S 

WESTERN DISTRICT OF TEXAS 

In the Matter of the Search of JUN 21 2020 

SEARCH W 

Information associated with 

&iIS. DISTRICT COURT 

WESTERN DIS 

kevinpe1ayo(hotmail.com, further described in BV_ (I\OF TEXAS 

Attachment A, that is stored at premises CASE NUMBER1LO DEPUTY CLI 

controlled by Microsoft Corporation 

TO: RICKY L. WELTON, Special Agent, United States Army, Criminal Investigation Division, 

and any Authorized Officer of the United States 

Affidavit(s) having been made before me by RICKY L. WELTON, Special Agent, United States Army, 

Criminal Investigation Division, and any Authorized Officer of the United States, who has reason to 

believe that [ } on the person of [ X] on the premises known as 

Information associated with kevinpe1ayo(hotmai1.com, further described in Attachment A, that is stored 

at premises controlled by Microsoft Corporation, 

in the Western District of Texas there is now concealed a certain person or property, described on the 

attached property list, see Attachment B - List of Items to be Searched for and Seized, which 

property constitutes evidence of the commission of a criminal offense, contraband, the fruits of crime, 

or things otherwise criminally possessed, property designed or intended for use or which is or has been 

used as the means of committing a criminal offense concerning a violation of Title 18, United States 

Code, Section 641. 

I am satisfied that the affidavit(s) and any recorded testimony establish probable cause to believe that 

the person or property so described is now concealed on the person or premises above-described and 

establish grounds for the issuance of this warrant. 

YOU ARE HEREBY COMMANDED to search on or before \ c 

(not to exceed 14 days) the person or place named above for the person or property specified, serving 

the warrant and making the search (in the daytime 6:OOA:M. to 10:00 P.M.) (at any time in the day or 

night as I find reasonable cause has been established) and if the person or property be found there to 

seize same, leaving a copy of this warrant and receipt for the person or property taken and prepare a 

written inventory of the person or property seized and promptly return this warrant to U.S. Magistrate 

Judge as required by law. 

June ,2020 

Date and Time Issued 

Jeffrey C. Manske, United States Magistrate Judge 

Name and Title of Judicial Officer 

Waco, Texas 

City and State 

Signature of Judicial Officer 

Case 6:20-mj-00106-JCM Document 4 Filed 06/22/20 Page 1 of 6
AO 93 (Rev. 12/09) SearGh and Seizure Warrant (Page 2) 

Return 

Case 

W 

No.: Date and time warrant executed: Copy of warrant and inventory left with: -20-106M 22 June 2020 09:30 RAC S. Lane Allen, Army CID-MPFU 

lnventoiy made in the presence of: 

SA Kevin Benifield 

Inventory of the property taken and name of any person(s) seized: 

Receipt of digital files and electronic data from Microsoft Online Services, containing contents such as 

emails, subscriber information, names, email addresses related to subjects and business under 

investigation and within the purview of U.S. Army CID-MPFU. 

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX NOTHING FOLLOWS XXXXXXXXXXXXXXXX 

CcrtIfict1p,i 

I declare under penalty of perjury that this inventory Is correct and was returned along with the original warrant 

to the designated judge. 

22 June 2020 Date: 

Executing officer s signature 

Ricky Welton Special Agent 

Printed name and title 

Case 6:20-mj-00106-JCM Document 4 Filed 06/22/20 Page 2 of 6
ATTACIIMEII 

Property to Be Searched 

This warrant applies to information associated with kevinplayOh ikcom that is stored at 

premises controlled by Microsoft Corporation, a company that accepts service of legal process at 

