Page 1
Approved: Mu
CHRISTOiHER D. FRE
Assista t United S tes Attorney
Before: HONORABLE THEODORE H. KATZ
‘ United States Magistrate Judge
Southern District of New York
SEALED COMPLAINT
UNITED STATES OF AMERICA _
Violations of
- v. ~ : l8 U.S.C. §§ 1343, 2320
and 2
LUCAS TOWNSEND HENDERSON,
COUNTY OF OFFENSE:
Defendant. : NEW YORK
SOUTHERN DISTRICT OF NEW YORK, SS . :
ANDRE G. CICERO, being duly sworn, deposes and says
that he is a Special Agent with the Federal Bureau of
Investigation (“FBI”) , and charges as follows:
COUNT ONE
(Wire Fraud)
1. From at least in or about July 2010, up to and
including in or about March 2011, in the Southern District of New
York and elsewhere, LUCAS TOWNSEND HENDERSON, the defendant,
unlawfully, willfully, and knowingly, having devised and
intending to devise a scheme and artifice to defraud, and for
obtaining money and property by means of false and fraudulent
pretenses, representations, and promises, transmitted and caused
to be transmitted by means of wire and radio communication in
interstate and foreign commerce, writings, signs, signals,
pictures, and sounds for the purpose of executing such scheme and
artifice, to wit, HENDERSON participated in a scheme to defraud
coupon issuers and retailers through the creation and subsequent
use of counterfeit online coupons, and, in furtherance of that
scheme, HENDERSON caused the transmission of several of those
counterfeit coupons over the Internet from Rochester, New York to
an individual located in Springfield, Illinois.
(Title 18, United States Code, Sections 1343 and 2 . )
Page 2
COUNT TWO
(Trafficking in Counterfeit Goods)
2 . From at least in or about July 2010, up to and
including in or about March 2011, in the Southern District of New
York and elsewhere, LUCAS TOWNSEND HENDERSON, the defendant,
unlawfully, intentionally, and knowingly did traffic and attempt
to traffic in goods and services, and did knowingly use a
counterfeit mark on and in connection with such goods and
services, and did intentionally traffic and attempt to traffic in
labels, patches, stickers, wrappers, badges, emblems, medallions,
charms, boxes, containers, cans, cases, hangtags, documentation
and packaging of a type and nature, knowing that a counterfeit
mark has been applied thereto, the use of which is likely to
cause confusion, to cause mistake, and to deceive, to wit,
HENDERSON created and thereafter disseminated over the Internet
various online coupons bearing counterfeit marks, including the
“Powered by SmartSource” slogan and a distinctive border.
(Title 18, United States Code, Sections 2320 (a) (1) and 2 .)
The bases for my knowledge and the foregoing charges
are, in part, as follows:
3 . I am a Special Agent with the FBI, and I have been
involved in the investigation of this matter. The information
contained herein is based upon my personal knowledge and my
review of documents and records gathered during the course of
this investigation, as well as information obtained, directly or
indirectly, from other sources and law enforcement agents.
Because this affidavit is being submitted for the limited purpose
of establishing probable cause, it does not include all of the
facts that I have learned during the course of the investigation.
Where the contents of documents and the actions, statements and
conversations of others are reported herein, they are reported in
substance and in part, except where otherwise indicated.
4 . Since at least in or about July 2010, I and other
agents with the FBI have been conducting an investigation into
the creation and subsequent distribution over the Internet of
counterfeit online coupons. These coupons are designed to look
like legitimate coupons that are offered on the Internet at
www.SmartSource.com (the “SmartSource Website”) , and produced by
News America Marketing, a subsidiary of News Corporation, which
is based in New York, New York. The SmartSource Website offers
discount coupons to consumers for a wide range of consumer
products. Consumers who wish to obtain coupons for products via
the SmartSource Website must first download software that enables
Page 3
them to print coupons. Once that software is installed, a
consumer can review a list of coupons, make selections from that
list, and print specific coupons from his or her home printer.
These coupons typically expire within a period of anywhere from
several days to several months .
