WI Teen Charged With Murdering Parents In ‘Neo-Nazi’ Satanic Plot To Kill Trump
A 17-year-old kid from Wisconsin is suspected of murdering his own parents as part of a demented plot to assassinate President Trump and violently overthrow the government, according to charges outlined by local law enforcement.
The teenager, Nikita Casap, has been charged with two counts of first-degree intentional homicide of his own mother and stepfather, according to a Waukesha County Sheriff’s Department press release.
Case 2:25-mj-00038-WED Filed 03/18/25 Page 1 of 26 Document 1
AO 106A 08/18) Application for aWarrant by Telephone or Other Reliable Electronic Means
UNITED STATES DISTRICT COURT
for theEastern District of WisconsinIn the Matter of the Search of
Briefly escribehepropertyo besearchedor dentifyheperson y name ndaddress)
Devices further described in Attachment A, located atthe WCSO Computer Forensic Lab CFL} located at515 West Moreland Boulevard, Waukesha, WI 53188CaseNo.25
MJ
38
APPLICATION FOR AW ARRANT BY TELEPHONE OR OTHER RELIABLE ELECTRONIC MEANS
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state underpenalty of perjury that I have reason to believe that on the following person or property
identifyheperson rdescribehepropertyo besearchedndgive ts ocation):
See Attachment Alocated in the___ E_as_t_e_rn__ District of _____ W_i_sc_o_n_s_in____ , there is now concealed
identifyheperson r describehepropertyo beseized):
See Attachment 8The basis for the search under Fed. R. Crim. P. 41 c) is
check neormore):
1 f
vidence of a crime;
1 f
ontraband, fruits of crime, or other items illegally possessed;property designed for use, intended for use, or used in committing a crime;a person to be arrested or a person who is unlawfully restrained.The search is related to a violation of:
Code Section Offense Description
Title 18 U.S.C. § 371; ConspiracyTitle 18 U.1751 c}and
d);
and Presidential assassinationTitle 18 U.S.C. §2332a a} 2} Weapons of mass destructionThe application is based on these facts:See attached Affidavit
1 f
Continued on the attached sheet.LI Delayed notice of __ days
give xact nding ate f more han30days:
_____
)
is requested under18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.
~?2—-
£7
~i?Jin~ignature
Justin Mosiman, FBI Special Agent
Printed ame nd itle
Attested to by
~~e
applicant in accordance with the requirements of Ped. R. Crim. P. 4.1 by
telep one
specifyeliable lectronic eans).
Date
03/18/2025
w~ ~~~
City and state: Milwaukee,WisconsinHonorable William
E.
Duffin,U.S. Magistrate Judge
Printed ame nd itle
Case 2:25-mj-00038-WED Filed 03/18/25 Page 2 of 26 Document 1
FFID VIT IN SUPPORT OFN PPLIC TION FOR SE RCH W RR NT
I Justin Mosiman being first duly sworn herby depose and state as follows:INTRODUCTION AND AGENT BACKGROUND1. I make this affidavit in support of an application for a search warrant for electronicdevices as described in Attachment A received from the Waukesha County Sheriffs Office forthe things described in Attachment B.2. I am a Special Agent with the Federal Bureau of Investigation and have been sinceMay 2019. I have also been a Special Agent Bomb Technician since February 2021. lam currentlyassigned to the Joint Terrorism Task Force in Milwaukee where I investigate violations of federallaw. I have investigated and assisted in the investigation of matters involving violations of federallaw related to domestic and international terrorism and weapons of mass destruction including theservice of search and arrest warrants. Prior to my employment with the FBI I served in the UnitedStates Navy for six years as an Explosive Ordnance Disposal Technician and was employed as acontractor with the Department of Defense as an Explosive Ordnance Disposal Subject Matterexpert for six additional years.3. The facts in this affidavit are known to me through my personal knowledgetraining experience and through information provided to me by other law enforcement officers inthe course of their duties whom I consider to be truthful and reliable.4. This affidavit is intended to show there is sufficient probable cause for the requestedwarrant and does not set forth all my knowledge about this matter. Based on the facts set forth inthis affidavit there is probable cause to believe that the following violations of federal law havebeen committed:
Case 2:25-mj-00038-WED Filed 03/18/25 Page 3 of 26 Document 1
a.
