Page 1
Approved: Mu CHRISTOiHER D. FREAssista t United S tes Attorney Before: HONORABLE THEODORE H. KATZ ‘ United States Magistrate JudgeSouthern District of New York SEALED COMPLAINTUNITED STATES OF AMERICA _ Violations of - v. ~ : l8 U.S.C. §§ 1343, 2320 and 2LUCAS TOWNSEND HENDERSON, COUNTY OF OFFENSE:Defendant. : NEW YORK SOUTHERN DISTRICT OF NEW YORK, SS . : ANDRE G. CICERO, being duly sworn, deposes and says that he is a Special Agent with the Federal Bureau of Investigation (“FBI”) , and charges as follows: COUNT ONE (Wire Fraud) 1. From at least in or about July 2010, up to and including in or about March 2011, in the Southern District of New York and elsewhere, LUCAS TOWNSEND HENDERSON, the defendant, unlawfully, willfully, and knowingly, having devised andintending to devise a scheme and artifice to defraud, and forobtaining money and property by means of false and fraudulentpretenses, representations, and promises, transmitted and causedto be transmitted by means of wire and radio communication ininterstate and foreign commerce, writings, signs, signals, pictures, and sounds for the purpose of executing such scheme and artifice, to wit, HENDERSON participated in a scheme to defraud coupon issuers and retailers through the creation and subsequent use of counterfeit online coupons, and, in furtherance of thatscheme, HENDERSON caused the transmission of several of thosecounterfeit coupons over the Internet from Rochester, New York to an individual located in Springfield, Illinois. (Title 18, United States Code, Sections 1343 and 2 . )
Page 2
COUNT TWO (Trafficking in Counterfeit Goods) 2 . From at least in or about July 2010, up to and including in or about March 2011, in the Southern District of NewYork and elsewhere, LUCAS TOWNSEND HENDERSON, the defendant, unlawfully, intentionally, and knowingly did traffic and attemptto traffic in goods and services, and did knowingly use a counterfeit mark on and in connection with such goods and services, and did intentionally traffic and attempt to traffic in labels, patches, stickers, wrappers, badges, emblems, medallions, charms, boxes, containers, cans, cases, hangtags, documentationand packaging of a type and nature, knowing that a counterfeitmark has been applied thereto, the use of which is likely tocause confusion, to cause mistake, and to deceive, to wit,HENDERSON created and thereafter disseminated over the Internetvarious online coupons bearing counterfeit marks, including the“Powered by SmartSource” slogan and a distinctive border. (Title 18, United States Code, Sections 2320 (a) (1) and 2 .) The bases for my knowledge and the foregoing charges are, in part, as follows: 3 . I am a Special Agent with the FBI, and I have been involved in the investigation of this matter. The informationcontained herein is based upon my personal knowledge and my review of documents and records gathered during the course ofthis investigation, as well as information obtained, directly orindirectly, from other sources and law enforcement agents. Because this affidavit is being submitted for the limited purpose of establishing probable cause, it does not include all of the facts that I have learned during the course of the investigation. Where the contents of documents and the actions, statements and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. 4 . Since at least in or about July 2010, I and otheragents with the FBI have been conducting an investigation into the creation and subsequent distribution over the Internet of counterfeit online coupons. These coupons are designed to look like legitimate coupons that are offered on the Internet atwww.SmartSource.com (the “SmartSource Website”) , and produced by News America Marketing, a subsidiary of News Corporation, which is based in New York, New York. The SmartSource Website offers discount coupons to consumers for a wide range of consumer products. Consumers who wish to obtain coupons for products via the SmartSource Website must first download software that enables
Page 3
