nationalsecuritylaw United States v. Suarez (S.D. Fla. Apr. 18, 2017) (life sentence in ISIS material support & explosives case)

April 19, 2017

From DOJ’s press release:

WASHINGTON – Harlem Suarez, aka “Almlak Benitez,” 23, of Monroe County, Florida, was sentenced to life in prison for attempting to use a weapon of mass destruction, an explosive device, and attempting to provide material support to Islamic State of Iraq and al-Sham (ISIS), a designated foreign terrorist organization.

The announcement was made by Acting Assistant Attorney General for National Security Mary B. McCord, U.S. Attorney Benjamin G. Greenberg for the Southern District of Florida, Special Agent in Charge George L. Piro of the FBI’s Miami Field Office, and members of the South Florida Joint Terrorism Task Force (JTTF). Suarez was sentenced by U.S. District Judge Jose E. Martinez in Key West to life in prison for the weapon of mass of mass destruction count of conviction and a concurrent term of 20 years in prison for attempting to provide material support.

Suarez, a U.S. legal resident and citizen of Cuba, was convicted at trial in Key West, Florida on January 27, of knowingly attempting to use a weapon of mass destruction against a person or property within the U.S., in violation of Title 18, U.S. Code, Section 2332a(a)(2) and attempting to provide material support to a terrorist organization, in violation of Title 18, U.S. Code, Section 2339B.

According to evidence introduced at trial, in April 2015, Suarez’s Facebook postings contained extremist rhetoric and promoted ISIS. Evidence further indicated that Suarez told an FBI confidential human source that he wanted to make a “timer bomb.” Suarez purchased components for this device, which was to contain galvanized nails, be concealed in a backpack and be remotely detonated by a cellular telephone. Suarez intended to bury the device at a public beach in Key West and then detonate it.

Mr. Greenberg commended the investigative efforts of the FBI; South Florida JTTF, Bureau of Alcohol, Tobacco, Firearms, and Explosives; U.S. Immigration and Customs Enforcement, Homeland Security Investigations; Key West Police Department, Monroe County Sheriff’s Office;s and Palm Beach County Sheriff’s Office. This case is being prosecuted by Assistant U.S. Attorneys Marc S. Anton and Karen E. Gilbert with assistance from the National Security Division’s Counterterrorism Section.

nationalsecuritylaw United States v. Muchacho (E.D.Va. Apr. 12, 2017) (false statement case involving CBP agent mishandling classified and other protected information systems)

April 13, 2017

From the press release:

WASHINGTON – A former officer and program manager for the U.S. Customs and Border Protection (CBP) pleaded guilty today to making false statements regarding his improper use of CBP and other law enforcement databases, announced Acting Assistant Attorney General Kenneth A. Blanco of the Department of Justice’s Criminal Division and U.S. Attorney Dana J. Boente of the Eastern District of Virginia.

Jesus R. Muchacho, 39, of Temple Hills, Maryland, and a naturalized U.S. citizen from Venezuela, pleaded guilty to one count of making false statements before U.S. District Judge Leonie M. Brinkema of the Eastern District of Virginia. Sentencing is scheduled for July 7, 2017.

According to admissions made in connection with his plea, in December 2013, Muchacho was reassigned to CBP’s National Targeting Center Cargo (NTCC) in Herndon, Virginia, as a CBP officer and a program manager. The NTCC targets and coordinates the examination of high-risk cargo entering the United States and persons associated with such shipments. According to his plea, Muchacho held a Top Secret security clearance, which gave him access to classified national security information, sensitive information and protected law enforcement database systems. Muchacho exceeded CBP’s use restrictions by, among other things, making unauthorized searches and disclosing information to foreign nationals.

According to his plea, on Dec. 1, 2016, Muchacho falsely stated to federal law enforcement officers that: he did not send CBP or U.S. government information outside of CBP systems; he was not asked to provide, and he did not disclose, CBP or U.S. government information to third parties who did not have an authorized need to know; and he did not search law enforcement databases for non-official purposes. Muchacho further admitted that he made false statements during a background reinvestigation in 2014, when he applied for access to a classified information system in 2016, and when he was interviewed during a secondary inspection at Dulles International Airport. According to the plea, the false statements were related to his citizenship status, his contacts with foreign governments and an undisclosed foreign passport.

