORDANO AUGUSTO LIMA GUIMARAES, a Brazilian national
residing in Salem, Massachusetts;
2 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 3 of 68
o. Defendant O , a Brazilian national residing in
Shrewsbury, Massachusetts;
p. ALESSANDRO FELIX DA FONSECA, a Brazilian national residing in
Revere, Massachusetts;
q. Defendant Q , a Brazilian national
residing in Watertown, Massachusetts; and
r. Defendant R , a Brazilian national residing in Wheeling,
Illinois. - I make this affidavit in support of a criminal complaint charging the defendants
with conspiracy to commit wire fraud, in violation of Title 18, United States Code, Section 1349.
As set forth below, I have probable cause to believe that the defendants conspired with others
known and unknown: (1) to open driver accounts with various rideshare and delivery service
companies using stolen identities and/or falsified documents; and (2) to make money by renting
or selling those fraudulent accounts to individual drivers who might not otherwise qualify to drive
for those services, and by exploiting referral bonus programs offered by the companies. - I also make this affidavit in support of an application for search warrants for the
following premises because there is probable cause to believe that they contain fruits, evidence,
and instrumentalities of the TARGET OFFENSES, as described in Attachment B:
a. Rock Wood Drive, Saugus, Massachusetts (the “BARBOSA/ABREU
RESIDENCE”), as described in Attachment A-1; and
b. Stone Lane, Apt. 5139, Malden, Massachusetts (the “DA SILVA”
RESIDENCE), as described in Attachment A-2.
3 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 4 of 68 - The facts in this affidavit come from my personal observations, my training and
experience, information obtained from other agents and witnesses, and my review of documents—
including bank records, text messages and “chats” between and among the defendants, and other
materials obtained through legal process and Court-authorized search warrants. This affidavit is
intended to show simply that there is sufficient probable cause for the requested complaint and
search warrants and does not set forth all of my knowledge about this matter.
PROBABLE CAUSE TO BELIEVE THAT FEDERAL CRIMES WERE COMMITTED
Overview of the Conspiracy - Beginning by at least 2019 and continuing through at least April 2021, in the
District of Massachusetts and elsewhere, the defendants conspired with one another and with
others known and unknown to create fraudulent driver accounts with multiple rideshare and
delivery companies (the “Rideshare/Delivery Companies”), and to rent or sell the accounts to
individuals who might not otherwise qualify to drive for those services. The evidence I have
reviewed indicates that the scheme included the following:
a. Obtaining images of victims’ driver’s licenses, or the information on
victims’ driver’s licenses, and Social Security Numbers, from various sources including
the DarkNet1
;
b. Creating accounts to drive for the Rideshare/Delivery Companies using
those stolen identifiers;
1
The DarkNet is part of the Internet that is not indexed and consists of overlaying networks
that use the public Internet but require unique software, configuration, or authorization to access,
which is predominately designed to hide the identity of the user. Payment for goods and services
on the DarkNet is usually through virtual currency like bitcoin, which is also designed to be
anonymous.
4 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 5 of 68
c. Renting or selling those accounts, including to people who might not
otherwise qualify to drive for the Rideshare/Delivery Companies;
d. Coordinating on prices charged to rent and sell accounts so as not to
undercut each other’s business;
e. Sharing tips about how to circumvent the Rideshare/Delivery Companies’
fraud detection systems;
f. Causing the Rideshare/Delivery Companies to generate Internal Revenue
Service Forms 1099 in the names of the identity theft victims for income they never earned,
and attempting to divert those Forms 1099 from being sent to the victims;
g. Using fake driver accounts for the purpose of referring other drivers to the
Rideshare/Delivery Companies, and then collecting referral bonuses from the companies
for additional fake accounts that the conspirators created;
h. Utilizing global positioning system (“GPS”) “spoofing” applications to “cut
the line” for rides or deliveries, or to make it appear that trips were longer than they actually
were, in order to obtain increased fares from the Rideshare/Delivery Companies, and
selling this technology to drivers. - In renting or selling accounts, the conspirators either had payments from the
Rideshare/Delivery Companies deposited directly into their accounts, and then transferred the
payments—less their cut—to the subjects using the fraudulent accounts, or they had payments
deposited directly with the subjects using the fraudulent accounts, and collected weekly rental
payments, usually between $250 and$300 per week for Rideshare Companies, and $150 per week
for Delivery Companies. The conspirators charged more for fraudulent accounts for which they
edited the driver’s photograph onto the driver’s license that they used to open the account.
5 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 6 of 68 - To date, investigators have identified more than 2,000 individuals whose identities
were stolen and used as part of the scheme.
Background on the Rideshare/Delivery Companies - Rideshare Company A is a ride-hailing company that connects drivers with riders
via a mobile phone application (“app”). To become a driver for Rideshare Company A in
Massachusetts, applicants must be at least 21 years old, have at least one year of driving history
(three years if under age 23), and pass a motor vehicle and criminal background check. Drivers
apply through Rideshare Company A’s app or its website and provide, among other things, their
name, date of birth, Social Security number, an image of their driver’s license, automobile
registration and insurance information, and a profile photo. Drivers must also pass a separate
background check run by the Massachusetts Department of Public Utilities (“DPU”). Rideshare
Company A stores the information applicants enter on servers which are located outside the
District of Massachusetts. - Delivery Company B is an online food ordering and delivery service. To become
a driver for Delivery Company B in Massachusetts, drivers applying to deliver via automobile
must be at least 18 years old, have at least one year of driving history, and pass a motor vehicle
and criminal background check.2 Drivers apply through Delivery Company B’s app or its website
and provide, among other things, their name, date of birth, Social Security number, and profile
photo. Drivers applying to deliver via automobile must also provide an image of their driver’s
2
Some of the Delivery Companies allow drivers to deliver via bicycle or on foot in certain
locations.
6 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 7 of 68
license. Delivery Company B stores the information applicants enter on servers which are located
outside the District of Massachusetts. - Rideshare Company C is a ride-hailing company that connects drivers with riders
via a mobile phone app. To become a driver for Rideshare Company C in Massachusetts,
applicants must be at least 25 years old, possess a valid driver’s license, Social Security number,
and vehicle insurance, have at least one year of driving history, and pass a motor vehicle and
criminal background check. Drivers apply through Rideshare Company C’s app or its website and
provide, among other things, their name, date of birth, Social Security number, an image of their
driver’s license, their automobile insurance information, and a photo of themselves (“selfie”).
Drivers must also pass a separate background check run by the DPU. Rideshare Company C stores
the information applicants enter on servers located outside the District of Massachusetts and
operated by Amazon Web Services. - Delivery Company D is an online food ordering and delivery platform. To become
a driver for Delivery Company D in Massachusetts, drivers applying to deliver via automobile
must be at least 18 years old, have a valid Social Security number, and pass a motor vehicle and
criminal background check. Drivers apply through Delivery Company D’s website and provide,
among other things, their name, date of birth, and Social Security number. Drivers applying to
deliver via automobile must also provide their driver’s license number (but not an image of their
license). Delivery Company D stores the information applicants enter on servers located outside
the District of Massachusetts and operated by Amazon Web Services. - Delivery Company E is an online grocery delivery and pick-up service platform.
To become a driver for Delivery Company E in Massachusetts, drivers must be at least 18 years
old and pass a motor vehicle and criminal background check. Drivers apply through Delivery
7 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 8 of 68
Company E’s website and provide, among other things, their name, date of birth, Social Security
number, image of their driver’s license, and a “selfie” photo. Delivery Company E stores the
information applicants enter on servers located outside the District of Massachusetts and operated
by Amazon Web Services. - When a driver account is opened, the Rideshare/Delivery Companies generally
collect metadata concerning, among other things, the device used to open the account, its location,
the Internet Protocol (“IP”) address used to submit the applicant’s information, and whether the
account was referred by another driver. - Each of the Rideshare/Delivery Companies uses a third-party company to complete
the motor vehicle and criminal background check on driver applicants. This company runs the
motor vehicle and criminal background check based on the name, date of birth, and Social Security
number provided by the driver applicant. - The DPU also completes a two-part background check for rideshare drivers in
Massachusetts. For Rideshare Company A and Rideshare Company C, the DPU runs its check
based on the name, date of birth, driver’s license number, and last six digits of the Social Security
number provided by the driver applicant. The DPU completes follow-up background checks on
all Rideshare Company A and Rideshare Company C drivers in Massachusetts every six months
based on this same information. - None of the Rideshare/Delivery Companies requires that the vehicles used for rides
or deliveries be registered to the driver. It is not uncommon for drivers to use a vehicle registered
to someone else. - The Rideshare/Delivery Companies occasionally offer referral bonuses depending
on market conditions. To earn a referral bonus, existing drivers who are in good standing can refer
8 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 9 of 68
another person to become a driver for the company. Once the referred driver completes a set
number of trips, which varies by company and market, the referring driver (and, at some
companies, the referred driver) can earn a bonus. The amount of the bonus depends on the
company and the market and can be greater than $1,000. - One way that the Rideshare/Delivery Companies pay their drivers is via direct
deposit.3
Payments generally, but not always, appear on bank statements with the name of the
driver who purportedly completed the trip or delivery. - The Rideshare/Delivery Companies utilize various fraud detection systems. For
example, Rideshare Company A periodically requires drivers to upload “selfie” photos to the app,
which are compared to the driver’s profile and license images. The defendants and other
conspirators attempted to circumvent these fraud detection systems in multiple ways, including by
(a) editing the images on victim’s licenses to depict the subject driving under the fraudulent
account, rather than the victim, (b) having subjects who used the fraudulent accounts keep a
printout of the victim’s face with them to use when prompted for a “selfie,” or (c) editing their
own photo onto the victim’s license and using GPS “spoofing” technology to make it appear the
“selfie” they took matched the location of the subject driver when the subject was prompted to
upload a “selfie.”
WEMERSON DUTRA AGUIAR - AGUIAR’s role in the scheme is described in my May 5, 2021 Affidavit in Support
of Criminal Complaint and Search Warrant (the “May 5 Affidavit”), attached to this Affidavit as
Exhibit 1.
3
Some of the companies also offer a debit card option for payment.
9 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 10 of 68 - In the May 5 Affidavit, I stated, based on my review of draft summary translations
of WhatsApp chats conducted predominantly in Portuguese between and among AGUIAR and
various conspirators, that the conspirators used templates of various states’ driver’s licenses,
editing the victims’ information and importing photos of the drivers who rented or purchased the
fraudulent accounts from them.4
AGUIAR discussed manipulating driver’s licenses with, among
others, GUIMARAES NETO and Defendant J . For example, as set forth below, AGUIAR
sent images of victims’ driver’s licenses to GUIMARAES NETO, and GUIMARAES NETO sent
back three stock images of the edited licenses either resting on a wallet or being held in a hand.
Likewise, as set forth below, Defendant J requested that AGUIAR send him a template for
a Massachusetts driver’s license so that he could use it to create bogus license images.
Additionally, BARBOSA emailed AGUIAR an attachment with a file name “Connecticut driver’s
license.zip.” While I have not been able to open the attachment to the email from BARBOSA, I
am aware that, later that day, AGUIAR sent the same file via WhatsApp to another conspirator,
and this file opens to an image of a Connecticut driver’s license. - AGUIAR also discussed creating fraudulent driver’s accounts with GUIMARAES
NETO and Defendant J , as further detailed below, and discussed exploiting referral bonuses
with conspirators, including, as detailed herein, GUIMARAES NETO.
4
WhatsApp is a text messaging application that provides users with end-to-end encryption,
which means that a WhatsApp message is visible only to the sender and receiver of the message.