them to print coupons. Once that software is installed, a consumer can review a list of coupons, make selections from that list, and print specific coupons from his or her home printer.These coupons typically expire within a period of anywhere from several days to several months . 5. My investigation began when News America Marketingreported to the FBI that a rash of counterfeit online coupons, in the SmartSource likeness, were being redeemed in stores acrossthe country. These counterfeit coupons consistently employ alogo which reads “Powered by SmartSource" as well as adistinctive border, both of which are trademarks that have been registered with the United States Patent and Trademark Office byNews America Marketing. Since the investigation began, these counterfeit coupons have ranged from lower priced consumer items such as energy drinks, beer, cigarettes and cosmetic products, tomore expensive consumer items such as electronic goods, including X~Box and PlayStation video game consoles. From my conversationswith individuals at News America Marketing, I have learned thatwhen these counterfeit coupons are used by consumers, three types of losses can result. First, if the manufacturers of consumer products honor the coupons, which they often do to maintain relationships with their retailers, they bear direct financial loss when a retailer seeks compensation for a fake coupon thathas been redeemed. Second, if the manufacturer does not honor the coupon, the retailer bears the cost. Finally, in both circumstances, consumers bear the cost of price increases passedon by manufacturers and/or retailers, particularly mom and pop stores, to cover the cost of the fraud. For example, in or aboutDecember 2010, $200, 000 worth of such counterfeit coupons for Tide laundry detergent were redeemed by consumers over a two to three week period. Notably, Proctor & Gamble, which manufacturers Tide and is the single largest coupon issuer in theUnited States, has never issued a single online print-at-home coupon. The costs associated with the redemption of those counterfeit coupons were subsequently borne by Proctor & Gamble and the various retailers victimized by consumers who redeemed the fraudulent coupons. 6 . In the course of the investigation, I haveidentified a number of individuals posting, among other things,(1) counterfeit coupons; (2) advice concerning the redemption of these counterfeit coupons; and (3) instructions or tutorials for creating these counterfeit coupons on at least two Internetmessage board websites:
www.4chan.org (the “4chan Website") andwww.zoklet.net (the “Zoklet Website”) . Based on my training andexperience, as well as my participation in this investigation, I know that users posting on these message board websites generally
Page 4
employ nondescript user names. In connection with thisinvestigation, I have reviewed these posts and have identifiedthe “handles” or “nicknames” used by two of the perpetrators of the criminal activity described above: an individual who refersto himself as “Coupon Guy" and another individual who has employed the user names “Anonymous123 , ” “Anonymous 234, " and“Anonymous3 4 5 . ” 7. Based on my review of postings made on the Zoklet Website and information provided by internet service providershosting the Internet Protocol (“IP”) addresses associated with those posts, I know the following, among other things: a. Posts made on the Zoklet.net Website by the user “Anonymous123, " “Anonymous.234, ” and “Anonymous345” have, byand large, had anonymous IP addresses associated with thoseposts. Based on my review of those anonymous IP addresses, I believe that the individual employing those user names is using the Tor network. Tor is a system intended to enable online anonymity, by using specialized software and a network of serversto hide information about users’ locations and other factorswhich might identify them. Users of this system make it moredifficult to trace internet traffic, including visits to websites, online posts, instant messages, and other communication forms, back to them. Tor works by relaying communicationsthrough a network of systems run by volunteers in various locations throughout the world. Because the IP address of thesender and the recipient are not both readable at any step alongthe way, someone engaging in network traffic analysis and surveillance at any point along the line cannot directly identify which systems are involved in the communication. b. On or about July 13, 2010, an individual employing the user ID of “Anonymous123" posted fourteen (14)counterfeit coupons on the Zoklet Website, including coupons for PowerBars, Campbell's Soup at Hand, SmartOnes TV Dinners, Bagel Bites, and Magic Hat Beer, among other various food and beverage items. In so doing, “Anonymous 123” wrote in relevant part:“Most if not all of these have been tested. . . . For those whodon’ t know how to reach the instructions that are on many of these, basically, you can print them off any old printer, on regular paper, and use them at most stores. In windows, justsave the image to your computer, right click it, and choose print. Do full page photo print or something.” The IP address associated with this post was an anonymous IP address.