The CBP’s Office of Professional Responsibility and the FBI’s Washington Field Office are investigating the case. Trial Attorney Edward P. Sullivan of the Criminal Division’s Public Integrity Section and Assistant U.S. Attorney Grace L. Hill of the Eastern District of Virginia are prosecuting the case.

nationalsecuritylaw United States v. Jones (N.D. Ill. Apr. 12, 2017) (material support charges in Islamic State case)

April 12, 2017

WASHINGTON – Joseph D. Jones, also known as “Yusuf Abdulhaqq,” 35, and Edward Schimenti, also known as “Abdul Wali,” 35, both of Zion, Illinois, were arrested today on a federal complaint charging them with conspiring and attempting to provide material support and resources to the Islamic State of Iraq and al-Sham (ISIS). Jones and Schimenti were arrested this morning. They are scheduled to make an initial appearance at on April 12 at 3:00 p.m. CDT (4:00 p.m. EDT) before U.S. Magistrate Judge M. David Weisman in Chicago, Illinois. Authorities also executed a search warrant at Jones’ residence in Zion today.

The complaint and arrests were announced by Acting Assistant Attorney General for National Security Mary B. McCord, Acting U.S. Attorney Joel R. Levin for the Northern District of Illinois and Special Agent in Charge Michael J. Anderson of the FBI’s Chicago Office.

According to a complaint and affidavit filed in U.S. District Court in Chicago, Jones and Schimenti, both U.S. citizens, pledged their allegiance to ISIS and advocated on social media for violent extremism in support of the terrorist group. In the fall of 2015, the pair befriended three individuals whom Jones and Schimenti believed were fellow ISIS devotees. Unbeknownst to Jones and Schimenti, two of the individuals were undercover FBI employees and the third individual was cooperating with law enforcement and was not an ISIS supporter.

Over the next several months, as part of the conspiracy, Jones and Schimenti allegedly took steps to assist the cooperating source with plans to travel overseas to join ISIS. The defendants met the undercover FBI employees and the cooperating source on numerous occasions, during which Jones and Schimenti discussed their devotion and commitment to ISIS, according to the complaint. Some of the meetings took place in Waukegan, Zion, Bridgeview, North Chicago, Highland Park and Chicago, in Illinois.

At one point, Jones and Schimenti shared photographs of themselves holding the ISIS flag at the Illinois Beach State Park in north suburban Zion, according to the complaint. In a recorded conversation with the cooperating source, Schimenti commented that Schimenti would like to see the ISIS flag “on top of the White House,” the complaint states.

Earlier this year, Schimenti engaged in physical training exercises with the cooperating source at a gym in Zion, the complaint states. Understanding that the cooperating source intended to travel overseas to fight for ISIS, Schimenti commented that the exercises would “make you good, you know, in the battlefield,” according to the complaint.

According to the complaint, last month, the pair furnished several cellular phones to the cooperating source, believing they would be used to detonate explosive devices in ISIS attacks overseas. On April 7, Jones and Schimenti drove the cooperating source to O’Hare International Airport in Chicago with the understanding that the source would be traveling to Syria to join and fight with ISIS. Schimenti told the source to “drench that land with they, they blood.”

A complaint is not evidence of guilt. The defendants are presumed innocent and are entitled to a fair trial at which the government has the burden of proving guilt beyond a reasonable doubt.

The charge in the complaint is punishable by up to 20 years in prison. The maximum statutory sentence is prescribed by Congress and is provided here for informational purposes. If convicted of any offense, the sentencing of the defendant will be determined by the court based on the advisory Sentencing Guidelines and other statutory factors.

The case was investigated by the Chicago Joint Terrorism Task Force, which is comprised of FBI personnel and representatives from numerous federal, state and local law enforcement agencies. The Zion Police Department also provided valuable assistance. The government is represented by Assistant U.S. Attorneys Barry Jonas and Rajnath Laud of the Northern District of Illinois, and Trial Attorney Lolita Lukose of the National Security Division’s Counterterrorism Section.

nationalsecuritylaw United States v. Levashov (D. Alaska April 10, 2017) (botnet takedown)

April 10, 2017

DOJ CCIPS and FBI Cyber Divison are in the midst of a botnet takedown, this one focused on the Kelihos malware. Details and documents from DOJ follow below:

WASHINGTON – The Justice Department today announced an extensive effort to disrupt and dismantle the Kelihos botnet – a global network of tens of thousands of infected computers under the control of a cybercriminal that was used to facilitate malicious activities including harvesting login credentials, distributing hundreds of millions of spam e-mails, and installing ransomware and other malicious software.

Acting Assistant Attorney General Kenneth A. Blanco of the Justice Department’s Criminal Division, Acting U.S. Attorney Bryan Schroder for the District of Alaska, and Assistant Director Scott Smith for the FBI’s Cyber Division made the announcement.