WhatsApp also allows users to send and receive voice recordings. WhatsApp users typically use
their phone number as their WhatsApp account number to send and receive messages through the
application.
10 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 11 of 68
PRISCILA BARBOSA - As part of the scheme, BARBOSA prepared and submitted applications using
fraudulent identifiers; rented and sold driver accounts; purchased and traded driver’s licenses,
Social Security numbers, and driver’s license templates; fraudulently obtained referral bonuses
from the Rideshare/Delivery Companies; and exchanged information with other conspirators about
how to circumvent the Rideshare/Delivery Companies’ fraud detection systems. - For example, information provided by Rideshare Company A indicates that on or
about April 10, 2019, a bogus account in the name of Victim 3 (“Account 3A”) was created by a
device named “iPhone de Priscila Barbosa.”5 A “selfie” photo uploaded with the account appears
to be BARBOSA, based on my review of the photograph of BARBOSA on her United States visa.
Information provided by Delivery Company B indicates that on or about the same date, a driver
account was created in the name of Victim 3 (“Account 3B”), containing a different “selfie” of
BARBOSA. The driver’s license associated with Accounts 3A and 3B appears to be a picture of
Victim 3’s actual license. BARBOSA and Victim 3 are similar in appearance. The vehicle
associated with Accounts 3A and 3B was registered to BARBOSA and another individual at
Founders Way, Saugus, Massachusetts. That address is located in the Residences at Stevens Pond
apartment complex. According to records from the management company for the Residences at
Stevens Pond, BARBOSA rented an apartment at a different address in the Residences at Stevens
5
To avoid confusion, I have continued the victim numbering system from the May 5
Affidavit, which addressed Victim 1 and Victim 2. Account have been numbered to correspond
to the number assigned to the victim in whose name the account was created. I have also continued
the co-conspirator numbering system from the May 5 Affidavit, such that references to “CC-2” in
the May 5 Affidavit concern to the same person referenced as “CC-2” in this Affidavit.
11
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 13 of 68
registered to BARBOSA.6 Victim 5 reported receiving an IRS Tax Form 1099 for income
purportedly earned working for Rideshare Company A, despite the fact that Victim 5 never worked
for Rideshare Company A. - I have reviewed BARBOSA’s iCloud account pursuant to a Court-authorized
search warrant. Among other items, I located hundreds WhatsApp chats, mostly in Portuguese, in
which BARBOSA corresponded with individuals seeking to rent or buy driver accounts. - The BARBOSA iCloud Account also contained Excel spreadsheets listing names,
email addresses, birthdates, Social Security numbers, and/or driver’s license numbers for hundreds
of individuals. Two tabs in one such spreadsheet were labeled with the names of Delivery
Company D and Delivery Company E. Certain entries are labeled “aprovada” (Portuguese for
“approved”), “suspenso” (Portuguese for “suspended”), “reprovado” (Portuguese for “failed”), or
with the name of the company that runs background checks for the Rideshare/Delivery Companies. - Certain names and email addresses appearing in the spreadsheets were used to open
fraudulent driver accounts. For example, one email address (which includes part of Victim 6’s
name, which I have redacted with “X”), “XXXXXdd2003@protonmail.com,” was used to open
an account (“Account 6”) with Delivery Company D in the name of Victim 6 on or about
December 9, 2019.7
Account 6 was linked to BARBOSA’S Bank of America account. Bank
statements indicate that, between January and May 2020, BARBOSA received $43,500 in deposits
from Delivery Company D in the name of Victim 6. According to Delivery Company D’s records,
6
Venmo is a mobile payment service owned by PayPal that allows account holders to
transfer funds to others via a mobile phone application.
7
ProtonMail is an encrypted email service.
13 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 14 of 68
Account 6 did not complete any deliveries. Rather, it appears Account 6 was created solely to
receive payments from Delivery Company D’s referral bonus program. - The BARBOSA iCloud Account also contained items in the Notes app listing many
similar email addresses structured as “[victim’s name]dd[number]@protonmail.com” along with
corresponding Social Security numbers, dates of birth, and passwords. Other Notes list names of
drivers, the Rideshare/Delivery Companies for which BARBOSA created an account for that
driver, and what appears to be the name of the conspirators with whom she shared the account,
such as ABREU, Co-Conspirator 5 (“CC-5”), and others. Still other notes appear to contain
instructions for how to circumvent the Rideshare/Delivery Companies fraud detection systems,
such as instructions to delete machine “cookies” and delete and reinstall the app. The BARBOSA
iCloud Account also contained hundreds of pictures of driver’s licenses. - On or about June 7, 2020, BARBOSA created a WhatsApp group that included
Defendant D herself, CABRAL, PLACIDO, , DA SILVEIRA, and CC-5 that she named “Mafia.” I
have reviewed a computer-generated translation of this chat. This group discussed how to exploit
referral bonuses. For example, on or about August 21, 2020, BARBOSA sent the following image
to the “Mafia” group chat. The image, from which victims’ names have been redacted, suggests
that BARBOSA and her conspirators received $194,800 from Delivery Company D in connection
with 487 referrals:
14 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 15 of 68 - Participants in the “Mafia” group chat also discussed Rideshare/Delivery Company
accounts rented or sold to drivers, including ways to apply for accounts to improve the likelihood
of the Rideshare/Delivery Company approving the account, issues with the Rideshare/Delivery
Companies closing accounts, and vetting potential purchasers of the accounts. They also discussed
ways to take advantage of the Rideshare/Delivery Companies’ platforms and increase their profits
from the scheme. For example, in or about June 2020, BARBOSA, CABRAL, DA SILVEIRA,
COLACO, and CC-5 purchased a “bot” to enable them to “cut the line” to grab batches of
Defendant D deliveries on Delivery Company E’s app.8 Both and CC-5 sent BARBOSA $1,000 via
Venmo for the “bot,” with CC-5 adding a picture of a robot to his payment. Upon purchasing the
8
A “bot” is a software application that runs automated tasks over the Internet.
15
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 16 of 68
program, CABRAL tested it and advised the others, in substance, that if he could use the program,
anyone could. CABRAL directed that they charge drivers $500 for the “bot.” - The members of the “Mafia” chat group also shared ways to advertise their
“business,” exchanged images of driver’s licenses, and discussed ways to get around the
Rideshare/Delivery Companies’ fraud detection systems, such as by using a virtual private network
(“VPN”) to avoid detection of their IP address.9 - BARBOSA purchased and traded driver’s licenses with numerous conspirators,
including ABREU, Defendant O, LIMA GUIMARAES, and CC-2. Additionally, I have
probable cause to believe that BARBOSA purchased Social Security numbers on the DarkNet.
For example, on or about November 18, 2019, BARBOSA asked ABREU, in substance, to teach
her how to buy Bitcoin after she discovered a site to purchase Social Security numbers that required
payment in Bitcoin. On or about October 29, 2020, BARBOSA sent Defendant Q a
photo of her computer opened to a DarkNet site where she was looking for the Social Security
number of Victim 7. - I have reviewed a bank account in BARBOSA’S name at Bank of America. The
address associated with the account is Rock Wood Drive, Saugus, Massachusetts, another
address in the Residences at Stevens Pond complex. Between on or about June 12, 2019 and on
or about January 11, 2021, approximately $782,340 was deposited into BARBOSA’S Bank of
9
A VPN creates a secure, encrypted connection between a computer and a VPN server
located elsewhere and can be used to hide a user’s computer IP address by replacing it with the
VPN provider’s IP address.
16
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 17 of 68
America account. Zelle transfers accounted for approximately $402,248 of that amount.10
Payments from several of the Rideshare/Delivery Companies for completed rides accounted for
approximately $248,076. These companies paid BARBOSA approximately $201,940 for trips
completed under at least 68 names other than her own name. - For example, between January and May 2020, BARBOSA received $20,623.16 in
deposits from Rideshare Company A in the name of Victim 8. According to Rideshare Company
A’s records, the account in the name of Victim 8 (“Account 8”) was created with a Florida driver’s
license in Victim 8’s name. A “selfie” of an individual that appears to match the picture on the
driver’s license was uploaded to Account 8. BARBOSA’S bank statement reflects a pattern of
receiving a payment from Rideshare Company A in the name of Victim 8 and transferring a similar
amount of money, less approximately $100-$200, to another individual, Co-Conspirator 6 (“CC6”), on the same day. Based on my knowledge of the investigation, I believe that CC-6 rented
Account 8 from BARBOSA, and that BARBOSA collected the proceeds from CC-6’s trips in her
account and then transferred the money, less her rental fee, to CC-6. - Between approximately June 2019 and September 2020, BARBOSA received
approximately $302,599 in Zelle transfers. These transfers typically were in amounts between
$100 to $300. Based on my knowledge of this investigation, I believe that many of these transfers
were from individuals renting or buying fraudulent driver accounts.
10 Zelle is a digital payment network owned by a group of banks, including Bank of
America and Wells Fargo, among others. Zelle allows users to send and receive money, typically
over a mobile device, directly from their bank accounts at participating banks.
17 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 19 of 68
Defendant D that he had agreements to sell the “bot” to several people. CABRAL suggested that
create a video to share with the individuals to whom they rented and sold accounts showing the
features of the “bot.” - CABRAL and BARBOSA also had separate WhatsApp chats with each other,
during which CABRAL used both the CABRAL TELEPHONE 1 and CABRAL TELEPHONE 2.
I have reviewed computer-generated translations of these chats. The chats make clear that
CABRAL and BARBOSA worked together to create and rent fraudulent driver accounts. For
example, on or about October 25, 2019, CABRAL and BARBOSA discussed, in substance, that
Rideshare Company C had approved one of their accounts, in the name of Victim 9. On or about
October 28, 2019, CABRAL and BARBOSA discussed, in substance, that an account they created
for another individual, Co-Conspirator 7 (“CC-7”), had been approved, and CABRAL notified
CC-7. CABRAL and BARBOSA also discussed payments they were owed for their accounts and
that they owed each other. CABRAL also advertised the accounts he and BARBOSA shared. For
example, on October 29, 2019, BARBOSA notified CABRAL that she had a female account with
Delivery Company B available, and CABRAL said he would advertise it. - CABRAL and BARBOSA also shared the proceeds of some of their fake driver
accounts with CC-5. For example, on or about November 10, 2019, BARBOSA and CABRAL
discussed, in substance, sharing an account with CC-5 and dividing the rental payments by three. - BARBOSA and CABRAL also discussed the referral bonuses they were getting
from setting up fake accounts. For instance, on or about October 31, 2019, CABRAL and
BARBOSA discussed, in substance, using a referral code for Rideshare Company C and splitting
the referral bonus. In another instance, on or about November 6, 2019, BARBOSA sent CABRAL
the screenshot set forth below (from which I have redacted victim names) depicting a list of driver
19 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 20 of 68
accounts BARBOSA and CABRAL had referred to Rideshare Company C and showing their
progress toward earning the referral bonus: - CABRAL also created his own accounts and relied on BARBOSA to help him
answer the identity verification questions asked during the application process. To help her answer
the questions, CABRAL shared with BARBOSA photos of the victims’ licenses and their Social
Security numbers. CABRAL also shared images of his computer with BARBOSA, which appear
to show other fraudulent driver accounts he was managing. - CABRAL often supplied BARBOSA with victims’ information. For example, on
or about November 9, 2020, CABRAL sent BARBOSA a list of victim names, addresses, dates of
birth, and Social Security numbers. He also purchased driver’s licenses from BARBOSA
occasionally. For example, on or about December 10, 2020, BARBOSA sent CABRAL five
images of driver’s licenses, and instructed him to pay $175 to the telephone number
via Zelle. As set forth below, this phone number belongs to LIMA GUIMARAES. Additionally,
20 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 21 of 68
I have seen a WhatsApp chat between LIMA GUIMARAES and BARBOSA from the prior day
in which LIMA GUIMARAES sent BARBOSA the same five images. Accordingly, based on my
training and experience and my knowledge of this investigation, I believe that BARBOSA acted
as a middleman in the sale of the five victim licenses from LIMA GUIMARAES to CABRAL. - BARBOSA and CABRAL also shared tips and resources, including the name of a
contact who could edit licenses for them. On or about November 19, 2019, CABRAL asked
BARBOSA if there was an app that could help him manage multiple ProtonMail accounts. Based
on my involvement in this investigation, I am aware that many of the defendants, including
BARBOSA and AGUIAR, used ProtonMail to create email accounts for use with the driver
accounts they created. Based on my training and experience, I am aware that ProtonMail is an
encrypted email service. Accordingly, I believe the conspirators used this service as a means to
avoid detection of their scheme. - I have reviewed a bank account in CABRAL’s name at Bank of America. The
address associated with the account is 60 Linwood Street, Apt. 1, Malden, Massachusetts, an
address that is also associated with bank records for CC-5. Between on or about June 6, 2019 and
on or about January 5, 2021, approximately $623,721 was deposited into CABRAL’s Bank of
America account. Zelle transfers accounted for approximately $315,695 of that amount. Many of
those Zelle transfers reference the name of Rideshare Company C. Payments from several of the
Rideshare/Delivery Companies accounted for approximately $26,964. Of these, many of the
payments are round numbers, which suggests to me that they are referral bonuses.