Title 18 U.S.C. § 371
(Conspiracy) makes it unlawful for two or morepersons to conspire to commit any offense against the United States.b.
Title 18 U.S.C. § 1751 c) and d)
(Presidential assassination) make itunlawful to attempt to kill the President or Vice-President of the United States orfor two or more persons to conspire to kill the President or Vice-President of theUnited States.c.
Title 18 U.S.C. § 2332a a) 2)
(Use of weapons of mass destruction) makesit unlawful for any person to use, threaten, or attempt or conspire to use, a weaponof mass destruction against any person within the Unites States utilizing interstateor foreign commerce. The term weapon of mass destruction is defined in 18U.S.C. § 2332a(c )(2)(a) to include any destructive device as defined in 18 U.S.C. §921(a)(4).5. There is probable cause to search the items described in Attachment A for evidencefurther described in Attachment B.PROBABLE CAUSE6. On February 28, 2025, at approximately 9:44 a.m., Donald Mayer’s mother, J.M,contacted the Waukesha County Communications Center to request a welfare check at a residencein Waukesha, Wisconsin. J.M stated they were unable to contact the family and learned NikitaCasap had not attended high school for approximately two weeks. Additionally, the SchoolResource Officer (SRO) for Waukesha West High School also requested a welfare check andadvised that Casap had been absent for approximately two weeks.7. On February 28, 2025, law enforcement officers from the Waukesha CountySheriff’s Office (WCSO) conducted a welfare check at approximately 10:00 a.m. on Nikita Casap,2
Case 2:25-mj-00038-WED Filed 03/18/25 Page 4 of 26 Document 1
his mother, Tatiana Casap (Tatiana), and his step-father, Donald Mayer. The Deputy was unableto make contact with the residents and received information from neighbors that they had not seenthe family recently. The Deputy contacted Mayer’s work manager and received information thatMayer had not been to work since February 13, 2025 but had communicated via text message fromFebruary 13 to 24, 2025, claiming to be sick and unable to work.8. On February 28, 2025, at approximately 1 40 p.m., WCSO Deputies entered theresidence through the garage and found Tatiana Casap deceased, likely from gunshot wounds, andcovered with blankets. WCSO secured the residence.9. WCSO requested emergency cell phone pings from AT&T for Donald Mayer andNikita Casap. AT&T provided information that both phones were located in the area of Laramie,Wyoming.10. A neighbor immediately to the west of the residence, P.F., provided information
to
WCSO that there had been little activity at the residence for two weeks. On February 23, 2025,P.F. observed Mayer’s black SUV driving away from the residence.11. During a secondary search of the residence, Donald Mayer was located, deceasedfrom gunshot wounds, in the first-floor office and also covered in blankets. During the search, areceipt was found for a .357 magnum revolver, but the firearm was not located in the residence.12. Based on information obtained by WCSO during the course of their investigation,including security footage, cell-phone records, and witness statement, Mayer and Tatiana arebelieved to have been killed on February 11, 2025, at approximately 6:30 p.m. and 8:40 p.m.,respectively.13. WCSO reviewed ping records, which showed that Casap‘sphone was stationary onFebruary 24, 2025, between 2:20 and 2:50 p.m. at theWorld’sLargest Truckstop located
in
Case 2:25-mj-00038-WED Filed 03/18/25 Page 5 of 26 Document 1
Walcott, Iowa. The Walcott Police Department provided security footage of Casap operatingMayer’s black Volkswagen Atlas SUV and was alone, traveling with their family dog.14. On February 28, 2025, at approximately 10:00 p.m., Mayer’s vehicle was listed asstolenandCasap was entered as amissingjuvenile inNCIC. At 11:25p.m. that day, the WaKeeneyKansas Police Department (WPD) conducted a traffic stop on Mayer’s SUV. An unloaded .357magnum revolver was observed in plain view on the front passenger floorboard. Boxes of .357magnum and .38 special ammunition, Mayer and Tatiana’s wallets, large amount ofU.S. currencyand Euros, and two cell phones belonging to Mayer and Casap were found in the vehicle. WPDultimately arrested Nikita Casap for theft of a vehicle and possession of a firearm and seized hiscell phone incident to his arrest.15. On March 3, 2025, WCSO obtained a search warrantforCasap’scellphone. Duringtheir review, WCSO identified material on the phone related to the The Order of Nine Angles(O9A).
