,  ,$ ,  !,%!

,
",
,(,
 ,
8/2/2024
IN THE UNITED STATES DISTRICT COURT %,,% !, ,
FOR THE WESTERN DISTRICT OF VIRGINIA *, +,, ( ,
HARRISONBURG DIVISION '#, ,

UNITED STATES OF AMERICA )

) Case No.: _______________
5:24mj60
v. )
)
FRANK LUCIO CARILLO )
)

AFFIDAVIT IN SUPPORT OF
CRIMINAL COMPLAINT AND ARREST WARRANT

I, Melissa Macaron, a Special Agent with the Federal Bureau of Investigation (FBI),

being duly sworn, depose and state as follows:

A. PURPOSE OF AFFIDAVIT

1. I submit this affidavit to establish probable cause in support of a criminal complaint

charging FRANK LUCIO CARILLO, (“CARILLO”) with one violation of 18 U.S.C. § 871

(threatening the Vice President of the United States) occurring on or about July 27, 2024 in the

Western District of Virginia.

B. INTRODUCTION AND AGENT BACKGROUND

2. I am a Special Agent (SA) with the Federal Bureau of Investigation (FBI) and have

been so employed since 2020. I am currently assigned to the FBI Richmond, Virginia (VA), Field

Office, Winchester Resident Agency. As part of my duties as an FBI SA, I have investigated

criminal violations relating to, civil rights, violent gangs, drugs, and crimes against children. I

have received training and gained experience in interviewing and interrogation techniques, arrest

procedures, search warrant applications, the execution of searches and seizures, computer crimes,

computer evidence identification, child pornography identification, computer evidence seizure and

processing, and various other criminal laws and procedures.

1
 3. Your Affiant bases this affidavit upon personal knowledge and observations made

during the course of this investigation, and upon my personal review of records, documents, and

items lawfully obtained by third parties, public records, and interviews. Where the contents of

documents and the actions, statements and conversations of others are reported herein, they are

reported in substance and in part. The Affiant is familiar with the information contained in this

affidavit based upon the investigation I have conducted to date and based on my conversations

with other law enforcement officers who have been involved in this investigation, some of whom

have been engaged in numerous investigations involving domestic terrorism. Because this affidavit

is being submitted for the limited purpose of establishing probable cause for the issuance of an

arrest warrant, I have not included each and every fact I know about the investigation.

C. APPLICABLE LAW

4. I am aware that 18 U.S.C. § 871 makes it a crime for anyone to knowingly and

willfully make a threat to take the life of, to kidnap, or to inflict bodily harm against the President,

President-elect, Vice President or other officer next in the order of succession to the office of

President, or Vice President-elect.

5. Based on the facts set forth in this affidavit, there is probable cause to believe that

a violation of 18 U.S.C. § 871 has been committed by Frank Lucio CARILLO.

D. PROBABLE CAUSE

i. GETTR Threats

6. On July 27, 2024, at 2:47 p.m. EST, Maricopa County, Arizona, Recorder’s office

notified FBI Phoenix of potential threats to Maricopa County Recorder Stephen Richer made by

GETTR 1 username “joemadarats1”. Specifically, the “joemadarats1” GETTR account posted

1
GETTR is a social media platform and micro blogging website. User interface and features have been described as
very similar to “X”, formerly known as Twitter.

2
“someone need to remove this asshole permanently someone needs to kill this fuck.” FBI Phoenix

conducted further open-source research on the “joemadarats1” GETTR account and identified

further threatening statements directed at several public officials.

7. FBI Phoenix submitted legal process to GETTR and received responsive records

on July 29, 2024. The responsive records from GETTR revealed approximately 4,359 posts/replies

made by “joemadarats1” targeting various public officials including but not limited to: President

Joseph Biden, Vice President Kamala Harris, FBI Director Christopher Wray, Maricopa County

Recorder Stephen Richer, and many other public officials.