CLOVIS KARDEKIS PLACIDO - The investigation has revealed that, as part of the scheme, PLACIDO edited
driver’s licenses; prepared and submitted applications using fraudulent identifiers; rented and sold
21 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 22 of 68
driver accounts; fraudulently obtained referral bonuses from the Rideshare/Delivery Companies;
and exchanged information with other conspirators about how to circumvent the
Rideshare/Delivery Companies’ fraud detection systems. - PLACIDO communicated with BARBOSA and the “Mafia” group via WhatsApp
at the phone number 407-820-7640 (the “PLACIDO TELEPHONE”). I have reviewed computergenerated translations of these chats. In the chat with BARBOSA, PLACIDO sent pictures of
himself to BARBOSA as well as an image of his driver’s license. Additionally, BARBOSA saved
the PLACIDO TELEPHONE in her contacts under the name “Clovis.” - On or about April 9, 2020, PLACIDO offered to sell BARBOSA information and
a link regarding referral bonuses available through Delivery Company D. After some negotiations,
BARBOSA agreed to pay PLACIDO $1,000 for the information and link. In connection with this
exchange, PLACIDO sent BARBOSA the link, created an account with Delivery Company D
using Victim 10’s information, and, after receiving the $1,000 payment from BARBOSA, sent
BARBOSA an image of Victim 10’s license and the log-in information for the account, as well as
the zip code to use when applying to maximize the referral bonus. - PLACIDO and BARBOSA also exchanged tips about how to circumvent security
measures employed by the Rideshare/Delivery Companies. For example, on or about April 9,
2020, PLACIDO instructed BARBOSA how to get past the background check for Delivery
Company D to deliver with a scooter, rather than a car. On or about April 10, 2020, PLACIDO
shared with BARBOSA that he managed to solve an error she was experiencing by uninstalling
and reinstalling Delivery Company D’s app. On or about April 15, 2020, BARBOSA explained
to PLACIDO that it was better to use ProtonMail than using Gmail to register email addresses for
fake accounts.
22 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 23 of 68 - PLACIDO also told BARBOSA, in substance, that he was creating fraudulent
accounts. On or about April 10, 2020, PLACIDO stated that he had created 16 driver accounts the
previous day, after BARBOSA responded that she had created 21 accounts. - PLACIDO also referred drivers to BARBOSA. On or about April 11, 2020,
PLACIDO sent the contact information of a driver looking for an account with Delivery Company
E to BARBOSA. - After BARBOSA created the “Mafia” group, PLACIDO also exchanged tips with
his fellow “Mafia” group members, including regarding which markets were accepting new
accounts and where to secure higher referral bonuses. For example, on or about October 22, 2020,
PLACIDO shared, in substance, that despite using a VPN to hide his location, he had been
unsuccessful in opening driver accounts in Canadian markets. He also explained that he used the
VPN to disguise himself when browsing the DarkNet. - PLACIDO also edited driver’s license images. For example, on or about January
29, 2021, PLACIDO sent BARBOSA a photo of his computer, opened to a photo editing
application, with an image of Victim 12’s driver’s license displayed, but with PLACIDO’s face
edited into the license. PLACIDO asked BARBOSA if she thought the image would pass the
background check process for Delivery Company E, despite the fact that it was missing one of the
security features.
Defendant D
Defendant D 60. The investigation has revealed that, as part of the scheme, rented and sold
driver accounts; fraudulently obtained referral bonuses from the Rideshare/Delivery Companies;
sold and installed “bots” for use in connection with the Rideshare/Delivery Company apps; and
23 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 25 of 68
Defendant D 65. The following day, asked the group how much they would charge an
Defendant D individual for an account and a “bot” together; group participants then discussed a price.
Defendant D indicated to the group that she knew of potential buyers for the “bot.” As noted above,
transferred $1,000 via Venmo as her share for the purchase of the “bot.”
Defendant D 66. In various messages with the “Mafia” group, described how to install the
“bot” to work in connection with the Delivery Company E app, including how to install the “bot”
Defendant D on a phone remotely. also troubleshot various “bot” installation problems raised by the
other group members and managed email addresses and passwords used by the group in connection
with the apps.
Defendant D 67. also discussed account rentals and deactivations with the “Mafia” group.
In various messages, she asked group members whether they had accounts available to rent to
individuals who had contacted her for accounts. In other messages, she and other group members
speculated about why one Rideshare/Delivery company had deactivated accounts that had accrued
Defendant D referral bonuses. On or about August 22, 2020, sent a screenshot of an email from
Delivery Company D, addressed to Victim 13, in which Delivery Company D apologized for
“mistakenly” deactivating the account “for referral fraud.”
Defendant D 68. As noted, I have reviewed a bank account in ’s name at Bank of America.
Defendant D Between in or around March 2019 and in or around December 2020, received deposits
of approximately $82,661 from Rideshare/Delivery Companies. Payments for at least $44,760 of
this amount specifically referenced the names of at least 53 other individuals, while other payments
Defendant D referenced no driver name. During this period, also received Zelle transfers totaling over
$60,000, including recurring Zelle transfers from numerous individuals. Based on my knowledge
25 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 26 of 68
of this investigation, I believe that many of these transfers were from individuals renting or buying
fraudulent driver accounts and/or purchasing “bots” to use with such accounts.
GUILHERME DA SILVEIRA - The investigation has revealed that, as part of the scheme, DA SILVEIRA obtained
driver’s license images; rented and sold fraudulent driver accounts; fraudulently obtained referral
bonuses from the Rideshare/Delivery Companies; and exchanged information with other
conspirators about how to circumvent the Rideshare/Delivery Companies’ fraud detection
systems. - DA SILVEIRA communicated with BARBOSA and the “Mafia” group via
WhatsApp using the phone number 857-346-7961 (the “DA SILVEIRA TELEPHONE”). I have
reviewed computer-generated translations of these chats. In the chat with BARBOSA, DA
SILVEIRA sent pictures of himself to BARBOSA, and BARBOSA sent screenshots confirming
she sent funds to DA SILVEIRA. I have reviewed Bank of America records for DA SILVEIRA
that reflect corresponding transfers in an account in his name. Additionally, BARBOSA saved the
DA SILVEIRA TELEPHONE in her contacts under the name “Guiii.” DA SILVEIRA also
communicated with AGUIAR via WhatsApp using the DA SILVEIRA TELEPHONE. AGUIAR
saved the DA SILVEIRA TELEPHONE in his contacts under the name “Guilherme Alug Fusion.”
I believe, based on my knowledge of this investigation, that “Alug Fusion” is a reference to DA
SILVEIRA’S rental of a Ford Fusion from AGUIAR, as I understand “alug” is the Portuguese
word for “rent.” - WhatsApp messages between BARBOSA and DA SILVEIRA indicate that DA
SILVEIRA provided driver’s license images to BARBOSA for the purpose of opening driver
accounts with multiple Rideshare/Delivery Companies with fraudulent identifiers.
26 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 27 of 68 - DA SILVEIRA was also part of the “Mafia” group chat. Among other activity in
the chat, DA SILVEIRA sent photos of his phone as he was attempting to access the “bot” the
group purchased. DA SILVEIRA also complained, in substance, that drivers to whom he had
rented or sold accounts were coming to him with problems related to their accounts. - I have also reviewed draft summary translations of WhatsApp messages between
AGUIAR and CC-2. In those chats, they discuss, in substance, that DA SILVEIRA supplied CC2 with driver’s license images for the purpose of opening fraudulent driver accounts with
Rideshare/Delivery Companies. For example, on or about December 13, 2019, CC-2 told
AGUIAR that DA SILVEIRA had provided CC-2 eight “clean” California driver’s licenses for the
purpose of obtaining fraudulent accounts with Delivery Company B, and that CC-2 and DA
SILVEIRA would split the profits generated by the use of those fraudulent accounts, and invited
CC-2 to use the same driver’s licenses to apply for accounts with Rideshare Company A. CC-2
indicated in other messages with AGUIAR that CC-2 and DA SILVEIRA maintained an
arrangement pursuant to which DA SILVEIRA provided driver’s licenses, CC-2 obtained Social
Security numbers and edited images of the licenses, and CC-2 and DA SILVEIRA shared the
profits. - Additionally, as of March 3, 2021, DA SILVEIRA had at least nine vehicles
registered in his name at the address 14 Woodman Way, Apartment 9, Newburyport,
Massachusetts. DA SILVEIRA’S domestic partner had at least nine additional vehicles registered
in her name at the same address. Based on my training and experience and knowledge of the
investigation, I believe that DA SILVEIRA rented these vehicles to individuals driving for
Rideshare/Delivery Companies under fraudulent accounts.
27 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 28 of 68 - I have reviewed a bank account in DA SILVEIRA’S name at Bank of America.
The address associated with the account is 93 Ward Street in Revere, Massachusetts, which I know
to be an address where DA SILVEIRA resides. Between on or about June 25, 2019 and on or
about December 24, 2020, DA SILVEIRA received a total of approximately $106,842 in payments
from various Rideshare/Delivery Companies that referenced at least 37 other individuals’ names.
Some of these names were used by other conspirators to create fraudulent accounts. Based on my
knowledge of the investigation, I believe that DA SILVEIRA received these payments for renting
out accounts fraudulently opened in these individuals’ names. - DA SILVEIRA’S bank statements for that period reflected Zelle inflows totaling
$225,107, which is consistent with the amount of Zelle inflows for other conspirators renting and
selling fake driver accounts. Zelle account statements reflect payments totaling approximately
$7,096 from BARBOSA and approximately $2,052 from CC-2. DA SILVEIRA also transferred
approximately $4,090 to AGUIAR.