1
WCSO review of the phone identified possible usemames for Casap includingaccelerationist14 and Awoken.16. On March 4, 2025, WCSO executed a search warrant for Mayer’s VolkswagenAtlas. During the search, the following items were located in the vehicle: a pried open safe;women’s jewelry; electronics, including iPads, cell phones, and laptops; approximately $14,000;banking documents; hard drives and external storage devices; a SimpliSafe home security sensor;and a YI security camera with a micro SD card.
1
The OrderofNineAngles (O9A)is a networkofindividualsholdingneo-Naziraciallymotivatedextremist views. 09 A advocates for the use of violence and terrorism to overthrow governmentsand destroy modem civilization.4
Case 2:25-mj-00038-WED Filed 03/18/25 Page 6 of 26 Document 1
17. WCSO reviewed Casap’s phone and saw images and communications thatreferenced a self-described manifesto regarding assassinating the president, making bombs, andterrorist attacks.18. During WCSO review of Telegram messages between February 14 and 24, 2025,messages in Russian were identified from phone notifications and translated, including:a. Reply to them all and say [you] got sick.b. Take [drag] them to the basement.19. WCSO review of the YI security camera and micro SD card that were found in theVolkswagen Atlas revealed footage from February 16 to 22, 2025, including Casap lighting (whatare believed to be scented) candles and rummaging through a desk while near a mound of blanketsand pillows covering Mayer’s body.Ideology20. On March 7 to 8, 2025, a preliminary review of the device image by the FBI forexigent threats revealed the following conversations:a. TikTok, December 6-8, 2024:
Awoken
(UID: 7087032891993605163): Yk it’s kinda interestinghow I told this girl best friend about how I follow O9A teachingsand whatnot and she was pretty chill about it
Awoken
I feel like mostly people would freak out lol
Awoken
Hbu, does anyone irl know you ‘re into 09 A, CharlieManson?
Mystic Physis
(UID: 7399786784584369195): well they know
Awoken
My parents don’t know lol, they would take away myphone away if they did. Especially since last year fbi visited
2
lol
Mystic Physis
my parents know
2
The FBI interviewed the Casap family in November of 2023 for unrelated internet IP activity.All members of the family denied the IP activity and Agents were allowed to view devices andinternet history and found no corroboration of the alleged internet activity.
5
Case 2:25-mj-00038-WED Filed 03/18/25 Page 7 of 26 Document 1
Awoken
Are you over 18? Cuz I’m not, thus they still have controlto take away stuff
Mystic Physis
me neither
Awoken
And your parents don’t care ?
Mystic Physis
nob. TikTok, December 27, 2024:
Nihilus
(UID: 7412693046985114629): He dude
Nihilus
Do yk any telegram group where niners and dreccs caninteract and exchange info?
Awoken
Sorry no, I’m mostly in NS/WP crew tg groups lol
Awoken
If you do find any, it’d be nice if u tell me
Nihilus
What’s WP
Awoken
https://en.m. wikipedia.org/wiki/National_ Socialism_/_White _Power
Nihilus
Oh white power
Nihilus
Cool
Awoken
Do you know why O9A telegram groups?
Nihilus
You mean any 09 A telegram groups?
Awoken
Yeah typo lol
Nihilus
Oh not a group
Nihilus
But a channel
Nihilus
you can find documents there
Awoken
alright send
Nihilus
https://t.me/c/2300591097/3
Awoken
Can you send me the link to the account?
Awoken
It says I can’t access the message
Nihilus
How can I do that?
Nihilus
wait a sec
Awoken
Here’s mine tg usemame @accelerationist14
Nihilus
I sent a msgc. Telegram, January 21, 2025:
•
@accelerationist
“whatcountrydo you think will get the blame forthis?”
•
Unknown
Russia will be blamed for it, this is the goal
Case 2:25-mj-00038-WED Filed 03/18/25 Page 8 of 26 Document 1
•
@accelerationist
When the time comes for me to send mymanifesto to you ( so that you can spread it online ), should it be pdf?And also you won’t anyhow change or modify the manifesto•
Unknown
Write on a piece of paper and take a picture of it21. FBI personnel performing the preliminary review also saw images of a three-pagedocument entitled,Acceleratethe Collapse. The images, which appear to be screengrabs of adocument that was displayed on the phone, were created on February 28, 2025. The documentappears to be the manifesto referenced by@accelerationist,in the messages with the unknownuser in the above paragraph, calling for the assassination of the President of the United States inorder to foment a political revolution in the United States andsavethe white race from Jewishcontrolled politicians. The third page of the document contained images of Adolf Hitler with textHAIL HITLER HAIL THE WHITE RACE HAIL VICTORY.22. Excerpts from the three-page document include:a.