5. My investigation began when News America Marketing
reported to the FBI that a rash of counterfeit online coupons, in
the SmartSource likeness, were being redeemed in stores across
the country. These counterfeit coupons consistently employ a
logo which reads “Powered by SmartSource" as well as a
distinctive border, both of which are trademarks that have been
registered with the United States Patent and Trademark Office by
News America Marketing. Since the investigation began, these
counterfeit coupons have ranged from lower priced consumer items
such as energy drinks, beer, cigarettes and cosmetic products, to
more expensive consumer items such as electronic goods, including
X~Box and PlayStation video game consoles. From my conversations
with individuals at News America Marketing, I have learned that
when these counterfeit coupons are used by consumers, three types
of losses can result. First, if the manufacturers of consumer
products honor the coupons, which they often do to maintain
relationships with their retailers, they bear direct financial
loss when a retailer seeks compensation for a fake coupon that
has been redeemed. Second, if the manufacturer does not honor
the coupon, the retailer bears the cost. Finally, in both
circumstances, consumers bear the cost of price increases passed
on by manufacturers and/or retailers, particularly mom and pop
stores, to cover the cost of the fraud. For example, in or about
December 2010, $200, 000 worth of such counterfeit coupons for
Tide laundry detergent were redeemed by consumers over a two to
three week period. Notably, Proctor & Gamble, which
manufacturers Tide and is the single largest coupon issuer in the
United States, has never issued a single online print-at-home
coupon. The costs associated with the redemption of those
counterfeit coupons were subsequently borne by Proctor & Gamble
and the various retailers victimized by consumers who redeemed
the fraudulent coupons.
6 . In the course of the investigation, I have
identified a number of individuals posting, among other things,
(1) counterfeit coupons; (2) advice concerning the redemption of
these counterfeit coupons; and (3) instructions or tutorials for
creating these counterfeit coupons on at least two Internet
message board websites:
www.4chan.org (the “4chan Website") and
www.zoklet.net (the “Zoklet Website”) . Based on my training and
experience, as well as my participation in this investigation, I
know that users posting on these message board websites generally
Page 4
employ nondescript user names. In connection with this
investigation, I have reviewed these posts and have identified
the “handles” or “nicknames” used by two of the perpetrators of
the criminal activity described above: an individual who refers
to himself as “Coupon Guy" and another individual who has
employed the user names “Anonymous123 , ” “Anonymous 234, " and
“Anonymous3 4 5 . ”
7. Based on my review of postings made on the Zoklet
Website and information provided by internet service providers
hosting the Internet Protocol (“IP”) addresses associated with
those posts, I know the following, among other things:
a. Posts made on the Zoklet.net Website by the
user “Anonymous123, " “Anonymous.234, ” and “Anonymous345” have, by
and large, had anonymous IP addresses associated with those
posts. Based on my review of those anonymous IP addresses, I
believe that the individual employing those user names is using
the Tor network. Tor is a system intended to enable online
anonymity, by using specialized software and a network of servers
to hide information about users’ locations and other factors
which might identify them. Users of this system make it more
difficult to trace internet traffic, including visits to
websites, online posts, instant messages, and other communication
forms, back to them. Tor works by relaying communications
through a network of systems run by volunteers in various
locations throughout the world. Because the IP address of the
sender and the recipient are not both readable at any step along
the way, someone engaging in network traffic analysis and
surveillance at any point along the line cannot directly identify
which systems are involved in the communication.
b. On or about July 13, 2010, an individual
employing the user ID of “Anonymous123" posted fourteen (14)
counterfeit coupons on the Zoklet Website, including coupons for
PowerBars, Campbell's Soup at Hand, SmartOnes TV Dinners, Bagel
Bites, and Magic Hat Beer, among other various food and beverage
items. In so doing, “Anonymous 123” wrote in relevant part:
“Most if not all of these have been tested. . . . For those who
don’ t know how to reach the instructions that are on many of
these, basically, you can print them off any old printer, on
regular paper, and use them at most stores. In windows, just
save the image to your computer, right click it, and choose
print. Do full page photo print or something.” The IP address
associated with this post was an anonymous IP address.