Defendant F
Defendant F 77. The investigation has revealed that, as part of the scheme, prepared and
submitted applications using fraudulent identifiers; rented and sold fraudulent driver accounts;
purchased and traded driver’s licenses and Social Security numbers; sold GPS “spoofing”
technology to drivers; and exchanged information with other conspirators about how to circumvent
the Rideshare/Delivery Companies’ fraud detection systems. - A number of the driver accounts associated with AGUIAR and BARBOSA appear
to have been created using stock driver’s license images, including a stock image in which a
driver’s license rests on a wallet. Metadata that Rideshare Company A collected for several of
28 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 30 of 68
AGUIAR with the note “SS,” which I believe, based on my training and experience and my
knowledge of this investigation, refers to “Social Security.”11 - In or about October 2020, ten accounts with Delivery Company B were created in
the names of ten different victims from the Comcast IP Address 73.123.253.111. The profile
Defendant F photographs and driver’s license images uploaded for these accounts bear the image of
Defendant F
or Defendant G. IP Address 73.123.253.111 is a Comcast IP address subscribed to at
19 Overlook Ridge Terrace, Apartment 204, in Revere, Massachusetts and is associated with the
Defendant F TELEPHONE. Delivery Company B has identified additional fraudulent accounts that
were created from this same IP address. According to the GPS data collected by Delivery
Company B, one of these accounts was active in the vicinity of Overlook Ridge.
Defendant F 82. In WhatsApp chats with AGUIAR, exchanged driver’s licenses, Social
Defendant F Security numbers, and information about how to get accounts approved. also told
AGUIAR that he had obtained a GPS “spoofing” application to, in substance, make rides appear
Defendant F longer than they were, in order to secure a higher fare. told AGUIAR he was selling the
“spoofing” app to drivers.
Defendant F 83. Additionally, in or about March 2020, referred another individual, CoConspirator 9 (“CC-9”), to AGUIAR as someone who could edit driver’s licenses. AGUIAR sent
the Connecticut license template he received from BARBOSA to CC-9.
11 The $1,000 transfer came from an account in the name of another female individual
Defendant F (“Subject 1”). sent AGUIAR a photo of the confirmation that he had sent the $1,000
payment on or about February 23, 2020. The only payment for $1,000 to AGUIAR on that date Defendant F was from Subject 1. Other payments from to AGUIAR were also sent from Subject 1’s Defendant F account. In WhatsApp chats, also told AGUIAR that he used his girlfriend’s account to
send payments.
30 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 31 of 68
Defendant G - The investigation has revealed that, as part of the scheme, Defendant G prepared
and submitted applications using fraudulent identifiers; rented and sold fraudulent driver accounts;
purchased and traded Social Security numbers; and exchanged information with other conspirators
on prices for Social Security numbers. - Rideshare Company A identified approximately seven fraudulent accounts created
between on or about December 2019 and on or about October 2020 with driver’s license images
Defendant G bearing Defendant G’s image (the “Defendant G Accounts”). At least three of the
Accounts are linked to a vehicle registered to Defendant G. Additionally, these three
accounts feature stock images of a license in a hand, which appear to be the same stock images
Defendant F Defendant F associated with some of the Accounts. Further, CC-8, who referred many of the
Accounts, also referred one of the Defendant G Accounts to Rideshare Company A under its
driver referral bonus program. Two of the accounts were created using the IP address
Defendant F 73.123.253.111, which, as previously noted, was subscribed to . - Defendant G also received payments from the Rideshare/Delivery Companies in
the names of at least three individuals, and more than $40,000 in payments where the driver was
not attributed. He also received a $150 Zelle payment in or about September 2018 with the
description “Conta [Delivery Company D],” which I believe based on my knowledge of the
investigation is a rental payment for an account with Delivery Company D. I understand that
“conta” is the Portuguese word for “account.” - Defendant G was also a member of a group WhatsApp chat that included
Defendant F AGUIAR, , and others, in which he offered accounts for sale. For example, on or about
September 10, 2020, Defendant G notified the group that he had a delivery account available in
31 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 33 of 68
Defendant F and . Defendant G also received payments from Rideshare Company C in the names
of three different individuals.
FLAVIO CANDIDO DA SILVA - The investigation has revealed that, as part of the scheme, DA SILVA rented and
sold driver accounts and referred other conspirators to AGUIAR. - In total, investigators have identified at least 19 fraudulent driver accounts with DA
SILVA’s photograph on the driver’s license, under the names of at least 11 individuals. The
“selfie” associated with each of these accounts is a photo of DA SILVA. - I have reviewed bank and Zelle records for DA SILVA. The records reflect
payments to DA SILVA from Rideshare/Delivery companies totaling approximately $37,746
between June 2019 and December 2020, including payments totaling approximately $12,919 that
specifically referenced the names of at least 14 other individuals. DA SILVA also received
numerous Zelle transfers from individuals in amounts ranging from $100 to $300, which I believe
based on my knowledge of the investigation are rental payments to DA SILVA for fraudulent
driver accounts. In total, between in or about June 2019 through in or about December 2020, DA
SILVA received approximately $200,263 in Zelle inflows. - Bank statements also reflect numerous Zelle and PayPal transfers between DA
Defendant F SILVA and , as well as recurring Zelle transfers from Defendant G in varying amounts.
Defendant F WhatsApp messages between AGUIAR, Defendant G, and indicate that DA SILVA
referred Defendant G to AGUIAR in or about February 2020 to obtain Social Security numbers,
and that AGUIAR made a $150 Zelle transfer in April 2020 to DA SILVA, whom AGUIAR
identified in his contacts as “Flavio Santa Fe.” The WhatsApp profile photo for the “Flavio Santa
Fe” account appears to match known photographs of DA SILVA.
33 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 34 of 68
ALTACYR DIAS GUIMARAES NETO - The investigation has revealed that, as part of the scheme, GUIMARAES NETO
acted as a middleman for Co-Conspirator 10 (“CC-10”), another participant in the scheme who
edited driver’s licenses. GUIMARAES NETO also rented and sold fraudulent driver accounts and
exchanged information with other conspirators about how to circumvent the Rideshare/Delivery
Companies’ fraud detection systems. - In a WhatsApp chat on or about October 16, 2019, AGUIAR asked another
conspirator, CC-5, for the contact information for the person who edits driver’s licenses. CC-5
forwarded AGUIAR the contact information for “Altacyr [delivery company]” with a phone
number of 857-505-5848 (the “GUIMARAES NETO TELEPHONE”) and told AGUIAR that he
would need to make an upfront payment of $40 per license. - On or about the same day, AGUIAR contacted, via WhatsApp, a person identified
in AGUIAR’s contacts as “Altacyr [delivery company]” at the GUIMARAES NETO
TELEPHONE. The GUIMARAES NETO TELEPHONE is associated with a Zelle account
belonging to GUIMARAES NETO, which is linked to a Bank of America account in the name of
GUIMARAES NETO. - I have reviewed a draft summary translation of the WhatsApp chat between
GUIMARAES NETO and AGUIAR. During their initial communication, GUIMARAES NETO
indicated to AGUIAR that it was his friend, CC-10, edited driver’s licenses and charged $40 for
that service. GUIMARAES NETO and AGUIAR also discussed, in substance, that AGUIAR
shared accounts with CC-5 and that GUIMARAES NETO had previously had problems with CC5. GUIMARAES NETO offered to collaborate with AGUIAR.
34
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 35 of 68 - Thereafter, between in or about October 16, 2019 and November 8, 2019, AGUIAR
sent GUIMARAES NETO approximately 20 passport-style photos and images of victim’s driver’s
licenses, and in return, GUIMARAES NETO sent AGUIAR images of correspondingly altered
licenses. All of the images GUIMARAES NETO sent to AGUIAR were the same three stock
images, but with different victim’s licenses edited into each image. AGUIAR also notified CC-2
via WhatsApp that his friend had recommended a person to alter driver’s licenses for $40. - AGUIAR sent GUIMARAES NETO payments of $40 via Zelle corresponding to
each license he asked him to edit. In total, between on or about October 16, 2019 and on or about
November 8, 2019, AGUIAR sent GUIMARAES NETO $720 via Zelle, all in $40 or $80
increments. Between on or about May 20, 2019 through on or about February 12, 2021,
GUIMARAES NETO received Zelle payments totaling approximately $963 from CC-5, including
multiple payments in $40 increments in or about September and October 2019, which I believe,
based on the foregoing, were payments to edit licenses for CC-5. During this same period,
GUIMARAES NETO also received approximately $3,900 in Zelle payments from CABRAL and
approximately $2,740 in Zelle payments from another individual, Co-Conspirator 11 (“CC-11”).12
Between on or about May 20, 2019 and on or about February 12, 2021, GUIMARAES NETO sent
approximately $27,415 to DA SILVEIRA via Zelle. - GUIMARAES NETO and AGUIAR also discussed in these chats whether the
edited licenses would be caught by Rideshare Company A or Rideshare Company C’s respective
12 I am aware from my review of summary translations of WhatsApp chats that CC-2
shared with CC-11 that CC-2 purported to have someone who would edit licenses for $40.
believe, based on the foregoing, that CC-2 was referring to GUIMARAES NETO.
35
I
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 36 of 68
fraud detection systems. For example, on or about November 1, 2019, AGUIAR sent
GUIMARAES NETO a message from Rideshare Company C that an account had been suspended.
AGUIAR also gave GUIMARAES NETO tips about how to manipulate the angles from which the
photographs were taken in order for Rideshare Company A to accept them. - On or about October 30, 2019, GUIMARAES NETO inquired of AGUIAR, in
substance, whether they were using the same source for Social Security numbers and whether they
were paying the same price. - GUIMARAES NETO also occasionally asked AGUIAR to obtain driver’s licenses
for him. For example, on or about November 1, 2019, GUIMARES NETO asked AGUIAR to
obtain four driver’s licenses for him for $50 total. - I have also reviewed records for a Bank of America account in GUIMARAES
NETO’s name. Between in or about December 2018 and in or about February 2021,
GUIMARAES NETO received nearly $155,000 from the Rideshare/Delivery Companies. Of that
amount, more than $48,000 was received in the names of approximately 31 drivers. During that
same period, GUIMARAES NETO received approximately $234,094 in Zelle inflows.
Defendant J - The investigation has revealed that, as part of the scheme, Defendant J
bought and sold driver’s licenses and Social Security numbers; edited driver’s licenses; prepared
and submitted applications using fraudulent identifiers; rented and sold fraudulent driver accounts;
referred prospective drivers to AGUIAR; and exchanged information with other conspirators about
how to circumvent the Rideshare/Delivery Companies’ fraud detection systems. - Defendant J communicated with AGUIAR via WhatsApp using the phone
number (the “Defendant J TELEPHONE”). This number is associated with
36 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 37 of 68
a Zelle account in Defendant J ’s name, which is in turn linked to a Bank of America account
Defendant J in Defendant J ’s name, for which Defendant J is also listed as having the
Defendant J
phone. AGUIAR identified the phone number as “ Califa Zelle.” I
believe “Califa” refers to “California,” where Defendant J resided. - I have reviewed a draft summary translation of a chat between Defendant J
and AGUIAR, as well as computer-generated translations of chats between AGUIAR and
individuals Defendant J referred to AGUIAR. For example, on or about November 13,
2019, AGUIAR asked Defendant J , via WhatsApp, whether he knew anyone interested in
Defendant K an account with Rideshare Company C. Later that day, contacted AGUIAR over
Defendant K WhatsApp to rent the account. During the chat between AGUIAR and , AGUIAR asked
Defendant K Defendant J Defendant K if “ ” had discussed the rental cost with him, and informed it was $300 per
week. In another instance, on or about April 25, 2020, a driver contacted AGUIAR for an account
Defendant J
with Delivery Company E, and AGUIAR confirmed that “ ” had told him the driver would be
contacting him. - Defendant J also managed his own fraudulent driver accounts. In or about
November 2019, Defendant J and AGUIAR complained to one another, in substance, about
losses they incurred when the Rideshare/Delivery Companies suspended the fraudulent accounts
that they managed. - Defendant J and AGUIAR also exchanged driver’s licenses and Social
Security numbers. For example, on or about November 24, 2019, Defendant J sent
AGUIAR an image of a driver’s license for which Defendant J needed the corresponding
Social Security number. AGUIAR agreed, in substance, to ask his source for Social Security
numbers on the DarkNet. On or about the next day, Defendant J asked AGUIAR if another
37 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 38 of 68
individual, Co-Conspirator 12 (“CC-12”), was his source for Social Security numbers. AGUIAR
Defendant J replied, in substance, that he had dealt with CC-12 in the past, but no longer used him.
and AGUIAR also discussed what happened when they applied for driver accounts
without a Social Security number. - Defendant J and AGUIAR also discussed the prices they paid for Social
Security numbers. Subsequently, on or about December 27, 2019, Defendant J offered to
provide AGUIAR with Social Security numbers at a better price than what AGUIAR was getting
from his existing source. On or about January 13, 2020, Defendant J told AGUIAR he
would charge him $60 per Social Security number. Thereafter, AGUIAR sent Defendant J
Defendant J victims’ driver’s licenses and requested Social Security numbers. Two days later,
sent AGUIAR a photo of the following message from his source, which was in English
and which I have redacted, notifying him that of the four Social Security numbers he had requested,
only one was available: - I believe, based on my knowledge of the investigation, that Defendant J
edited driver’s licenses. For example, on or about February 15, 2020, approximately one month
after Defendant J expressed his interest in entering the Boston market, Defendant J
notified AGUIAR that he was having a template of a Massachusetts driver’s license made.