It
is clear that jews control all of the White countries, and it is clear thatthey promote White genocide and degeneracy. This for the white race to survive, itis necessary to accelerate the collapse of the countries. Jewish occupiedgovernments must fall. The white race cannot survive unless America collapses.b.Asto why, specifically Trump, I think it’s obvious. By getting rid of thepresident and perhaps the vice president, that is guaranteed to bring in some chaos.And not only that, but it will further bring into the public the idea that assassinationsand accelerating the collapse are possible things to do.c.Nowwhat if you say you aren’t capable of committing these acts? This
is
perfectly fine for now, the next best thing you can do is to tribe and train. Makeconnections, join White conscious martial arts clubs, because once Americacollapses there would have to be a network that can take its place.
7
Case 2:25-mj-00038-WED Filed 03/18/25 Page 9 of 26 Document 1
d.Readingis also important. Read Siege
3
by James Mason, MilitantAccerlerationism/The Hard Reset
4
by Terrorgram, Redstone Killers-good sourceregarding sabotage, A Call To Arms -Juraj Krajcik. The American Futurist
5
havea lot ofreally good articles. They’re former Atomwaffen
6
guys, and there is suremuch to learn from the success and mistakes of Atomwaffen.e.UseYandex, to find bomb making instructions and those books … f youalready know the reality of situation, that there is no political solution, then I wouldjust focus on reading practical material. Such as the ways to do attacks (Terrorgrampublications and Redstone Killers talks of this) .. if you already know all of that andare just waiting for a signal, well then this is your signal to act. Jewish politiciansand billionaires have names and addresses. Find out what they are and kill them.
f.
As a side note, the other attacks that may occur, I have no idea what theyare/who they target. I have no idea even if they are same ideology as I. Point being,this manifesto is specifically for the attack that targets Trump.g.There’llnever be a perfect revolutionary situation that springs up out ofnowhere. We need to create a revolutionary situation ourselves. I do agree that onlyif terrorism is sustained over a period of time can it be effective. In short, hugeamounts of violence will be required. Long past are the days when we can vote fora Hitler to save us. It is time we stop waiting. The best day to commit an attack istoday, the next best is tomorrow.h.Itis time that we lead the way to the System collapse. Do absolutelyanything you can that will lead to the collapse of America or any other country youlive in. This is the only way that we can save the White race. White Revolution isthe only solution.
3
Siege by James Mason is a series of racially motivated violent extremism essays advocating forthe use of terrorism to accelerate a white-race revolution.On January 13, 2025, the United States DepartmentofState designated the Terrorgram Collectiveas Specially Designated Global Terrorists.
5
The American Futurist is an online media platform promoting violent extremism includingarticles and guides for conducting acts of terrorism.
6
Atomwaffen Division (AWD) is aneo-Nazi white supremacist extremist organization advocatingfor the use of violent terrorism to accelerate the social collapse.