8. Vice President Kamala Harris was mentioned 19 times by the “joemadarats1”

account. Some examples of the violent comments aimed at Vice President Harris are below:

07/27/2024 – “Listen to me crappler Harris also known as cunt Harris you don't have a
snowballs chance in hell which is exactly where you're going and soon I will cut your
eyes out of your FUCKING head while you're alive bitch and I will make sure you
suffer a slow agonizing death you piece of shit”

07/27/2024 – “Kamala Harris needs to be put on fire alive I will do it personally if no

one else does it I want her to suffer a slow agonizing death”

07/27/2024 – “Harris is going to regret ever trying to become president because if that
ever happened I will personally pluck out her eyes with a pair of pliers but first I will
shoot and kill everyone that gets in my way that is a f****** promise”

07/27/2024 – “Just for being a Democrat you're going to die crap La Harris that's a
f****** promise I'm going to find you and your f****** family and I'm going to kill
you all you f****** waste of life I can't wait to rip your eyes out of your f****** head
with a pair of eyes you piece of s*** and nothing but scum of the Earth and you're going
to die like it”

07/27/2024 – “Crapler Harris is laying thieving piece of garbage like the rest of this
administration they all need to die and they will soon”

3
 9. On February 22, 2024, GETTR account “joemadarats1” posted on GETTR “I

HAVE MY AR-15 LOCKED AND LOADED”.

ii. Identification of CARILLO and NEDLEY

10. Through legal process, FBI Phoenix obtained the subscriber information from

GETTR USA, Inc., for GETTR account “joemadarats1”. Based on the responsive information

from GETTR with the date range of June 15, 2023, through July 28, 2024, the “joemadarats1”

account was created on June 15, 2023, and is associated with email address

[email protected].

a. GETTR Location Information

11. On or about July 27, 2024, GETTR user joemadarats1 posted 46 comments to the

GETTR service using two different Internet Protocol (IP) addresses. Posts submitted to GETTR

by joemadarats1 between 7:36 AM - 8:07 AM used IP address 172.58.253.113, and between 9:17

AM - 7:35 PM used IP address 204.111.228.117.

12. A review of open-source records indicate that the service provider for IP address

172.58.253.113 is T-Mobile USA, Inc, and the service provider for 204.111.228.117 is GLO Fiber,

which is a subsidiary of Shentel. GLO Fiber/Shentel was unable to provide subscriber information

associated with the IP address without a port number, which GETTR did not provide to law

enforcement.

b. Google Location Information

13. FBI Phoenix submitted legal process to Google, LLC, for subscriber and device

information connected to the [email protected] email address. Analysis of subscriber

information associated with Google account [email protected] revealed that the Google

account was created on or about January 18, 2020. The name associated with the

4
[email protected] account is “Joe Madarats” and included a recovery email of

[email protected] and recovery phone number of +1-610-762-5261 (herein, the Target

Cell Phone). IP addresses associated with login activity for [email protected] revealed

that the account used IP address 204.111.228.117 18 times on or about July 26, 2024 - July 29,

2024. In addition, on July 29, 2024, the [email protected] account used IP address

2607:fb91:dc4:aa75:2458:deff:fe94:c84f 1 time. Open-source records indicate that the service

provider for IP address 2607:fb91:dc4:aa75:2458:deff:fe94:c84f is T-Mobile USA, Inc.

14. Google, LLC, also provided the device IMEI number 356125201089732, which

belongs to an Android phone and is associated with the subject email account. The device account

identifiers also provide additional email accounts connecting to the target device which includes

email address [email protected], among others.

15. In addition, Google LLC provided logins to the account associated with

[email protected], which showed logins to the subject account on July 26-29, 2024,

were made with IP address 204.111.228.117. This IP address is the same IP address that is seen

with the threatening GETTR posts that were posted on GETTR by “joemadarats1” on July 27,

2024.

16. Analysis of the Google Location History records associated with Google account

[email protected] revealed 220 records with approximately device locations for the

moto g G5 device for July 27, 2024 between 4:09 AM - 10:03 PM. During this time period, all

220 records indicated that the moto g G5 device was in the immediate vicinity the Preston Place

Apartment and Townhomes located north of Airport Rd. This area includes the address of 207

Brigstock Dr, Winchester, Virginia. The entirety of the 220 records include a display radius of 6

meters to 123 meters. Analysis of records with a display radius of 20 meters or less indicated that

5
there are 71 records with approximate locations in the immediate vicinity of the townhomes on the

west side of the 200-block of Brigstock Drive (odd house numbers), which also includes the

address of 207 Brigstock Dr, Winchester, Virginia.