Defendant J asked AGUIAR to take a high-quality photo of a Massachusetts driver’s license
for Defendant J to use in the template.
38 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 39 of 68 - On or about February 20, 2020, Defendant J sent AGUIAR photos of
licenses he had edited, and AGUIAR provided feedback on the shading. During this exchange,
AGUIAR sent Defendant J a template for vehicle insurance. - Throughout their chats, Defendant J and AGUIAR exchanged tips about
how to avoid the Rideshare/Delivery Companies’ fraud detection systems. For example, on or
about December 9, 2019, Defendant J shared a tip about taking a picture of a picture to get
Defendant J past Rideshare Company C’s fraud detection system. On or about January 19, 2020,
instructed AGUIAR to apply for accounts via Rideshare Company C’s website, as
opposed to its app, for better results. - AGUIAR also told Defendant J that he was working with others. For
example, on or about December 4, 2019, AGUIAR told Defendant J that he and his partner
had applied for 25 accounts with Rideshare Company A that week. - On or about December 6, 2019, Defendant J shared with AGUIAR a
photograph of a GPS “spoofing” application he had purchased. On or about December 16, 2019,
Defendant J instructed AGUIAR about how the application worked. - I have also reviewed records for a Bank of America account in Defendant J ’s
name. Between in or about September 2019 and in or about February 2021, Defendant J
received approximately $41,000 from the Rideshare/Delivery Companies in the names of
approximately 47 drivers. - Defendant J is listed in corporation records filed with the State of California
as the Chief Executive Officer, Secretary, Chief Financial Officer, and Director of ,
Defendant K a company incorporated in California in or about October 2020. is listed as the sole other
Director. The type of business is “ecommerce.”
39 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 40 of 68 - I have reviewed bank records for . Based on my training and experience
and my knowledge of the investigation, I believe was set up to launder money
associated with the Rideshare/Delivery Company scheme. More than $75,000 has been passed
through since it was incorporated in or about October 2020, more than $13,000 of which
comprised Zelle transfers from Defendant J . Another approximately $21,000 was deposited
into the account in seven cash transactions, all in amounts less than $10,000.
Defendant K
Defendant K 119. The investigation has revealed that, as part of the scheme, created or
caused to be created multiple driver accounts with his image; referred a potential conspirator to
AGUIAR; laundered money through . with Defendant J ; and exchanged
information with other conspirators about how to circumvent the Rideshare/Delivery Companies’
fraud detection systems.
Defendant K 120. communicated with AGUIAR via WhatsApp using the phone number
Defendant K (the “ TELEPHONE”). I have reviewed a computer-generated translation
Defendant K of this chat. During the chat, sent AGUIAR his bank information, which matches a Wells
Defendant K Defendant K Fargo account ending in in ’s name. also sent “selfie” photographs of
Defendant K himself. Additionally, sent AGUIAR screenshots showing Zelle payments he made to
Defendant K AGUIAR, which correspond to Zelle payments drawn on ’s bank account. AGUIAR also
Defendant K Defendant K
saved the TELEPHONE in his contacts under the name “ [Rideshare Company C]
Defendant K Califa.” I believe “Califa” refers to “California,” where resided.
Defendant K 121. As described above, contacted AGUIAR at the recommendation of his
Defendant J
friend “ ” for an account with Rideshare Company C. Additionally, Rideshare Company A’s
40
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 41 of 68
Defendant K records reflect four accounts created in the names of other individuals but bearing ’s
image.
Defendant K 122. I have reviewed bank and Zelle records for . Between on or about June
Defendant K 28, 2019 and on or about December 28, 2020, received approximately $70,515 in
payments from various Rideshare/Delivery Companies in the names of at least 32 different
individuals. He also received Zelle transfers of approximately $135,483 during that period,
including approximately $23,224 from Defendant J .
13
Defendant K 123. Additionally, on or about November 21, 2019, told AGUIAR in a chat
that he had a contact who would edit driver’s licenses for AGUIAR for $30 each.
Defendant L
Defendant L 124. The investigation has revealed that, as part of the scheme, acted as a
middleman between AGUIAR and individuals who rented fraudulent driver accounts. Defendant L
also managed accounts and collect payments from drivers; and exchanged information with other
conspirators about how to circumvent the Rideshare/Delivery Companies’ fraud detection
Defendant L systems. also obtained at least one license for use in creating a fraudulent driver
account.
Defendant L 125. communicated with AGUIAR via WhatsApp using the phone number
Defendant L Defendant L (the “ TELEPHONE”). The TELEPHONE is associated with
13 Defendant K also transferred approximately $17,132 to Defendant J during this
period. I am aware that public records available to law enforcement list the same address for both
Defendant J Defendant K and in Daly City, California. Based on my knowledge of the
Defendant K investigation, I believe and Defendant J were roommates, and some of these Zelle
payments may have been associated with household expenses.
41 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 42 of 68
Defendant L an insurance claim made by .
Defendant L 126. I have reviewed a draft summary translation of the chat between and
Defendant L AGUIAR. In the chat, shared a photograph of his own driver’s license and vehicle
Defendant L registration with AGUIAR. Additionally, AGUIAR identified the contact using the
Defendant L TELEPHONE as “ Drive Califa.” I believe “Califa” is a reference to “California,” where
Defendant L resided.
Defendant L 127. On or about November 7, 2019, AGUIAR offered to work with in
connection with creating fraudulent driver accounts with Rideshare Company A and Rideshare
Company C. AGUIAR proposed, in substance, to send photos of victims’ driver’s licenses to
Defendant L Defendant L so that could find drivers with a similar appearance to use fraudulent
Defendant L accounts created in the victims’ names. confirmed that he knew people interested in
renting accounts, but wanted to be paid more than he was receiving under a similar agreement with
Defendant L Defendant L a conspirator. and AGUIAR negotiated the price, and agreed that he would
be responsible for solving account problems, collecting payments from drivers, and managing the
accounts in exchange for his commission.
Defendant L 128. During this communication, asked AGUIAR if he worked with CC-12.
AGUIAR denied that he worked with CC-12, and confirmed that he his partner were willing to
Defendant L work with . Based on my knowledge of the investigation, I believe the “partner” to
which AGUIAR referred was CC-2.
Defendant L 129. Thereafter, at AGUIAR’s direction, sent AGUIAR passport-style photos
and “selfie” photos of drivers, along with vehicle registrations and proof of automobile insurance.
In exchange, AGUIAR created fraudulent accounts for the drivers in the names of victims. Once
42 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 43 of 68
Defendant L the accounts were set up, sent AGUIAR the drivers’ banking information so they could
receive payments directly from Rideshare Company A and Rideshare Company C.
Defendant L 130. In or about December 2019, and AGUIAR discussed a driver who was
late in paying his weekly rental fee. AGUIAR changed the password on the driver’s account to
Defendant L prevent the driver from accessing it. AGUIAR told that the individual to whom he
reported controlled all account activities and pressured him to collect weekly payments from
drivers.
Defendant L 131. and AGUIAR also discussed the cost to purchase (as opposed to rent)
Defendant L accounts. AGUIAR told , in substance, that the $2,000 he charged for accounts was
justified because he relied on a team to complete the work and outsourced various jobs, including
the procurement of driver’s licenses and Social Security numbers and editing licenses.
Defendant L 132. In the course of their chats, and AGUIAR exchanged tips about how to
avoid the Rideshare/Delivery Companies’ fraud detection systems. For example, on or about
Defendant L November 8, 2019, told AGUIAR to apply for driver accounts in San Francisco,
Defendant L because they were going through more easily. and AGUIAR also exchanged messages
about how to resolve issues with account shutdowns, how to change banking information on a
driver’s account, and whether to use female names for male drivers because of a shortage of male
accounts.
Defendant L 133. On or about November 22, 2019, told AGUIAR that his own driver
account with Rideshare Company A had been shut down, and asked AGUIAR to create an account
Defendant L with Delivery Company B for him using a female victim’s driver’s license that had
obtained after a traffic accident in which he took a photo of the driver’s license of the woman who
Defendant L hit him. AGUIAR suggested that he and save this driver’s license to use for an account
43 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 44 of 68
Defendant L with Rideshare Company A instead. AGUIAR then suggested, in substance, that
intentionally hit a car, preferably driven by an American male, in order to obtain a photograph of
Defendant L Defendant L his driver’s license and use it for ’s account. On or about November 27, 2019,
shared with AGUIAR another fraudulent scheme to obtain driver’s licenses involving liquor
deliveries.
Defendant L 134. Thereafter, in or about December 2019, sent AGUIAR an image of
Victim 17’s driver’s license, and on or about December 22, 2019, AGUIAR sent back a stock
Defendant L photo of the same license resting on a wallet with ’s photo edited onto the license.
Defendant L AGUIAR and thereafter exchanged screenshots concerning a Rideshare Company A
Defendant L account in Victim 17’s name featuring ’s photo.
Defendant L 135. I have reviewed bank records for ’s account at Wells Fargo. Between on
Defendant L or about November 3, 2019 and on or about June 9, 2020, received approximately
$43,167 in deposits into his Wells Fargo account ending in . Zelle transfers comprised
approximately $33,515 of that amount. Many of those deposits were in amounts of $200 or $250,
paid weekly from various individuals. These transfers often referenced “[Rideshare Company A]”
or “Conta,” which is the Portuguese word for “account.” Based on my knowledge of this
investigation, I believe that many of these transfers were from individuals renting or buying
fraudulent driver accounts.
BRUNO PROENCIO ABREU - The investigation has revealed that, as part of the scheme, ABREU supplied
BARBOSA with driver’s license images and assisted BARBOSA with obtaining Social Security
numbers from the DarkNet.
44 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 45 of 68 - ABREU communicated with BARBOSA via text message and WhatsApp using the
phone number (the “ABREU TELEPHONE”). I have reviewed a draft summary
translation of these messages and chat. In the chat, ABREU sent pictures of himself to BARBOSA.
