Carillo Affidavit
Carillo Affidavit
Carillo Affidavit
,
", ,(,
,
8/2/2024
IN THE UNITED STATES DISTRICT COURT %,,% !, ,
FOR THE WESTERN DISTRICT OF VIRGINIA *, +,, ( ,
HARRISONBURG DIVISION '#, ,
AFFIDAVIT IN SUPPORT OF
CRIMINAL COMPLAINT AND ARREST WARRANT
I, Melissa Macaron, a Special Agent with the Federal Bureau of Investigation (FBI),
A. PURPOSE OF AFFIDAVIT
charging FRANK LUCIO CARILLO, (“CARILLO”) with one violation of 18 U.S.C. § 871
(threatening the Vice President of the United States) occurring on or about July 27, 2024 in the
2. I am a Special Agent (SA) with the Federal Bureau of Investigation (FBI) and have
been so employed since 2020. I am currently assigned to the FBI Richmond, Virginia (VA), Field
Office, Winchester Resident Agency. As part of my duties as an FBI SA, I have investigated
criminal violations relating to, civil rights, violent gangs, drugs, and crimes against children. I
have received training and gained experience in interviewing and interrogation techniques, arrest
procedures, search warrant applications, the execution of searches and seizures, computer crimes,
computer evidence identification, child pornography identification, computer evidence seizure and
1
3. Your Affiant bases this affidavit upon personal knowledge and observations made
during the course of this investigation, and upon my personal review of records, documents, and
items lawfully obtained by third parties, public records, and interviews. Where the contents of
documents and the actions, statements and conversations of others are reported herein, they are
reported in substance and in part. The Affiant is familiar with the information contained in this
affidavit based upon the investigation I have conducted to date and based on my conversations
with other law enforcement officers who have been involved in this investigation, some of whom
have been engaged in numerous investigations involving domestic terrorism. Because this affidavit
is being submitted for the limited purpose of establishing probable cause for the issuance of an
arrest warrant, I have not included each and every fact I know about the investigation.
C. APPLICABLE LAW
4. I am aware that 18 U.S.C. § 871 makes it a crime for anyone to knowingly and
willfully make a threat to take the life of, to kidnap, or to inflict bodily harm against the President,
President-elect, Vice President or other officer next in the order of succession to the office of
5. Based on the facts set forth in this affidavit, there is probable cause to believe that
D. PROBABLE CAUSE
i. GETTR Threats
6. On July 27, 2024, at 2:47 p.m. EST, Maricopa County, Arizona, Recorder’s office
notified FBI Phoenix of potential threats to Maricopa County Recorder Stephen Richer made by
1
GETTR is a social media platform and micro blogging website. User interface and features have been described as
very similar to “X”, formerly known as Twitter.
2
“someone need to remove this asshole permanently someone needs to kill this fuck.” FBI Phoenix
conducted further open-source research on the “joemadarats1” GETTR account and identified
7. FBI Phoenix submitted legal process to GETTR and received responsive records
on July 29, 2024. The responsive records from GETTR revealed approximately 4,359 posts/replies
made by “joemadarats1” targeting various public officials including but not limited to: President
Joseph Biden, Vice President Kamala Harris, FBI Director Christopher Wray, Maricopa County
account. Some examples of the violent comments aimed at Vice President Harris are below:
07/27/2024 – “Listen to me crappler Harris also known as cunt Harris you don't have a
snowballs chance in hell which is exactly where you're going and soon I will cut your
eyes out of your FUCKING head while you're alive bitch and I will make sure you
suffer a slow agonizing death you piece of shit”
07/27/2024 – “Harris is going to regret ever trying to become president because if that
ever happened I will personally pluck out her eyes with a pair of pliers but first I will
shoot and kill everyone that gets in my way that is a f****** promise”
07/27/2024 – “Just for being a Democrat you're going to die crap La Harris that's a
f****** promise I'm going to find you and your f****** family and I'm going to kill
you all you f****** waste of life I can't wait to rip your eyes out of your f****** head
with a pair of eyes you piece of s*** and nothing but scum of the Earth and you're going
to die like it”
07/27/2024 – “Crapler Harris is laying thieving piece of garbage like the rest of this
administration they all need to die and they will soon”
3
9. On February 22, 2024, GETTR account “joemadarats1” posted on GETTR “I
10. Through legal process, FBI Phoenix obtained the subscriber information from
GETTR USA, Inc., for GETTR account “joemadarats1”. Based on the responsive information
from GETTR with the date range of June 15, 2023, through July 28, 2024, the “joemadarats1”
account was created on June 15, 2023, and is associated with email address
joemadarats588@gmail.com.