Page 5
c. On or about July 17, 2010, an individual
employing the user ID of “Anonymousl23” posted a message on the
Zoklet Website, in which that user indicated that a new tutorial
for making counterfeit coupons was nearing completion, “from what
coupon guy said on a certain image board the yesterday (sic) ”
(the “July 17, 2010 Post") . The IP address associated with the
July 17, 2010 Post was an anonymous IP address.
d. On or about July 18, 2010, an individual
employing the user ID of “Anonymous123” posted a message on the
Zoklet Website. In that post, “Anonymousl23” wrote, among other
things: “$7. 00 off a 40 oz bag of hershey' s kisses. Think about
it. You can give someone special around 8x the chocolate you
might normally be able to get them for the normal price. I don‘ t
recommend you use 8 of these coupons at once though, as spending
$8 (plus tax) , for about $60 worth of chocolate might look
suspicious . " “Anonymous123" also included an image of “A Note
From The Author" in this post, which “Anonywnous123” described as
having been written by “Coupon Guy" in connection with the new
tutorial for making counterfeit coupons. The IP address
associated with this post was an anonymous IP address.
e. On or about July 19, 2010, an individual
employing the user ID of “Anonymous234” posted a message on the
Zoklet Website, in which that user indicated that he had been
banned from making posts under his previous user ID (i.e. ,
“Anonymous123") and referenced his July 17, 2010 Post . Among
other things, “Anonymous234” wrote: “Weird. I got banned for
some reason. AFAIK I wasn’ t breaking any rules . Then again, I
never read the rules either. ” The IP address associated with
this post was an anonymous IP address.
f. On or about July 22, 2010, an individual
employing the user ID of “Anonymous234" posted an image of the
cover of a “How to Make Coupons" tutorial on the Zoklet Website,
writing “If anyone is interested, here' s something Coupon Guy
posted last night, to give people an idea of what to look for
when he does release his new tutorial.” The IP address
associated with this post was an anonymous IP address.
g. On or about July 26, 2010, an individual
employing the user ID of “Anonymous234” posted a message on the
Zoklet Website, in which he admitted having a file of the “How to
Make Coupons” tutorial on his hard drive. In addition,
“Anonymous234” wrote: “
f you want some coupons for beer,
here' s a few from my own collection. . . . What’ s more
they’ 11 work at walmart self checkouts, at least the ones that I
have tried. At walmart self checkouts, the watcher person wills
Page 6
till (sic) need to come over and check your ID. But as long as
you don' t use more than $20 worth of coupons, they won' t have to
check the coupons . ” “Anonymous234” also posted three counterfeit
coupons for beer. The IP address associated with this post was
an anonymous IP address.
h. On or about September 29, 2010, an individual
employing the user ID of “AnonymousB45” posted a message on the
Zoklet Website, in which he claimed that the new version of the
“How to Make Coupons" tutorial was just released and provided a
link to the full copy of that tutorial, hosted on the 4chan
Website. The IP address associated with this post was an
anonymous IP address.
i. On or about September 30, 2010, an individual
employing the user ID of “Anonymous345” posted a message on the
Zoklet Website, in which he stated that he previously employed
the user ID of “Anonymous234 . " Among other things,
“Anonymous345” wrote: “TRUTH! I'm looking at the tutorial with
my own eyes. If you’ re at all familiar with the old coupon
thread, which apparently is no longer a sticky, I'm the same guy
as anonymous234. . ” The IP address associated with this post was
an anonymous IP address.
j . From reviewing information provided by the
operator of the Zoklet Website, I know that an individual
employing the user ID of “Anonymous345” posted a message on the
Zoklet Website on or about October 14, 2010 at approximately 2:17
a.m. That posting recorded an associated IP address of
129 .21. 82 . 115 (the “115 IP Address”) , and a host name for the 115
IP Address associated with the Rochester Institute of Technology
(“RIT”) .
8 . From reviewing information provided by RIT, I know
that from approximately 6: 06 p.m. on or about October 13, 2010,
up to and including approximately 5:20 p.m. on or about October
14, 2010, the 115 IP Address was assigned to RIT student LUCAS
TOWNSEND HENDERSON, the defendant. I also know that HENDERSON
has provided RIT with an e—mail address of
“lucashenderson@gmail.com." '
9. From reviewing information provided by Google,
including information regarding session timestamps and
originating IP addresses for logins of the Google e~mail account
“lucashenderson@gmail.com, ” I know that on or about October 13,
2010, the “lucashenderson@gmail . com” e-mail account was accessed
six separate times, with each login recording the 115 IP Address
as the originating IP address. Moreover, I know that on or about
Page 7
October 14, 2010 at approximately 7:14 a.m., the
“lucashenderson@gmail.com” email account was accessed, at which
time the 115 IP Address was recorded by Google as being the
originating IP address for that login.