Page 5
c. On or about July 17, 2010, an individualemploying the user ID of “Anonymousl23” posted a message on theZoklet Website, in which that user indicated that a new tutorialfor making counterfeit coupons was nearing completion, “from what coupon guy said on a certain image board the yesterday (sic) ” (the “July 17, 2010 Post") . The IP address associated with theJuly 17, 2010 Post was an anonymous IP address. d. On or about July 18, 2010, an individualemploying the user ID of “Anonymous123” posted a message on theZoklet Website. In that post, “Anonymousl23” wrote, among otherthings: “$7. 00 off a 40 oz bag of hershey' s kisses. Think about it. You can give someone special around 8x the chocolate you might normally be able to get them for the normal price. I don‘ trecommend you use 8 of these coupons at once though, as spending$8 (plus tax) , for about $60 worth of chocolate might look suspicious . " “Anonymous123" also included an image of “A NoteFrom The Author" in this post, which “Anonywnous123” described ashaving been written by “Coupon Guy" in connection with the new tutorial for making counterfeit coupons. The IP address associated with this post was an anonymous IP address. e. On or about July 19, 2010, an individualemploying the user ID of “Anonymous234” posted a message on theZoklet Website, in which that user indicated that he had beenbanned from making posts under his previous user ID (i.e. ,“Anonymous123") and referenced his July 17, 2010 Post . Amongother things, “Anonymous234” wrote: “Weird. I got banned forsome reason. AFAIK I wasn’ t breaking any rules . Then again, Inever read the rules either. ” The IP address associated with this post was an anonymous IP address. f. On or about July 22, 2010, an individual employing the user ID of “Anonymous234" posted an image of thecover of a “How to Make Coupons" tutorial on the Zoklet Website,writing “If anyone is interested, here' s something Coupon Guyposted last night, to give people an idea of what to look for when he does release his new tutorial.” The IP addressassociated with this post was an anonymous IP address. g. On or about July 26, 2010, an individualemploying the user ID of “Anonymous234” posted a message on theZoklet Website, in which he admitted having a file of the “How to Make Coupons” tutorial on his hard drive. In addition, “Anonymous234” wrote: “
f you want some coupons for beer, here' s a few from my own collection. . . . What’ s more they’ 11 work at walmart self checkouts, at least the ones that I have tried. At walmart self checkouts, the watcher person wills
Page 6
till (sic) need to come over and check your ID. But as long asyou don' t use more than $20 worth of coupons, they won' t have tocheck the coupons . ” “Anonymous234” also posted three counterfeit coupons for beer. The IP address associated with this post was an anonymous IP address. h. On or about September 29, 2010, an individual employing the user ID of “AnonymousB45” posted a message on theZoklet Website, in which he claimed that the new version of the “How to Make Coupons" tutorial was just released and provided a link to the full copy of that tutorial, hosted on the 4chanWebsite. The IP address associated with this post was ananonymous IP address. i. On or about September 30, 2010, an individualemploying the user ID of “Anonymous345” posted a message on the Zoklet Website, in which he stated that he previously employedthe user ID of “Anonymous234 . " Among other things, “Anonymous345” wrote: “TRUTH! I'm looking at the tutorial with my own eyes. If you’ re at all familiar with the old coupon thread, which apparently is no longer a sticky, I'm the same guy as anonymous234. . ” The IP address associated with this post wasan anonymous IP address. j . From reviewing information provided by the operator of the Zoklet Website, I know that an individual employing the user ID of “Anonymous345” posted a message on the Zoklet Website on or about October 14, 2010 at approximately 2:17a.m. That posting recorded an associated IP address of 129 .21. 82 . 115 (the “115 IP Address”) , and a host name for the 115 IP Address associated with the Rochester Institute of Technology (“RIT”) . 8 . From reviewing information provided by RIT, I knowthat from approximately 6: 06 p.m. on or about October 13, 2010, up to and including approximately 5:20 p.m. on or about October 14, 2010, the 115 IP Address was assigned to RIT student LUCAS TOWNSEND HENDERSON, the defendant. I also know that HENDERSON has provided RIT with an e—mail address of “lucashenderson@gmail.com." ' 9. From reviewing information provided by Google, including information regarding session timestamps and originating IP addresses for logins of the Google e~mail account“lucashenderson@gmail.com, ” I know that on or about October 13,2010, the “lucashenderson@gmail . com” e-mail account was accessed six separate times, with each login recording the 115 IP Addressas the originating IP address. Moreover, I know that on or about