11. On or about July 27, 2024, GETTR user joemadarats1 posted 46 comments to the
GETTR service using two different Internet Protocol (IP) addresses. Posts submitted to GETTR
by joemadarats1 between 7:36 AM - 8:07 AM used IP address 172.58.253.113, and between 9:17
12. A review of open-source records indicate that the service provider for IP address
172.58.253.113 is T-Mobile USA, Inc, and the service provider for 204.111.228.117 is GLO Fiber,
which is a subsidiary of Shentel. GLO Fiber/Shentel was unable to provide subscriber information
associated with the IP address without a port number, which GETTR did not provide to law
enforcement.
13. FBI Phoenix submitted legal process to Google, LLC, for subscriber and device
information associated with Google account joemadarats588@gmail.com revealed that the Google
account was created on or about January 18, 2020. The name associated with the
4
joemadarats588@gmail.com account is “Joe Madarats” and included a recovery email of
Cell Phone). IP addresses associated with login activity for joemadarats588@gmail.com revealed
that the account used IP address 204.111.228.117 18 times on or about July 26, 2024 - July 29,
2024. In addition, on July 29, 2024, the joemadarats588@gmail.com account used IP address
14. Google, LLC, also provided the device IMEI number 356125201089732, which
belongs to an Android phone and is associated with the subject email account. The device account
identifiers also provide additional email accounts connecting to the target device which includes
15. In addition, Google LLC provided logins to the account associated with
joemadarats588@gmail.com, which showed logins to the subject account on July 26-29, 2024,
were made with IP address 204.111.228.117. This IP address is the same IP address that is seen
with the threatening GETTR posts that were posted on GETTR by “joemadarats1” on July 27,
2024.
16. Analysis of the Google Location History records associated with Google account
joemadarats588@gmail.com revealed 220 records with approximately device locations for the
moto g G5 device for July 27, 2024 between 4:09 AM - 10:03 PM. During this time period, all
220 records indicated that the moto g G5 device was in the immediate vicinity the Preston Place
Apartment and Townhomes located north of Airport Rd. This area includes the address of 207
Brigstock Dr, Winchester, Virginia. The entirety of the 220 records include a display radius of 6
meters to 123 meters. Analysis of records with a display radius of 20 meters or less indicated that
5
there are 71 records with approximate locations in the immediate vicinity of the townhomes on the
west side of the 200-block of Brigstock Drive (odd house numbers), which also includes the
17. Analysis of Google Android Device Configuration Service Data records indicated
that the mobile device used to login to the joemadarats588@gmail.com account was a Motorola
356125201089732. The moto g 5G was first used with Google's services on or about July 13,
2024 and continued through July 29, 2024. Google indicated that the subscriber identity module
(SIM) card associated with the phone were encoded with a mobile country code (MCC) of 310
and mobile network code (MNC) of 240 and 260. A MCC of 310 indicates that the service
provider associated with the SIM is in the United States, and both MNCs of 240 and 260 indicate
that the mobile network operator is T-Mobile USA, Inc. The last data connection indicated on the
Google records indicate that, at the time the Google records were obtained, the mobile device
IP address used to login to the joemadarats588@gmail.com on July 29, 2024 and service is
18. The Google Android Device Configuration Service Data also identified 6
additional Google accounts that were associated with the moto g 5G mobile device. Two of the
6
d. T-Mobile Records
19. Legal process was sent to T-Mobile for subscriber information related to the Target
Cell Phone. T-Mobile returned responsive records identifying the subscriber to the target phone
number as Yvonne NEDLEY. NEDLEY and CARILLO are believed to be associates and have
lived together at multiple residences based on open-source database checks. Open-source checks
indicate that the phone number (610) 762-2760 is associated with NEDLEY while the target phone
20. Database checks including Department of Motor Vehicles (DMV) indicate that
CARILLO and NEDLEY reside at 207 Brigstock Drive, Winchester, Virginia. DMV records show
that CARILLO does not have any vehicles registered to his name.
21. Surveillance on July 30, 2024, conducted by an FBI Task Force Officer found one
22. Open-source Facebook checks identify a Facebook account using the name “Joe
Amarats”. The Facebook account does not have any pictures on it; however, it does have one
23. Open source checks identified a CashApp account associated with the Target Cell
24. Investigators made a phone call directly to the voicemail of the Target Cell Phone
and heard the voice of a male say “F.C.”. Based on my training and experience, the person who
has control over the cell phone device is most often the person whose name or nickname is left on
the voicemail identifying the user of the phone the caller will be leaving a voicemail for.