c. Android Device Information

17. Analysis of Google Android Device Configuration Service Data records indicated

that the mobile device used to login to the [email protected] account was a Motorola

moto g 5G uniquely identified with international mobile equipment identity (IMEI)

356125201089732. The moto g 5G was first used with Google's services on or about July 13,

2024 and continued through July 29, 2024. Google indicated that the subscriber identity module

(SIM) card associated with the phone were encoded with a mobile country code (MCC) of 310

and mobile network code (MNC) of 240 and 260. A MCC of 310 indicates that the service

provider associated with the SIM is in the United States, and both MNCs of 240 and 260 indicate

that the mobile network operator is T-Mobile USA, Inc. The last data connection indicated on the

Google records indicate that, at the time the Google records were obtained, the mobile device

connected from IP address 2607:fb91:dc4:aa75:2458:deff:fe94:c84f. This IP address is the same

IP address used to login to the [email protected] on July 29, 2024 and service is

provided by T-Mobile USA, Inc.

18. The Google Android Device Configuration Service Data also identified 6

additional Google accounts that were associated with the moto g 5G mobile device. Two of the

associated email addresses include [email protected] (recovery email for

[email protected]) and [email protected].

6
 d. T-Mobile Records

19. Legal process was sent to T-Mobile for subscriber information related to the Target

Cell Phone. T-Mobile returned responsive records identifying the subscriber to the target phone

number as Yvonne NEDLEY. NEDLEY and CARILLO are believed to be associates and have

lived together at multiple residences based on open-source database checks. Open-source checks

indicate that the phone number (610) 762-2760 is associated with NEDLEY while the target phone

number is associated with CARILLO.

e. Other Investigative Steps

20. Database checks including Department of Motor Vehicles (DMV) indicate that

CARILLO and NEDLEY reside at 207 Brigstock Drive, Winchester, Virginia. DMV records show

that CARILLO does not have any vehicles registered to his name.

21. Surveillance on July 30, 2024, conducted by an FBI Task Force Officer found one

vehicle located at the subject residence which was registered to NEDLEY.

22. Open-source Facebook checks identify a Facebook account using the name “Joe

Amarats”. The Facebook account does not have any pictures on it; however, it does have one

“friend” listed, which is Frankie Carillo, CARILLO’s son.

23. Open source checks identified a CashApp account associated with the Target Cell

Phone listed under the name of “Frank Carillo”.

24. Investigators made a phone call directly to the voicemail of the Target Cell Phone

and heard the voice of a male say “F.C.”. Based on my training and experience, the person who

has control over the cell phone device is most often the person whose name or nickname is left on

the voicemail identifying the user of the phone the caller will be leaving a voicemail for.

7
 25. Through database checks, investigators were able to find records indicating that

CARILLO purchased a firearm from Steel Reloaders, a store that sells weapons that is located in

Winchester, Virginia. Through open-source checks, investigators were able to find a Google

review written by Google account “Joe Amarats” of Steele Reloaders. The review written by “Joe

Amarats” recommends the store because they “know a lot about weapons”. The review was written

in approximately February 2024, around the time that investigators found record of CARILLO’s

firearm purchase.

iii. CARILLO and Firearms

26. As stated above, the subject GETTR account “joemadarats1” posted on GETTR

that the user had an “AR-15 locked and loaded”. The subject GETTR account also made numerous

other posts about firearms and shooting people. Some examples of the posts about shooting people

are below:

11/23/2023 – “DON'T WAIT FOR YOUR GOV. GO OUT WITH YOUR GUNS AND
KILL ALL MUSLIMS”

02/13/2024 – “FUCK YOU ASSHOLE SEND THEM TO YOUR HOUSE I WILL

SHOOT THEM FIRST”

03/23/2024 - LOOK AT ALL THE TARGET SHOOTING THEY MUST DIE”

03/24/2024 – “TRUDEAU IS A CLOWN PUPPET HE MUST BE TAKEN OUT AND

SHOT JUST LIKE BIDEN AND HIS ADMIN”

07/27/2024 – “They should be shot in the f****** head those lousy f****** CIA
b******* artist scumbags”

07/27/2024 – “I believe when he illegals show up to vote they should be shot in the head
quickly they are not allowed to vote so then they must die cuz if I see any of them I'll kill
them”

8
 iv. Search of CARILLO’S Residence

27. On August 2, 2024, a federal search warrant was executed at CARILLO’s residence

located at 207 Brigstock Drive, Winchester, Virginia 22602. At the time of execution, CARILLO

and NEDLEY were located inside the residence.