MSN Hotmail 1065 La Avenida, Building 4 Mountain View, CA 94043 

Case 6:20-mj-00106-JCM Document 4 Filed 06/22/20 Page 3 of 6
ATTACHMENT B 

Particular Things to Be Seized 

I. Information to be disclosed by Microsoft Corp. (the Provider) 

To the extent that the information associated with: 

a) kevinpelayo@hotmail.com 

Dating from October 1, 2018 to the present, as described in Attachment A is within the possession, 

custody, or control of the Provider, including any emails, records, files, logs, or information that 

has been deleted but is still available to the Provider, or has been preserved pursuant to a requests 

made under 18 U.S.C. § 2703(f) on January 15, 2020 and April 16, 2020 the Provider is required 

to disclose the information described in paragraphs (a) through (f) below in this section to the 

government for each account or identifier listed in Attachment A: 

a. The contents of all emails associated with the accounts, including stored or preserved 

copies of emails sent to and for the account, draft emails, the source and destination addresses 

associated with each email, the date and time at which each email was sent, and the size and length 

of each email; 

b. All records or other information regarding the identification of the account, to 

include full name, physical address, telephone numbers and other identifiers, records of session 

times and duration, the date on which the account was created, the length of service, the IP address 

used to register the account, log-in IP addresses associated with session times and dates, account 

status, alternative email addresses provided during registration, methods of connecting, log files, 

and means and source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 

account, including address books, contact and buddy lists, calendar data, pictures, and files; 

e. All records pertaining to communications between the Providers and any person 

regarding the account, including contacts with support services and records of actions 

taken; and 

f All records establishing control over or access to the subject email accounts. 

II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, contraband, evidence, 

and instrumentalities of violations of 18 U.S.C. 641 (Theft), 18 U.S.C. 1028A (Aggravated 

Identify Theft), 18 U.S.C. 1343 (Wire Fraud), 18 U.S.C. 956(h) (Money Laundering), and 18 

U.S.C. § 371 (Conspiracy), those violations involving known and unknown persons and occurring 

Case 6:20-mj-00106-JCM Document 4 Filed 06/22/20 Page 4 of 6
after October 1, 2018, to the present including, for each account or identifier listed on Attachment 

A, information pertaining to the following matters: 

a. All data and records relating to names, emails and other identifying information for 

participants in relation to the Army Mass Transit Benefit Program (MTBP) to include but 

not limited to: creation of participant forms, payments for any U.S. government benefit, 

and claims in relation to the Army Mass Transit Benefit Program (MTBP). 

b. All data and records relating to claims submitted in relation to the Army Mass Transit 

Benefit Program. 

c. All data and records of payments relating to any U.S. Department of the Army, U.S. 

Department of Transportation, or U.S. Department of Defense claim, benefit, voucher, 

application, participant inquiries, and/or application forms in relation to the MTBP 

d. All data and records relating to agreements, drafts of agreements and proposed but 

unconsunimated agreements related to the Anny Mass Transit Benefit Program. 

e. All data and records identifying communications devices and numbers utilized during the 

formulation and submission of any U.S. government claim, or benefit, and application 

related to the Army MTBP, including residential telephones, fax machines, cell phones, 

blackberries, and like devices, address books, calendars, and other similar types of records. 

f. All data and records relating to fmancial accounts associated with Kevin Pelayo, Soldiers 

Van Pools, LLC, and the Army Mass Transit Benefit Program. 

g. All data, records and communications that may identify any co-conspirators of Kevin 

Pelayo or Soldiers Van Pools, LLC related to the Army Mass Transit Benefit Program. 

h. Email and attachments that provide context to any electronic mail reflecting the criminal 

activity described in this warrant including any electronic mail sent or received in temporal 

proximity to any relevant electronic mail and any electronic mail that identifies any users 

of the subject accounts; and 

i. Information relating to who created, used, or communicated with the accounts, including 

records about their identities and whereabouts. 

j. Any data and records pertaining to any communications with a government email address 

ending in .civ@mail.mil or .mil@mail.mil 

Case 6:20-mj-00106-JCM Document 4 Filed 06/22/20 Page 5 of 6
IlL Providers Procedures 

Microsoft Corporation shall deliver the information set forth above within 30 days of the service 

of this warrant and shall send the information to: 

U.S. Army CID-MPFU 

Attn: Special Agent Ricky Welton 

40 N.E. Loop 410 

Suite #430 

San Antonio, TX 78216 

Ricky.L.Welton2.civmaiI.mil 

Case 6:20-mj-00106-JCM Document 4 Filed 06/22/20 Page 6 of 6