Additionally, payments they discussed correspond to payments reflected in bank statements for an
account in ABREU’s name. BARBOSA saved the ABREU TELEPHONE in her contacts under
the name “Bruno,” which is ABREU’s first name. - ABREU supplied BARBOSA with driver’s license images that BARBOSA used to
open fraudulent driver accounts. Between in or about October 2020 and in or about January 2021,
ABREU sent BARBOSA more than 90 driver’s license images. For example, on or about October
21, 2020, ABREU sent BARBOSA an image of the driver’s license of Victim 18. BARBOSA’S
bank statements indicate that BARBOSA received a deposit of $1,000 from Delivery Company D,
referencing Victim 18, on or about November 10, 2020. I believe this payment may have been a
referral bonus based on the creation of a driver account in Victim 18’s name. - Similarly, on or about October 21, 2020, ABREU sent BARBOSA an image of
Victim 19’s driver’s license. BARBOSA’S bank statements indicate that BARBOSA received a
deposit of $500 from Delivery Company D, referencing Victim 19, on or about November 10, - I believe this payment was also a referral bonus based on the creation of a driver account in
Victim 19’s name. - Based on my knowledge of the investigation and review of the license images
ABREU sent BARBOSA, I believe that ABREU obtained the images of the driver’s licenses of
Victim 18 and Victim 19, and of other victims, while delivering alcohol orders for one or more of
the Delivery Companies, by falsely telling the delivery recipients that the Delivery Company
required him to take a photograph of their licenses in order to verify the recipient’s date of birth.
45
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 46 of 68
Specifically, many of the photos show victims holding up their licenses to the camera, often
through a doorway or on a porch. I have also reviewed a WhatsApp chat between BARBOSA and
LIMA GUIMARAES, in which BARBOSA indicated, in substance, that she sent ABREU to make
deliveries from a liquor store in Connecticut in order to procure images of Connecticut licenses. - ABREU, who lives with BARBOSA at 1205 Rock Wood Drive, Saugus,
Massachusetts, also helped BARBOSA find Social Security numbers. For example, on or about
November 18, 2019, ABREU agreed to help BARBOSA use Bitcoin to purchase Social Security
numbers on a DarkNet site she had located. In other WhatsApp messages from in or around
November 2019, ABREU and BARBOSA discussed alternative sources for Social Security
numbers. In one message, ABREU suggested to BARBOSA that they partner with an accountant
who might have direct access to Social Security numbers through a government database. - I have reviewed records for a Bank of America account in ABREU’S name.
Between in or about December 2018 and in or about December 2020, ABREU received
approximately $51,484 from the Rideshare/Delivery Companies, including payments of
approximately $10,641 referencing the names of at least 18 other individuals. BARBOSA’s
Venmo records reflect that she paid ABREU approximately $5,276 in 2020.
JORDANO AUGUSTO LIMA GUIMARAES - The investigation has revealed that, as part of the scheme, LIMA GUIMARAES
supplied BARBOSA with driver’s license images; referred other drivers to her; and exchanged
information with BARBOSA about sources for driver’s licenses. - LIMA GUIMARAES communicated with BARBOSA via WhatsApp using the
phone number 857-888-2714 (the “LIMA GUIMARAES TELEPHONE”). I have reviewed a draft
summary translation of this chat. During the chat, LIMA GUIMARAES sent a photograph of
46 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 47 of 68
himself. Additionally, BARBOSA saved the LIMA GUIMARAES TELEPHONE in her contacts
under the name “Jordano,” which is LIMA GUIMARAES’s first name. - In or around August 2020, LIMA GUIMARAES asked BARBOSA to create a
driver account for him and sent BARBOSA a “selfie.” BARBOSA created an account for LIMA
GUIMARAES in Victim 20’s name and sent LIMA GUIMARAES a photograph of Victim 20’s
license edited to show LIMA GUIMARAES’s photo. According to their messages, LIMA
GUIMARAES began using the fraudulent account later the same day. - In or about September 2020, LIMA GUIAMARAES contacted BARBOSA again
to request an additional driver account. LIMA GUIMARAES told BARBOSA, in substance, that
he had a victim’s driver’s license already and sent it to BARBOSA. BARBOSA opened a
fraudulent driver account for LIMA GUIMARAES that same day, and LIMA GUIMARAES
offered to send BARBOSA additional driver’s license images that he and his spouse collected in
the future. - Days later, LIMA GUIMARAES contacted BARBOSA and, in substance, agreed
to send her additional driver’s licenses in exchange for payment. LIMA GUIMARAES then sent
BARBOSA photographs of three driver’s licenses. For the reasons set forth above, I understand
these photographs to have been taken in connection with alcohol deliveries for one of the Delivery
Companies. BARBOSA replied that she already had an image of one of the driver’s licenses. - On or about October 3, 2020, BARBOSA contacted LIMA GUIMARAES for
additional driver’s licenses. The following day, LIMA GUIMARAES sent BARBOSA
photographs of three additional driver’s licenses that appear to have been taken during deliveries.
Over the following month, LIMA GUIMARAES sent BARBOSA photographs of at least 30
additional Massachusetts driver’s licenses. BARBOSA paid LIMA GUIMARAES following each
47 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 48 of 68
transmission of photographs of licenses. LIMA GUIMARAES subsequently began sending
BARBOSA photographs of driver’s licenses by text message instead of WhatsApp. Between in
or about October 2020 and in or about January 2021, LIMA GUIMARAES texted BARBOSA
over 150 images of driver’s licenses. - LIMA GUIMARAES’s driver accounts were deactivated in or about December
2020, but BARBOSA created two additional accounts using his image on victims’ driver’s
licenses. - LIMA GUIMARAES also referred other drivers to BARBOSA for obtaining
fraudulent accounts with the Rideshare/Delivery Companies. In substance, LIMA GUIMARAES
and BARBOSA discussed how much she would charge to create an account for a friend of LIMA
GUIMARAES who could supply an image of a victim’s driver’s license to BARBOSA. - LIMA GUIMARAES and BARBOSA also discussed ways to obtain additional
driver’s licenses. For example, BARBOSA told LIMA GUIMARAES that she sent her roommate
to Connecticut to procure driver’s licenses and that he delivered for a wine shop there. LIMA
GUIMARAES expressed interest in doing the same, and later told BARBOSA that he had asked
some of his friends from Connecticut to get driver’s licenses for him. - I reviewed records of a Bank of America account for LIMA GUIMARAES
indicating that, between September 2020 and January 2021, BARBOSA sent GUIMARAES
approximately $5,100 via Zelle.
Defendant O - The investigation has revealed that, as part of the scheme, Defendant O supplied
BARBOSA with driver’s license images and exchanged information with her regarding account
deactivations.
48 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 49 of 68 - Defendant O communicated with BARBOSA via text message and WhatsApp using
the phone number (the “ TELEPHONE”). I have reviewed a draft Defendant O
summary translation of this chat. The profile photo associated with the TELEPHONE Defendant O
on WhatsApp appears to be a photo of based on my review of known photographs of Defendant O
Defendant O . In the chat, the person using the Defendant O TELEPHONE sent a screenshot of a
bank account and routing number that matches ’s bank account. Additionally, Defendant O
Defendant O Defendant O BARBOSA saved the TELEPHONE in her contacts under the name “ ,” which
is ’S first name. Defendant O - Between in or about November 2020 and in or about January 2021, Defendant O
sent BARBOSA more than 75 driver’s license images. In numerous WhatsApp exchanges,
Defendant O and BARBOSA discussed the quality of the images and whether any of the images
were duplicates of images BARBOSA already had. In one exchange, BARBOSA indicated to
Defendant O Defendant O that was one of two suppliers of driver’s licenses that BARBOSA used at
the time. It is apparent from the chat that obtained driver’s license images from Defendant O
victims to whom he delivered alcohol. For example, BARBOSA and Defendant O discussed, in
substance, that BARBOSA needed driver’s licenses to fulfill 20 requests for new accounts, but
Defendant O had none because he had not delivered a single order for alcohol that day. - Defendant O and BARBOSA also exchanged numerous messages about Delivery
Company E’s deactivation of accounts that BARBOSA rented to drivers. For example,
Defendant O explained to BARBOSA that Delivery Company E likely deactivated certain accounts
BARBOSA had rented as part of an annual, year-end clean-up. In another exchange, BARBOSA
and speculated that certain driver’s licenses obtained by Defendant O Defendant O might have
already been used in the creation of other fraudulent accounts.
49 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 50 of 68 - I have reviewed records for a Bank of America account in ’s name. Defendant O
Between in or about December 2018 and in or about December 2020, Defendant O received
approximately $34,271 from the Rideshare/Delivery Companies. Of that amount, approximately
$34,019 was in the names of approximately 20 drivers. - Additionally, Zelle account statements reflect payments of approximately $1,355
from BARBOSA to between November and December 2020, which I believe, based Defendant O
on my knowledge of the investigation, comprised payments for the driver’s license images that
Defendant O provided.
ALESSANDRO FELIX DA FONSECA - The investigation has revealed that, as part of the scheme, DA FONSECA referred
drivers to BARBOSA; managed accounts for BARBOSA; collected referral bonuses; and
exchanged information with other conspirators about how to circumvent the Rideshare/Delivery
Companies’ fraud detection systems. - DA FONSECA communicated with BARBOSA via WhatsApp using the phone
number (the “DA FONSECA TELEPHONE”). I have reviewed a computergenerated translation of this chat. In the chat, DA FONSECA and BARBOSA share screenshots
of payments confirming that they sent funds to each other. I have reviewed bank records in their
names that reflect corresponding transfers into their accounts. Additionally, BARBOSA saved the
DA FONSECA TELEPHONE in her contacts under the name “Ale Carro.” I believe “Ale” is
short for “ALESSANDRO,” which is DA FONSECA’s first name, and “Carro” is the Portuguese
word for “car.” - DA FONSECA provided support for BARBOSA’s account creation services. For
example, in or about November 2019, DA FONSECA sent BARBOSA several drafts of an
50 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 51 of 68
advertisement to attract drivers to the scheme, and BARBOSA edited the drafts. After BARBOSA
approved the advertisement, DA FONSECA indicated that he had posted it and that several
individuals had contacted him. DA FONSECA asked for BARBOSA’s price list, and BARBOSA
responded with weekly rental rates for each Rideshare/Delivery Company for accounts using an
unedited image of a victim’s driver’s license and accounts using an image of a driver’s license
edited to depict the driver’s photo. DA FONSECA subsequently directed individuals to
BARBOSA for account rentals and forwarded their names and bank account information to
BARBOSA to use in creating accounts. In return, BARBOSA sent DA FONSECA the login
information for the drivers to use. - DA FONSECA and BARBOSA also coordinated to link debit cards associated with
the Delivery Company D accounts they created to bank accounts. Based on my knowledge of the
investigation, I know that Delivery Company D provides drivers with a debit card to use to
purchase the items that drivers pick up and deliver for Delivery Company D’s customers. DA
FONSECA instructed BARBOSA to have activation kits containing these debit cards sent to
specified addresses, and he sent BARBOSA photographs of the debit cards and screenshots of the
bank account information to be linked to the cards. - DA FONSECA and BARBOSA also coordinated to receive referral bonuses from
the Rideshare/Delivery Companies in connection with the creation of fraudulent driver accounts
and communicated with each other about account deactivations and other issues. For instance, on
or around December 23, 2019, BARBOSA told DA FONSECA, in substance, that Rideshare
Company A had deactivated 75% of her accounts, which she suspected were accounts where the
Social Security number she had purchased did not actually correspond to the victims’ identities.
The same day, DA FONSECA told BARBOSA he was looking at the “bills,” and BARBOSA sent
51
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 52 of 68
him images of Delivery Company D’s app opened to the referral page, showing delivery progress
and referral bonus amounts for various names under which they had opened accounts.