10 . Based on conversations that I have had with
various representatives of RIT, I know that LUCAS TOWNSEND
HENDERSON, the defendant, is a member of the Class of 2013 and is
currently enrolled in the College of Computing and Information
Sciences at RIT. HENDERSON is pursuing a Bachelor of Sciences
degree in Information Security and Forensics.
11. Based on my review of information contained on the
publicly available Facebook page for LUCAS TOWNSEND HENDERSON,
the defendant, I have learned that HENDERSON posted that he has
been employed with the RIT ITS Helpdesk since June 2010, and that
he was employed by Walmart as a cashier in Lubbock, Texas from in
or about January 2008 through in or about August 2008 .
12. Based on my review of postings made on the Zoklet
Website and information provided by internet service providers
hosting the Internet Protocol (“IP”) addresses associated with
those posts, I know the following, among other things:
a. On or about August 2, 2010, an individual
employing the user ID of “AnonymousO” posted a message on the
Zoklet Website in response to the July 26, 2010 message posted by
“Anonymous234” (whom I believe to be LUCAS TOWNSEND HENDERSON,
the defendant) set forth in paragraph 7 (g) , above. Referencing
the three counterfeit coupons for beer that “Anonymous234” had
posted, “AnonymousO” wrote: “The bud/bud light coupon worked at a
grocery store. Tried at a gas station, and apparently they don’ t
accept online coupons (like most gas stations, as it’ s already
been mentioned) . We continued to press out luck at a Wal
Green’s. The cashier wasn't questioning it, he was just saying
“Wow, that' s a hell of a coupon, So thank you, very much, anon,
for 24 beers for ~$4."
b. The Zoklet Website recorded the IP address of
98 .228 .134 .184 (the “184 IP Address") as associated with the
August 2, 2010 post by “AnonymousO . ”
Page 8
13 . Comcast Cable Communications (“Comcast”) provides
Internet service and is the owner of the 184 IP Address. From
reviewing documents obtained from Comcast, I know that the name
and physical address associated with the 184 IP Address at the
time of the August 2, 2010 post by “AnonymousO” described above
in paragraph 12 was an individual with a residential address
located in Springfield, Illinois.
14 . On or about March 16, 2011, I and other law
enforcement agents executed a search warrant issued by a United
States Magistrate Judge of the United States District Court for
the Western District of New York at the current residence of
LUCAS TOWNSEND HENDERSON, the defendant. At that time, and among
other things, I and other law enforcement agents recovered a
number of coupons for various food and beverage items. Based on
my training and experience, as well as my familiarity with this
investigation, I believe these coupons to be examples of
counterfeit online coupons in the SmartSource likeness.
15. In addition, on or about March 16, 2011, in
connection with executing the search warrant described above in
paragraph 14 , I and another FBI agent advised LUCAS TOWNSEND
HENDERSON, the defendant, that he was free to leave and did not
have to answer any of our questions. However, TOWNSEND elected
to provide the following information:
a. When asked about the Zoklet Website,
HENDERSON indicated that he had heard of it, but “ [couldn’ t] say
for sure” whether he had posted messages on it.
b. When asked about the 4chan Website, HENDERSON
indicated that he had heard of it, had visited it, and had
probably posted messages on it in the past.
c. When asked about his use of Tor, HENDERSON
stated, “I use Tor on occasion. ”
d. When asked about producing coupons, HENDERSON
stated, “I did write the manual. I wrote what I could. I
thought it was an interesting thing. Some of it’ s putting on an
air, not necessarily my point of view. ”
Page 9
e. When asked whether he was “Anonym0us123, "
“Anonymous234 , ” and/or “AnonymousB45, " HENDERSON stated, “Most of
the time.”
WHEREFORE, deponent respectfully requests that a
warrant be issued for the arrest of LUCAS TOWNSEND HENDERSON, the
defendant, and that he be arrested and imprisoned, or bailed, as
the case may be.
ANDRE G. CICERO
Special Agent
Federal Bureau of Investigation
Sworn to before me this
10th day of May, 2011
,,,,,,
HONORABLE THEODORE H. KATZ
UNITED STATES MAGISTRATE JUDGE
SOUTHERN DISTRICT OF NEW YORK