7
25. Through database checks, investigators were able to find records indicating that
CARILLO purchased a firearm from Steel Reloaders, a store that sells weapons that is located in
Winchester, Virginia. Through open-source checks, investigators were able to find a Google
review written by Google account “Joe Amarats” of Steele Reloaders. The review written by “Joe
Amarats” recommends the store because they “know a lot about weapons”. The review was written
in approximately February 2024, around the time that investigators found record of CARILLO’s
firearm purchase.
26. As stated above, the subject GETTR account “joemadarats1” posted on GETTR
that the user had an “AR-15 locked and loaded”. The subject GETTR account also made numerous
other posts about firearms and shooting people. Some examples of the posts about shooting people
are below:
11/23/2023 – “DON'T WAIT FOR YOUR GOV. GO OUT WITH YOUR GUNS AND
KILL ALL MUSLIMS”
07/27/2024 – “They should be shot in the f****** head those lousy f****** CIA
b******* artist scumbags”
07/27/2024 – “I believe when he illegals show up to vote they should be shot in the head
quickly they are not allowed to vote so then they must die cuz if I see any of them I'll kill
them”
8
iv. Search of CARILLO’S Residence
27. On August 2, 2024, a federal search warrant was executed at CARILLO’s residence
located at 207 Brigstock Drive, Winchester, Virginia 22602. At the time of execution, CARILLO
28. During his initial contact with law enforcement, CARILLO asked why this was
happening, and Special Agent Nicholas Olson, FBI, indicated it was related to something posted
online. A short time later, CARILLO, seemingly talking to himself, stated, “…for a comment.
29. Additionally, CARILLO stated to another law enforcement officer, FBI Task Force
Officer Zachary Hawkins, if it was “about the online stuff. I posted it.” When CARILLO overhead
law enforcement personnel discussing firearms in the residence, he indicated he had a 9mm
30. Following his request for an attorney, CARILLO stated, “This is all over a
comment, huh?”
31. Following his arrest, CARILLO asked, “Is Yvonne being arrested?” When Special
Agent Steven W. Duke, FBI, replied, “I don’t know,” CARILLO stated, “She didn’t do anything.
32. NEDLEY was interviewed by law enforcement. According to NEDLEY, she and
CARILLO have resided in the townhouse for almost a year. During that time, no one else has
33. Among other items, federal agents seized an RF-15 rifle and a 9 mm handgun from
inside the residence. According to NEDLEY, those particular firearms belonged to CARILLO.
NEDLEY believed CARILLO purchased the handgun in 2023 and the rifle in 2024.
9
34. NEDLEY identified CARILLO’s cell phone number as the Target Cell Phone (610-
762-5261) and his email address as fcarillo@hotmail.com. NEDLEY indicated CARILLO has
used the cell phone number for over 10 years. As stated above, the cell phone number and the
email address were associated with the Gmail account associated with the subject GETTR account.
35. According to NEDLEY, CARILLO was active on a social media platform called
“Getta” (phonetic spelling). NEDLEY believed politics were discussed on the platform.
NEDLEY knew CARILLO to access the platform with their laptop computer. NEDLEY did not
36. NEDLEY identified aliases of CARILLO as “Joe Madrats” and “Bob Ugots.”
NEDLEY learned about these aliases from CARILLO. NEDLEY believed “Joe Madrats” was
38. NEDLEY consented to a search of her cell phone. Three photos taken in May 2024
were discovered on NEDLEY’s cell phone. The photos depicted the screen of another cell phone
displaying email addresses and passwords. NEDLEY indicated the photos depicted CARILLO’s
cell phone displaying CARILLO’s email addresses and passwords. The photos were taken to
capture his passwords prior to getting a new cell phone. The photos displayed the following email
39. Law enforcement did not identify an application for GETTR or other indicia of
10
E. CONCLUSION
40. Based on the information set forth in this affidavit, I submit that there is probable
cause to believe that on or about July 27, 2024, in the Western District of Virginia, the defendant,
FRANK LUCIO CARILLO, did knowingly and willfully make a threat to take the life of and to
inflict bodily harm upon the Vice President of the United States in violation of Title 18, United
41. Based on the forgoing, I request that the Court issue the proposed arrest warrant.
OATH
I declare under penalty of perjury that the foregoing is true and correct.
Respectfully submitted,
Digitally signed by MELISSA
MELISSA MACARON MACARON
Date: 2024.08.02 14:18:30 -04'00'
Received by reliable electronic means and sworn and attested to by telephone on this ____day
2nd of
August 2024.
________________________________________
C. KAILANI MEMMER
UNITED STATES MAGISTRATE JUDGE
11