- In or about July 2020, DA FONSECA sent BARBOSA a link to a news article
about a Rideshare/Delivery Company and the availability of its customers’ personal data online.
DA FONSECA explained to BARBOSA that the news article referenced a DarkNet that sold
information about Delivery Company E’s customers. BARBOSA asked DA FONSECA if she
should be concerned, and DA FONSECA told her, in substance, “No more than you already are.” - I have reviewed statements from a Bank of America account for DA FONSECA
which reflect payments from Rideshare/Delivery companies totaling approximately $77,011
between March 2019 and December 2020, including payments of approximately $45,761
referencing the names of at least 25 other individuals. The bank statements also reflect Zelle
transfers from BARBOSA to DA FOSNECA during this period totaling approximately $12,000.
Defendant Q - The investigation has revealed that, as part of the scheme, Defendant Q
prepared and submitted applications using fraudulent identifiers; rented and sold fraudulent driver
accounts; managed accounts; referred potential drivers to BARBOSA; and exchanged information
with other conspirators about how to circumvent the Rideshare/Delivery Companies’ fraud
detection systems. - Defendant Q communicated with BARBOSA and AGUIAR via
WhatsApp at the telephone number (the “Defendant Q
TELEPHONE”). I have reviewed computer-generated translations of these chats. In the chat with
BARBOSA, Defendant Q and BARBOSA shared screenshots confirming that they
sent funds to each other. I have reviewed Bank of America records for BARBOSA that reflect
52 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 53 of 68
corresponding transfers to an account in Defendant Q ’s name. Additionally,
Defendant Q BARBOSA listed the Defendant Q phone as “ ” in her contacts. AGUIAR listed
Defendant Q Defendant Q as “ [Delivery Company B]” in his contacts. - In or about December 2019, AGUIAR contacted Defendant Q via
WhatsApp to see if he knew anyone interested in renting Delivery Company B accounts. There
was no indication of a response in AGUIAR’s iCloud Account. - In their WhatsApp chat, Defendant Q and BARBOSA discussed, in
substance, that Defendant Q was creating accounts for BARBOSA. For example, on
or about June 10, 2020, BARBOSA sent Defendant Q an image of Victim 21’s
driver’s license and Social Security number, and a passport-style photo and a “selfie” photo of
another individual, Co-Conspirator 13 (“CC-13”), as well as a vehicle registration and inspection
report for a Toyota Prius registered to CC-13. Delivery Company B records confirm that an
account (“Account 21”) in Victim 21’s name was created on or about October 7, 2020 in the area
of Hartford, Connecticut. The vehicle associated with Account 21 was associated with six other
accounts, all created in or around Chelsea, Massachusetts or Boston, Massachusetts. One of the
accounts, in the name of Victim 22, used an insurance card with an address of 2 Fairmont Street,
Woburn, Massachusetts. This address was also used in insurance documents on accounts
associated with AGUIAR. While the driver’s license information is different on each of these
accounts, the photo on the license and the associated “selfie” of the driver are the same. These
same photos were used on three other Delivery Company B accounts created in the same locations
in Boston and Chelsea. One of these accounts, in the name of Victim 23, was referred by an
account in the name of Victim 24 (“Account 24”). The photo on the image of Victim 24’s license
53
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 54 of 68
submitted to Delivery Company B and the accompanying “selfie” depict Defendant Q .
Account 24 is linked to 129 other Delivery Company B accounts. - On or about October 7, 2020, BARBOSA sent Defendant Q images of
three victims’ Massachusetts driver’s licenses and their Social Security numbers to create
fraudulent accounts for her, and told Defendant Q she had paid him for all three.
Venmo records reflect that, on or about October 6, 2020, BARBOSA paid Defendant Q
$750 from in or around Saugus, Massachusetts. On or about October 9, 2020,
Defendant Q asked BARBOSA if she wanted to receive the rents for the accounts
directly, from which she could send him his share. - On or about October 29, 2020, Defendant Q sent BARBOSA a
screenshot of photos saved on his phone that appear to be victims’ Social Security cards and
driver’s license images. - Defendant Q also managed accounts for BARBOSA. For example, on
or about October 9, 2020, Defendant Q sent BARBOSA an excerpt of a spreadsheet
reflecting victims’ names, phone numbers, email addresses used to open accounts, Social Security
numbers, dates of birth, the first names of the drivers using the accounts, whether the accounts
were being rented or sold, the price, and whether the accounts were with Rideshare Company A
or Delivery Company B. Victim 21’s name appears in the spreadsheet, as well as one of the victims
whose information BARBOSA sent Defendant Q on or about October 7, 2020.
Defendant Q gave BARBOSA regular updates on the status of the accounts.
Defendant Q also sent BARBOSA screenshots of his conversations with drivers
renting the accounts to keep her updated on their status.
54 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 55 of 68 - Defendant Q also referred prospective drivers to BARBOSA. For
example, on or about October 9, 2020, Defendant Q asked BARBOSA, in substance,
if she had any Rideshare Company C accounts available for a friend in Florida. - Defendant Q also worked with another individual, CC-5, to obtain
Social Security numbers for BARBOSA. For example, on or about October 16, 2020,
Defendant Q notified BARBOSA, in substance, that CC-5 was unable to locate the
Social Security number corresponding to a victim whose a driver’s license BARBOSA had sent
Defendant Q , but was able to locate the Social Security number for a different victim.
Defendant Q also referenced CC-5 on or about October 24, 2020, when he sent
BARBOSA an updated spreadsheet tracking the accounts he managed for her, and added that he
had not talked to CC-5 about the rental amounts listed in the spreadsheet. - Defendant Q also relayed information to BARBOSA about the
Rideshare/Delivery Companies’ fraud detection systems. For example, on or about October 21,
2020, Defendant Q notified BARBOSA, in substance, that an account he had applied
for the previous day had been terminated before the background check was completed and
indicated that he was going to analyze what happened to figure out how to prevent accounts from
being closed before they were opened. On or about October 31, 2020, Defendant Q
told BARBOSA that, prior to the COVID-19 pandemic, he would accompany a friend who had an
account with Rideshare Company A to Rideshare Company A’s local office to learn about how
the company reviewed accounts. - In a chat on or about October 26, 2020, Defendant Q and BARBOSA
discussed, in substance, who edited driver’s licenses for them.
55 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 56 of 68 - Zelle and Venmo records confirm that, between in or about October 2020 and in or
about November 2021, Defendant Q received approximately $2,800 from
BARBOSA. Between in or about April 2020 and in or about December 2020, Defendant Q
received approximately $9500 from CC-5. Between in or about November 2019 and in
or about July 2020, Defendant Q received approximately $4,170 from Defendant R.
Defendant R - The investigation has revealed that, as part of the scheme, Defendant R exchanged
driver’s licenses and Social Security numbers with BARBOSA and exchanged information with
other conspirators about how to circumvent the Rideshare/Delivery Companies’ fraud detection
systems. - Defendant R communicated with BARBOSA via WhatsApp using the phone
number (the “Defendant R TELEPHONE”). The Defendant R TELEPHONE is
associated with a Zelle account in Defendant R’s name. - I have reviewed a computer-generated translation of the chat between Defendant R
and BARBOSA. In or about April 2020, Defendant R sought BARBOSA’s help with a Delivery
Company E account. Defendant R assured BARBOSA, in substance, that he would not “get in
the way” of her work. Defendant R also asked BARBOSA about issues related to using a “bot”
with one or more apps. - Defendant R and BARBOSA also exchanged victims’ driver’s licenses and Social
Security numbers. For example, in or about June 2020, Defendant R sent BARBOSA nine Illinois
driver’s license images, and BARBOSA replied with corresponding Social Security numbers. In
connection with this exchange, Defendant R sent BARBOSA a Zelle transfer of $900.
56 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 57 of 68 - I reviewed bank statements for a Bank of America account for Defendant R.
Between in or about December 2018 and in or about December 2020, Defendant R received
deposits totaling more than $102,000 from Rideshare/Delivery Companies, including payments of
more than $51,000 in the name of at least 33 other individuals. Defendant R also received over
$258,000 in Zelle transfers, including recurring payments from several individuals, such as
Defendant Q , in amounts consistent with the rental of accounts.
THE PREMISES CONTAIN EVIDENCE, FRUITS, AND INSTRUMENTALITIES - I also have probable cause to believe that the premises contain fruits, evidence, and
instrumentalities of violations of the TARGET OFFENSES, as described in Attachment B. - On or about April 5, 2021, the Honorable Judith G. Dein issued a warrant for precise
location information (GPS E-911 data) with respect to the mobile phone assigned number 207-
300-3003, used by BARBOSA, for which T-Mobile is the service provider. Information from that
warrant has regularly placed BARBOSA in the vicinity of the BARBOSA/ABREU RESIDENCE
for the past month, including during overnight hours. Investigators have conducted surveillance
over the past month and observed BARBOSA and ABREU outside the BARBOSA/ABREU
RESIDENCE and vehicles registered to them in the driveway. Additionally, the
BARBOSA/ABREU RESIDENCE is listed as the mailing address on BARBOSA’s bank
statements. In WhatsApp chats with other conspirators, BARBOSA has stated, in substance, that
her roommate obtains driver’s licenses for her, which corresponds to ABREU’s activity in the
scheme. - In a directory dated as of April 23, 2021, the management company for the DA
SILVA RESIDENCE listed DA SILVA and an individual believed to be DA SILVA’s spouse as
the current residents of the DA SILVA RESIDENCE. The DA SILVA RESIDENCE is listed on
57 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 58 of 68
an identification for DA SILVA issued by the Massachusetts Registry of Motor Vehicles. DA
SILVA has a Toyota Prius registered in his name at the DA SILVA RESIDENCE. Investigators
have conducted physical surveillance over the past month and observed that vehicle parked in
different spots outside of the DA SILVA RESIDENCE on at least three separate occasions,
including during overnight hours. Based on my training and experience, I am aware that
individuals often spend overnight hours in their own residence, and will leave their vehicle parked
outside their residence overnight. While investigators have not yet observed DA SILVA at the
residence, I am aware from my involvement in this investigation that DA SILVA does not hold a
regular, “9-5” job, and keeps irregular hours. Public records available to law enforcement also list
the DA SILVA RESIDENCE as the likely residence for DA SILVA. Specifically, these records
reflect that Experian identified the DA SILVA RESIDENCE as the most reliable of the possible
addresses for DA SILVA. - From my training and experience, I know that locations occupied by a target will
contain evidence that will aid in establishing the “who, what, why, when, where, and how” of the
criminal conduct under investigation, thus enabling the United States to establish and prove each
element or, alternatively, to exclude the innocent from further suspicion. I believe it is likely that
the BARBOSA/ABREU RESIDENCE and DA SILVA RESIDENCE will contain evidence of the
TARGET OFFENSES, including, without limitation, computers and cell phones used in the
offense, including those used to create accounts, send or receive payments, track accounts, and
communicate with conspirators; debit cards and welcome kits mailed by the Rideshare/Delivery
Companies; records of driver accounts created, victim personal identifying information, drivers
renting accounts, payments made or received in connection with the scheme, or concerning Bitcoin
purchases or the transfer of funds to bank accounts in Brazil; and cash.