28. During his initial contact with law enforcement, CARILLO asked why this was

happening, and Special Agent Nicholas Olson, FBI, indicated it was related to something posted

online. A short time later, CARILLO, seemingly talking to himself, stated, “…for a comment.

This is ridiculous, for a comment. I guess I’m gonna need a lawyer.”

29. Additionally, CARILLO stated to another law enforcement officer, FBI Task Force

Officer Zachary Hawkins, if it was “about the online stuff. I posted it.” When CARILLO overhead

law enforcement personnel discussing firearms in the residence, he indicated he had a 9mm

handgun and an AR-15, which he had purchased in February.

30. Following his request for an attorney, CARILLO stated, “This is all over a

comment, huh?”

31. Following his arrest, CARILLO asked, “Is Yvonne being arrested?” When Special

Agent Steven W. Duke, FBI, replied, “I don’t know,” CARILLO stated, “She didn’t do anything.

I made the comments.”

32. NEDLEY was interviewed by law enforcement. According to NEDLEY, she and

CARILLO have resided in the townhouse for almost a year. During that time, no one else has

lived in the residence.

33. Among other items, federal agents seized an RF-15 rifle and a 9 mm handgun from

inside the residence. According to NEDLEY, those particular firearms belonged to CARILLO.

NEDLEY believed CARILLO purchased the handgun in 2023 and the rifle in 2024.

9
 34. NEDLEY identified CARILLO’s cell phone number as the Target Cell Phone (610-

762-5261) and his email address as [email protected]. NEDLEY indicated CARILLO has

used the cell phone number for over 10 years. As stated above, the cell phone number and the

email address were associated with the Gmail account associated with the subject GETTR account.

35. According to NEDLEY, CARILLO was active on a social media platform called

“Getta” (phonetic spelling). NEDLEY believed politics were discussed on the platform.

NEDLEY knew CARILLO to access the platform with their laptop computer. NEDLEY did not

know what CARILLO did on his cell phone.

36. NEDLEY identified aliases of CARILLO as “Joe Madrats” and “Bob Ugots.”

NEDLEY learned about these aliases from CARILLO. NEDLEY believed “Joe Madrats” was

associated with an email address.

37. NEDLEY identified their Internet Service Provider as GLO Fiber.

38. NEDLEY consented to a search of her cell phone. Three photos taken in May 2024

were discovered on NEDLEY’s cell phone. The photos depicted the screen of another cell phone

displaying email addresses and passwords. NEDLEY indicated the photos depicted CARILLO’s

cell phone displaying CARILLO’s email addresses and passwords. The photos were taken to

capture his passwords prior to getting a new cell phone. The photos displayed the following email

addresses: [email protected], [email protected], [email protected],

[email protected], and [email protected]. The email addresses

[email protected] and [email protected] sounded familiar to NEDLEY.

39. Law enforcement did not identify an application for GETTR or other indicia of

access of the website during their review of NEDLEY’s phone.

10
 E. CONCLUSION

40. Based on the information set forth in this affidavit, I submit that there is probable

cause to believe that on or about July 27, 2024, in the Western District of Virginia, the defendant,

FRANK LUCIO CARILLO, did knowingly and willfully make a threat to take the life of and to

inflict bodily harm upon the Vice President of the United States in violation of Title 18, United

States Code, Section 871.

41. Based on the forgoing, I request that the Court issue the proposed arrest warrant.

OATH

I declare under penalty of perjury that the foregoing is true and correct.

Respectfully submitted,
Digitally signed by MELISSA
MELISSA MACARON MACARON
Date: 2024.08.02 14:18:30 -04'00'

Melissa Macaron, Special Agent

Federal Bureau of Investigation

Received by reliable electronic means and sworn and attested to by telephone on this ____day
2nd of
August 2024.

________________________________________
C. KAILANI MEMMER
UNITED STATES MAGISTRATE JUDGE

11