“The operation announced today targeted an ongoing international scheme that was distributing hundreds of millions of fraudulent e-mails per year, intercepting the credentials to online and financial accounts belonging to thousands of Americans, and spreading ransomware throughout our networks. The ability of botnets like Kelihos to be weaponized quickly for vast and varied types of harms is a dangerous and deep threat to all Americans, driving at the core of how we communicate, network, earn a living, and live our everyday lives,” said Acting Assistant Attorney General Blanco. “Our success in disrupting the Kelihos botnet was the result of strong cooperation between private industry experts and law enforcement, and the use of innovative legal and technical tactics. The Department of Justice is committed to combatting cybercrime, no matter the size or sophistication of the scheme, and to punish those who are engaged in such crimes.”

“Cybercrime is a worldwide problem, but one that infects its victims directly through the computers and personal electronic devices that we use every day,” said Acting U.S. Attorney Bryan Schroder for the District of Alaska. “Protecting the American people from such a worldwide threat requires a broad-reaching response, and the dismantling of the Kelihos botnet was such an operation. We are lucky that we have talented FBI agents and federal prosecutors with the skillsets to help protect Americans from this pervasive cybercrime.”

Kelihos malware targeted computers running the Microsoft Windows operating system. Infected computers became part of a network of compromised computers known as a botnet and were controlled remotely through a decentralized command and control system. According to the civil complaint, Peter Yuryevich Levashov allegedly operated the Kelihos botnet since approximately 2010. The Kelihos malware harvested user credentials by searching infected computers for usernames and passwords and by intercepting network traffic. Levashov allegedly used the information gained from this credential harvesting operation to further his illegal spamming operation which he advertised on various online criminal forums. The Kelihos botnet generated and distributed enormous volumes of unsolicited spam e-mails advertising counterfeit drugs, deceptively promoting stocks in order to fraudulently increase their price (so-called “pump-and-dump” stock fraud schemes), work-at-home scams, and other frauds. Kelihos was also responsible for directly installing additional malware onto victims’ computers, including ransomware and malware that intercepts users’ bank account passwords.

As with other botnets, Kelihos is designed to operate automatically and undetected on victims’ computers, with the malicious code secretly sending requests for instructions to the botnet operator. In order to liberate the victim computers from the botnet, the United States obtained civil and criminal court orders in the District of Alaska. These orders authorized measures to neutralize the Kelihos botnet by (1) establishing substitute servers that receive the automated requests for instructions so that infected computers no longer communicate with the criminal operator and (2) blocking any commands sent from the criminal operator attempting to regain control of the infected computers.

In seeking authorization to disrupt and dismantle the Kelihos botnet, law enforcement obtained a warrant pursuant to recent amendments to Rule 41 of the Federal Rules of Criminal Procedure. A copy of this warrant along with the other court orders are produced below. The warrant obtained by the government authorizes law enforcement to redirect Kelihos-infected computers to a substitute server and to record the Internet Protocol addresses of those computers as they connect to the server. This will enable the government to provide the IP addresses of Kelihos victims to those who can assist with removing the Kelihos malware including internet service providers.

The efforts to disrupt and dismantle the Kelihos botnet were led by the FBI’s Anchorage Office and New Haven Office; Senior Counsel Ethan Arenson and Harold Chun, and Trial Attorney Frank Lin of the Computer Crime and Intellectual Property Section; and Assistant U.S. Attorneys Yvonne Lamoureux and Adam Alexander of the District of Alaska.

The details contained in the civil complaint and related pleadings are merely accusations, and the defendant is presumed innocent unless and until proven guilty.

The Government has and will continue to share samples of the Kelihos malware with the internet security community so that antivirus vendors can update their programs to detect and remove Kelihos. A number of free and paid antivirus programs are already capable of detecting and removing Kelihos, including the Microsoft Safety Scanner, a free product.

The documents filed by the Government as well as the court orders entered in this case are available online at the following web address:



Signed Search Warrant


PRTT Order

Application for Search Warrant

Memo in Support of TRO

# # #



nationalsecuritylaw United States v. Gonzalez-Diaz (D.P.R. April 7, 2017) (indictment in stolen explosives case)

April 7, 2017

Not sure this one warrants coverage here, but I’d not seen a stolen-explosives charge in a long while and thought it was interesting enough to circulate (despite being mindful that there is no particular reason based on the limited information to assume this defendant was looking to engage in terrorism).