58 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 59 of 68
SEIZURE OF COMPUTER EQUIPMENT AND DATA - From my training, experience, and information provided to me by other agents, I
am aware that individuals frequently use computers to create and store records of their actions by
communicating about them through email, instant messages, and updates to online social
networking websites; drafting letters; keeping their calendars; arranging for travel; storing
pictures; researching topics of interest; buying and selling items online; and accessing their bank,
financial, investment, utility, and other accounts online. - Based on my training, experience, and information provided by other law
enforcement officers, I know that many cell phones (which are included in Attachment B’s
definition of “hardware”) can now function essentially as small computers. Phones have
capabilities that include serving as a wireless telephone to make audio calls, digital camera,
portable media player, GPS navigation device, sending and receiving text messages and emails,
and storing a range and amount of electronic data. Examining data stored on devices of this type
can uncover, among other things, evidence of communications and evidence that reveals or
suggests who possessed or used the device. - Here, the defendants communicated with each other and other conspirators via
WhatsApp and text message. They used their phones and computers to obtain driver’s licenses
and Social Security numbers, edit driver’s licenses, create driver accounts with the
Rideshare/Delivery Companies, rent or sell accounts, advertise their scheme, coordinate on
pricing, purchase “bots” and GPS “spoofing” technology, share tips about how to circumvent the
Rideshare/Delivery Companies’ fraud detection systems, refer other drivers to the scheme, and
transfer money.
59
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 60 of 68 - Based on my knowledge, training, experience, and information provided to me by
other agents, I know that computer files or remnants of such files can be recovered months or years
after they have been written, downloaded, saved, deleted, or viewed locally or over the Internet.
This is true because:
a. Electronic files that have been downloaded to a storage medium can be stored for
years at little or no cost. Furthermore, when users replace their computers, they can
easily transfer the data from their old computer to their new computer.
b. Even after files have been deleted, they can be recovered months or years later
using forensic tools. This is so because when a person “deletes” a file on a
computer, the data contained in the file does not actually disappear; rather, that data
remains on the storage medium until it is overwritten by new data, which might not
occur for long periods of time. In addition, a computer’s operating system may
also keep a record of deleted data in a “swap” or “recovery” file.
c. Wholly apart from user-generated files, computer storage media—in particular,
computers’ internal hard drives—contain electronic evidence of how the computer
has been used, what it has been used for, and who has used it. This evidence can
take the form of operating system configurations, artifacts from operating system
or application operation, file system data structures, and virtual memory “swap” or
paging files. It is technically possible to delete this information, but computer users
typically do not erase or delete this evidence because special software is typically
required for that task.
d. Similarly, files that have been viewed over the Internet are sometimes automatically
downloaded into a temporary Internet directory or “cache.” The browser often
60 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 61 of 68
maintains a fixed amount of hard drive space devoted to these files, and the files
are overwritten only as they are replaced with more recently viewed Internet pages
or if a user takes steps to delete them.
e. Data on a storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file). Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active. Web browsers, email
programs, and chat programs store configuration information on the storage
medium that can reveal information such as online nicknames and passwords.
Operating systems can record additional information, such as the attachment of
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
created, although this information can later be falsified. - As explained herein, information stored within a computer and other electronic
storage media may provide crucial evidence of the “who, what, why, when, where, and how” of
the criminal conduct under investigation, thus enabling the United States to establish and prove
each element or alternatively, to exclude the innocent from further suspicion. In my training and
experience, information stored within a computer or storage media (e.g., registry information,
communications, images and movies, transactional information, records of session times and
durations, Internet history, and anti-virus, spyware, and malware detection programs) can indicate
who has used or controlled the computer or storage media. This “user attribution” evidence is
61
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 62 of 68
analogous to the search for “indicia of occupancy” while executing a search warrant at a residence.
The existence or absence of anti-virus, spyware, and malware detection programs may indicate
whether the computer was remotely accessed, thus inculpating or exculpating the computer owner.
Further, computer and storage media activity can indicate how and when the computer or storage
media was accessed or used. For example, as described herein, computers typically contain
information that log: computer user account session times and durations, computer activity
associated with user accounts, electronic storage media that connected with the computer, and the
IP addresses through which the computer accessed networks and the Internet. Such information
allows investigators to understand the chronological context of computer or electronic storage
media access, use, and events relating to the crimes under investigation. Additionally, some
information stored within a computer or electronic storage media may provide crucial evidence
relating to the physical location of other evidence and the suspect. For example, images stored on
a computer may both show a particular location and have geolocation information incorporated
into its file data. Such file data typically also contains information indicating when the file or
image was created. The existence of such image files, along with external device connection logs,
may also indicate the presence of additional electronic storage media (e.g., a digital camera or
cellular phone with an incorporated camera). The geographic and timeline information described
herein may either inculpate or exculpate the computer user. Last, information stored within a
computer may provide relevant insight into the computer user’s state of mind as it relates to the
offense under investigation. For example, information within the computer may indicate the
owner’s motive and intent to commit a crime (e.g., Internet searches indicating criminal planning),
or consciousness of guilt (e.g., running a “wiping” program to destroy evidence on the computer
or password protecting/encrypting such evidence in an effort to conceal it from law enforcement).
62 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 63 of 68
- A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how computers
were used, the purpose of their use, who used them, and when. - The process of identifying the exact files, blocks, registry entries, logs, or other
forms of forensic evidence on a storage medium that are necessary to draw an accurate conclusion
is a dynamic process. While it is possible to specify in advance the records to be sought, computer
evidence is not always data that can be merely reviewed by a review team and passed along to
investigators. Whether data stored on a computer is evidence may depend on other information
stored on the computer and the application of knowledge about how a computer behaves.
Therefore, contextual information necessary to understand other evidence also falls within the
scope of the warrant. - Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a particular thing is not present
on a storage medium. For example, the presence or absence of counter-forensic programs or antivirus programs (and associated data) may be relevant to establishing the user’s intent. - Based on my knowledge and training and the experience of other agents with whom
I have spoken, I am aware that to completely and accurately retrieve data maintained in computer
hardware, computer software or storage media, to ensure the accuracy and completeness of such
data, and to prevent the loss of the data either from accidental or programmed destruction, it is
often necessary that computer hardware, computer software, and storage media (“computer
equipment”) be seized and subsequently processed by a computer specialist in a laboratory setting
rather than in the location where it is seized. This is true because of:
63 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 64 of 68
a. The volume of evidence that storage media such as hard disks, flash drives,
CDs, and DVDs can store is the equivalent of thousands or, in some instances, millions of
pages of information. Additionally, a user may seek to conceal evidence by storing it in
random order or with deceptive file names. Searching authorities may need to examine all
the stored data to determine which particular files are evidence, fruits, or instrumentalities
of criminal activity. This process can take weeks or months, depending on the volume of
data stored, and it would be impractical to attempt this analysis onsite.
b. Technical requirements analyzing computer hardware, computer software
or storage media for criminal evidence is a highly technical process requiring expertise and
a properly controlled environment. The vast array of computer hardware and software
available requires even computer experts to specialize in some systems and applications.
Thus, it is difficult to know, before the search, which expert possesses sufficient specialized
skill to best analyze the system and its data. Furthermore, data analysis protocols are
exacting procedures, designed to protect the integrity of the evidence and to recover even
“hidden,” deleted, compressed, or encrypted files. Many commercial computer software
programs also save data in unique formats that are not conducive to standard data searches.
Additionally, computer evidence is extremely vulnerable to tampering or destruction, both
from external sources and destructive code imbedded in the system as a “booby trap.”
Consequently, law enforcement agents may either copy the data at the premises to be searched or
seize the computer equipment for subsequent processing elsewhere. - The Premises may contain computer equipment whose use in the crimes or storage
of the things described in this warrant is impractical to determine at the scene. Computer
equipment and data can be disguised, mislabeled, or used without the owner’s knowledge. In
64 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 65 of 68
addition, technical, time, safety, or other constraints can prevent definitive determination of their
ownership at the premises during the execution of this warrant. If the things described in
Attachment B are of the type that might be found on any of the computer equipment, this
application seeks permission to search and seize it onsite or off-site to determine their true use or
contents, regardless of how the contents or ownership appear or are described by people at the
scene of the search. - The law enforcement agents will endeavor to search and seize only the computer
equipment which, upon reasonable inspection and/or investigation conducted during the execution
of the search, reasonably appear to contain the evidence in Attachment B because they are
associated with (that is used by or belong to) BARBOSA, ABREU, or DA SILVA. If, however,
the law enforcement agents cannot make a determination as to use or ownership regarding any
particular device, the law enforcement agents will seize and search that device pursuant to the
probable cause established herein. - This warrant authorizes a review of electronically stored information,
communications, other records, and information seized, copied or disclosed pursuant to this
warrant to locate evidence, fruits, and instrumentalities described in this warrant. The review of
this electronic data may be conducted by any government personnel assisting in the investigation,
who may include, in addition to law enforcement officers and agents, attorneys for the government,
attorney support staff, and technical experts. Pursuant to this warrant, the FBI may deliver a
complete copy of the seized, copied, or disclosed electronic data to the custody and control of
attorneys for the government and their support staff for their independent review.
65 Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 66 of 68
UNLOCKING A DEVICE USING BIOMETRIC FEATURES - I know from my training and experience, as well as from information found in
publicly available materials, that some models of cellphones made by Apple and other
manufacturers offer their users the ability to unlock a device via the use of a fingerprint or through
facial recognition, in lieu of a numeric or alphanumeric passcode or password. - On the Apple devices that have this feature, the fingerprint unlocking feature is
called Touch ID. If a user enables Touch ID on a given Apple device, he or she can register up to
five fingerprints that can be used to unlock that device. The user can then use any of the registered
fingerprints to unlock the device by pressing the relevant finger(s) to the device’s Touch ID sensor.
In some circumstances, a fingerprint cannot be used to unlock a device that has Touch ID enabled,
and a passcode must be used instead, such as: (1) when more than 48 hours has passed since the
last time the device was unlocked and (2) when the device has not been unlocked via Touch ID in
8 hours and the passcode or password has not been entered in the last 6 days. Thus, in the event
law enforcement encounters a locked Apple device, the opportunity to unlock the device via Touch
ID exists only for a short time. Touch ID also will not work to unlock the device if (1) the device
has been turned off or restarted; (2) the device has received a remote lock command; or (3) five
unsuccessful attempts to unlock the device via Touch ID are made. - The passcode that would unlock device(s) found during the search of the Subject
Premises is not currently known to law enforcement. Thus, it may be useful to press the finger(s)
of the user(s) of the device(s) to the device’s fingerprint sensor or to hold the device up to the face
of the owner in an attempt to unlock the device for the purpose of executing the search authorized
by this warrant. The government may not otherwise be able to access the data contained on those
devices for the purpose of executing the search authorized by this warrant.
66
Case 1:21-mj-05202-JGD Document 7-1 Filed 05/07/21 Page 67 of 68 - In my training and experience, the person who is in possession of a device or has
the device among his or her belongings at the time the device is found is likely a user of the device.
However, in my training and experience, that person may not be the only user of the device whose
fingerprints are among those that will unlock the device and it is also possible that the person in
whose possession the device is found is not actually a user of that device at all. Furthermore, in
my training and experience, I know that in some cases it may not be possible to know with certainty
who is the user of a given device, such as if the device is found in a common area of a premises
without any identifying information on the exterior of the device. Thus, it may be necessary for
law enforcement to have the ability to require any occupant of the Subject Premises to press their
finger(s) against the sensor of the locked device(s) or place the devices in front of their faces in
order to attempt to identify the device’s user(s) and unlock the device(s). - For these reasons, I request that the Court authorize law enforcement to press the
fingers (including thumbs) of individuals found at the Premises to the sensor of the devices or
place the devices in front of their faces for the purpose of attempting to unlock the device to search
the contents as authorized by this warrant.
67 Case 1:21-mj-05202-JGD Document 7 Filed 05/07/21 Page 2 of 2