Page 7
October 14, 2010 at approximately 7:14 a.m., the “lucashenderson@gmail.com” email account was accessed, at which time the 115 IP Address was recorded by Google as being theoriginating IP address for that login. 10 . Based on conversations that I have had with various representatives of RIT, I know that LUCAS TOWNSENDHENDERSON, the defendant, is a member of the Class of 2013 and is currently enrolled in the College of Computing and InformationSciences at RIT. HENDERSON is pursuing a Bachelor of Sciences degree in Information Security and Forensics. 11. Based on my review of information contained on the publicly available Facebook page for LUCAS TOWNSEND HENDERSON, the defendant, I have learned that HENDERSON posted that he has been employed with the RIT ITS Helpdesk since June 2010, and thathe was employed by Walmart as a cashier in Lubbock, Texas from in or about January 2008 through in or about August 2008 . 12. Based on my review of postings made on the Zoklet Website and information provided by internet service providershosting the Internet Protocol (“IP”) addresses associated with those posts, I know the following, among other things: a. On or about August 2, 2010, an individual employing the user ID of “AnonymousO” posted a message on the Zoklet Website in response to the July 26, 2010 message posted by“Anonymous234” (whom I believe to be LUCAS TOWNSEND HENDERSON,the defendant) set forth in paragraph 7 (g) , above. Referencingthe three counterfeit coupons for beer that “Anonymous234” hadposted, “AnonymousO” wrote: “The bud/bud light coupon worked at agrocery store. Tried at a gas station, and apparently they don’ t accept online coupons (like most gas stations, as it’ s alreadybeen mentioned) . We continued to press out luck at a WalGreen’s. The cashier wasn't questioning it, he was just saying “Wow, that' s a hell of a coupon, So thank you, very much, anon,for 24 beers for ~$4." b. The Zoklet Website recorded the IP address of98 .228 .134 .184 (the “184 IP Address") as associated with theAugust 2, 2010 post by “AnonymousO . ”
Page 8
13 . Comcast Cable Communications (“Comcast”) providesInternet service and is the owner of the 184 IP Address. Fromreviewing documents obtained from Comcast, I know that the name and physical address associated with the 184 IP Address at the time of the August 2, 2010 post by “AnonymousO” described above in paragraph 12 was an individual with a residential addresslocated in Springfield, Illinois. 14 . On or about March 16, 2011, I and other lawenforcement agents executed a search warrant issued by a United States Magistrate Judge of the United States District Court forthe Western District of New York at the current residence of LUCAS TOWNSEND HENDERSON, the defendant. At that time, and amongother things, I and other law enforcement agents recovered anumber of coupons for various food and beverage items. Based on my training and experience, as well as my familiarity with this investigation, I believe these coupons to be examples ofcounterfeit online coupons in the SmartSource likeness. 15. In addition, on or about March 16, 2011, in connection with executing the search warrant described above inparagraph 14 , I and another FBI agent advised LUCAS TOWNSEND HENDERSON, the defendant, that he was free to leave and did not have to answer any of our questions. However, TOWNSEND elected to provide the following information: a. When asked about the Zoklet Website, HENDERSON indicated that he had heard of it, but “ [couldn’ t] say for sure” whether he had posted messages on it. b. When asked about the 4chan Website, HENDERSONindicated that he had heard of it, had visited it, and hadprobably posted messages on it in the past. c. When asked about his use of Tor, HENDERSONstated, “I use Tor on occasion. ” d. When asked about producing coupons, HENDERSONstated, “I did write the manual. I wrote what I could. I thought it was an interesting thing. Some of it’ s putting on anair, not necessarily my point of view. ”
Page 9
e. When asked whether he was “Anonym0us123, " “Anonymous234 , ” and/or “AnonymousB45, " HENDERSON stated, “Most of the time.” WHEREFORE, deponent respectfully requests that awarrant be issued for the arrest of LUCAS TOWNSEND HENDERSON, the defendant, and that he be arrested and imprisoned, or bailed, as the case may be. ANDRE G. CICERO Special AgentFederal Bureau of Investigation Sworn to before me this 10th day of May, 2011 ,,,,,, HONORABLE THEODORE H. KATZ UNITED STATES MAGISTRATE JUDGE SOUTHERN DISTRICT OF NEW YORK
source: http://webcache.googleusercontent.com/search?q=cache:UO95jlNQzdcJ:regmedia.co.uk/2011/05/12/lucas_henderson_criminal_complaint.pdf
source: [size=11px]http://regmedia.co.uk/2011/05/12/lucas_henderson_criminal_complaint.pdf[/size]