WASHINGTON – On April 6, 2017, a federal Grand Jury indicted Juan González-Díaz for possession of stolen explosive materials, announced Rosa Emilia Rodríguez-Vélez, United States Attorney for the District of Puerto Rico. On March 23, 2017, FBI agents arrested González-Díaz based on a criminal complaint charging him with possession of stolen explosives, namely, approximately 20 pounds of ammonium nitrate, in violation of 18 U.S.C. § 842(h).

According to the information contained in the complaint, the defendant had stolen the explosives from a construction site in Caguas. González-Díaz took approximately two to three large bags and several others of a smaller size from a white pick-up truck. The defendant knew that the bags were explosives because the word “explosives” was written on the original packing.

González-Díaz told FBI agents that decided to store the explosives at a friend’s farm in Caguas, claiming that at the time he did not have any use for them. On March 22, 2017, FBI agents seized the explosives and a considerable number of explosive blasting caps.

“The Justice Department will continue to vigorously investigate and prosecute these crimes as we strive to protect the safety of our communities,” said U.S. Attorney Rosa Emilia Rodríguez-Vélez of the District of Puerto Rico. “As prosecutors, a significant part of the role we play is to protect the citizens in our communities from the threats they face. This case accomplishes that.”

Assistant United States Attorney Alexander Alum is in charge of the prosecution of the case. If convicted, González-Díaz faces a maximum term of imprisonment of ten years, a term of supervised release of up to three years, and a fine of up to $250,000. The FBI is in charge of the investigation with the collaboration of ATF.

# # #

nationalsecuritylaw United States v. Mashhandani (E.D. Va. Mar. 28, 2017) (immigration fraud prosecution involving Iraqi refugees and link to harm to US persons in Iraq in 2005)

March 28, 2017

DOJ’s press release appears below, and the criminal complaint/affidavit are attached:

WASHINGTON – Yousif Al Mashhandani (“Yousif”), 35, of Vienna, Virginia, and Adil Hasan, 38, of Burke, Virginia, who are full biological brothers, were arrested this morning. The third individual charged is Enas Ibrahim, 32, also of Burke, who is the wife of Hasan. Each are charged with attempting to obtain naturalization contrary to law. The defendants will have their initial appearance today in front of Magistrate Judge Ivan D. Davis at 2 p.m. at the federal courthouse in Alexandria, Virginia.

Acting Deputy Attorney General and U.S. Attorney for the Eastern District of Virginia Dana J. Boente, Assistant Director in Charge Andrew W. Vale of the FBI’s Washington Field and Special Agent in Charge Patrick J. Lechleitner of U.S. Immigration and Customs Enforcement’s (ICE) Homeland Security Investigations (HSI) Washington, D.C., made the announcement.

According to the affidavit in support of the criminal complaint, on Nov. 1, 2004, a U.S. citizen, identified as R.H., was kidnapped and held with other hostages for months in horrible conditions in an underground bunker. After a raid in 2005 freed the hostages, Majid Al Mashhadani (“Majid”), who is a full biological brother of Yousif and Hasan, was detained and admitted his complicity in the kidnapping of R.H.

According to the affidavit in support of the criminal complaint, Yousif was admitted into the U.S. as a refugee in 2008. In May 2013, Yousif resided in Vienna and applied for naturalization as a U.S. citizen. In connection with Yousif’s applications for citizenship, his fingerprints were taken. According to an FBI fingerprint specialist, analysis conducted in November 2013 determined that Yousif’s fingerprints match those found on a document at the underground bunker where forces rescued R.H. and others in Iraq in 2005.

According to the affidavit in support of the criminal complaint, Yousif, Hasan and Ibrahim are lawful permanent residents and have applied to naturalize and become U.S. citizens. On various applications and forms throughout their respective immigration processes, each has provided an extensive list of family members and information of their respective family trees; however, none listed any reference to Majid.

According to the affidavit in support of the criminal complaint, on March 4, 2016, FBI agents interviewed Yousif, Hasan and Ibrahim. When FBI agents asked Yousif why he failed to include reference to Majid on the family tree form, Yousif said he omitted reference to Majid because, when he was a refugee, he was told by others applying for refugee status that he would not be allowed into the U.S. if any immediate family members had a criminal background. Hasan admitted to FBI agents that Majid was his brother. Hasan and Ibrahim each admitted they discussed not including Majid’s name on their applications for refugee status because their connection to Majid might delay their ability to gain such status.

According to the affidavit in support of the criminal complaint, to justify his application for refugee status, Yousif reported that in 2006, while working as an anti-corruption investigator for the Iraqi Commission on Public Integrity in Iraq, he started receiving threats from a Shiite militia known as the "Al Mahdi Militia," in order to coerce Yousif to drop a particular corruption investigation. Yousif said that in May 2006, Hasan was kidnapped by the Al Mahdi Militia, and was released only after Yousif arranged to drop the investigation in question and helped pay a large ransom. Yousif said that after Hasan was released, he reopened the corruption investigation, only to flee to Jordon in October 2006 after his parents’ house was burned down.

According to the affidavit in support of the criminal complaint, to justify his application for refugee status, Hasan provided sworn testimony that, in 2006, he had been kidnapped and tortured by members of the Al Mahdi Army and held for nearly a month. Hasan said he was released upon the payment of a ransom of $20,000. In an interview by FBI agents in April 2016, Hasan said he was threatened in Iraq on two occasions, but made no mention of being kidnapped, held hostage and tortured for nearly a month. In a subsequent interview in October 2016, FBI agents confronted Hasan about the discrepancy in his stories and Hasan admitted to making false statements and creating his persecution story.

A criminal complaint contains allegations that a defendant has committed a crime. Every defendant is presumed to be innocent until and unless proven guilty in court. Each defendant faces a maximum penalty of 10 years in prison if convicted. The maximum statutory sentence is prescribed by Congress and is provided here for informational purposes. If convicted of any offense, the sentencing of the defendants will be determined by the court based on the advisory Sentencing Guidelines and other statutory factors.

The FBI’s Joint Terrorism Task Force, which includes ICE/HSI and U.S. Citizenship and Immigration Services, investigated the case. Assistant U.S. Attorneys Gordon Kromberg and Collen Garcia for the Eastern District of Virginia are prosecuting the case.

2017 03 28 Mashhadani Affidavit.pdf

nationalsecuritylaw United States v. Maric (M.D. Fla. Mar. 27, 2017) (fraudulent naturalization conviction and revocation of citizenship in case of Bosnian soldier)

March 27, 2017

This one probably is worth circulating in its own right (the defendant was convicted in absentia for war crimes in Bosnia involving abuse of prisoners), but it seems extra relevant in light of the suit DOJ filed last week to revoke the naturalized citizenship of AQ member Iyman Faris (in that this illustrates that denaturalization is not uncommon for those who fraudulently obtained citizenship). From DOJ’s press release:

WASHINGTON – A Jacksonville, Florida man was sentenced today to 18 months in prison for unlawfully procuring U.S. citizenship by failing to disclose during his naturalization process his membership in the Bosnian Army and crimes that he committed in Bosnia and Herzegovina during the Bosnian Conflict in the 1990s, announced Acting Assistant Attorney General Kenneth A. Blanco of the Justice Department’s Criminal Division and Acting U.S. Attorney W. Stephen Muldrow of the Middle District of Florida.

Slobo Maric, 56, was sentenced today by U.S. District Judge Marcia Morales Howard of the Middle District of Florida who also ordered his U.S. citizenship revoked. On July 18, 2016, Maric pleaded guilty before U.S. Magistrate Judge James R. Klindt of the Middle District of Florida to one count of unlawful procurement of naturalization.

According to the plea agreement, in 1993, Maric served as a shift leader, the second in command to the warden, of a detention facility in Bosnia that housed captured Bosnian-Croat soldiers. Many of the guards in the facility routinely subjected detainees to serious physical abuse and humiliation. According to the plea agreement, Maric selected detainees for other guards to abuse; directly participated in abusing several prisoners; and sent prisoners on dangerous and deadly work details on the front line of the conflict. The Bosnian government charged Maric for his criminal conduct and, after Maric immigrated to the United States, Bosnia indicted and convicted Maric in absentia for war crimes against prisoners. According to the plea agreement, Maric knew about the Bosnian court proceedings, yet he failed to disclose the proceedings and lied about his conduct on his application for U.S. citizenship. Maric became a naturalized U.S. citizen on Oct. 31, 2002.

U.S. Immigration and Customs Enforcement’s (ICE) Homeland Security Investigations (HSI) Jacksonville Field Office investigated the case under the supervision of the HSI Tampa Field Office with support from ICE’s Human Rights Violators and War Crimes Center.

Trial Attorney Clayton O’Connor and Historian David Rich of the Criminal Division’s Human Rights and Special Prosecutions Section (HRSP) and Assistant U.S. Attorney Dale Campion of the Middle District of Florida prosecuted the case.