8
Case 2:25-mj-00038-WED Filed 03/18/25 Page 10 of 26 Document 1
23. Nihilistic Violent Extremists NVEs) are individuals who engage in criminalconduct within the United States and abroad, in furtherance of political, social, or religious goalsthat derive primarily from a hatred of society at large and a desire to bring about its collapse bysowing indiscriminate chaos, destruction, and social instability. NVEs work individually or as partof a network with these goals of destroying civilized society through the corruption andexploitation of vulnerable populations, which often include minors.24. NVEs, both individually and as a network, systematically and methodically targetvulnerable populations across the United States and the globe. NVEs frequently use social mediacommunication platforms to connect with individuals and desensitize them to violence by, amongother things, breaking down societal norms regarding engaging in violence, normalizing thepossession, production, and sharing of gore material, and otherwise corrupting and grooming thoseindividuals towards committing future acts of violence.25. Those individuals are targeted online, often through synchronized group chats.NVEs frequently conduct coordinated extortions of individuals by blackmailing them so theycomply with the demands of the network. These demands vary and include, but are not limited to,self-mutilation, online and in-person sexual acts, harm to animals, sexual exploitation of siblingsand others, acts of violence, threats of violence, suicide, and murder.26. Historically, NVEs systematically targeted vulnerable individuals by grooming,extorting, coercing, and otherwise compelling through force, or the threat of force, the victims tomutilate themselves or do violence, or threaten violence, to others and either film or photographsuch activity. The members of the network have edited compilation photographs or videos oftargeted individuals, shared the photographs and videos on social media platforms for severalreasons, including to gain notoriety amongst members of the network, and spread fear among those
Case 2:25-mj-00038-WED Filed 03/18/25 Page 11 of 26 Document 1
targeted individuals for the purpose ofacceleratingthe downfall of society and otherwise achievingthe goals of the NVEs.27. NVEs networks have adopted various monikers to identify themselves. Thenetworks have changed names over time, which has led to the creation of related networks.Although the networks change names and use a variety of different social media platforms, thecore members and goals remain consistent and align with the overarching threat of NVE.Conspiracy28. FBI personnel performing the preliminary review also saw an image withinformation of how to utilize a drone as an attack drone. The information contains directions onhow to extend the range of an attack drone by using repeater drones and ways to avoid detection,such as making a drone from a kit rather than a commercial off-the-shelfbrand. The instructionsprovide direction to use a small dropper to drop an explosive, Molotov cocktail, or very strongtopical poison. Additionally, to avoid detection, the instructions advise to not bring a cell phone.29. FBI personnel performing the preliminary review also saw a Telegram directmessage conversation with POMaH BiKTOBHl.£, who writes in Cyrillic and has the Ukrainianmobile telephone number +380 50 259 5318. In the conversation, Accelerationist (Casap) states:• How long will I need to hide before I will be moved to Ukraine? 1 -2months?• Also I probably should brush up on my Russian, because I can understandjust fine but speaking is harder lol• So while in Ukraine, I’ll be able to get a normal job and have a normallife? Even if when it’s found out I did it?• Do the other 10 people also have similar beliefs to I? Or are theydifferent?• Assuming that my parents won’t leave … [remainder of message cut off]
Case 2:25-mj-00038-WED Filed 03/18/25 Page 12 of 26 Document 1
30. FBI personnel performing the preliminary review also saw a Telegram directmessage conversation withAngelof Death (usemame:@AngelOkIDeath)that contained thefollowing messages from Casap (using the usemame Accelerationist ):• A drone with a dropping mechanism•Yeah.I still have to ask@asellfuckregarding what should be the caringcapacity of the drone (unless he told you already).• Anyway, yeah so the drone would drop a bomb (with nuts, bolts, needles).So I will need that.• Angel of Death:Thetotal amount will be 1200-1500$ Payment byton btc
7
usdt? Bike waiting time is 7-10 days The IED-2000-500model is reserved for you, do you confirm the purchase?• Yeah I’m aware you will only start working once I’ve paid you. So I’ll textyou when I can pay. That includes the headphones as well? Quality one
to
protect hearing from gunshots of a .357 magnum. Just making sure• [bitcoin wallet address] That’s your bitcoin address, correct? Just makingsure.• So once the transfer is complete and I’ll be able to pick up it up. Is it justthe drone with the dropping mechanism? Or also explosives?•Howmuch will 200 wheels cost for this bike?31. FBI personnel performing the preliminary exigency review also saw a directmessage conversation with an individual, forest , who writes in Cyrillic, that contained messagesto obtain a different license plate and coordinates along with driving directions from a currentlocation in southeast Wyoming through Kansas to a location near Pumpkin Center, Oklahoma.Additionally, usemame alexander802 (Casap) states,andthen from there to Eureka, California,it is 30 hours. You think I’ll have enough time?32. FBI personnel performing the preliminary review also saw images created onFebruary 28, 2025, of the front and back of Mayer’s American Airlines AAdvantage credit card,PNC Bank debit card, BMO Harris Bank debit card, armed forces identification card, and driver’s
7
From context, btc here refers to the cryptocurrency bitcoin.11
Case 2:25-mj-00038-WED Filed 03/18/25 Page 13 of 26 Document 1
license. FBI personnel also saw an image displaying the username and password for a BMO Bankaccount.33. On March 10, 2025, WSCO interviewed a classmate of Casap. The classmate statedthat Casap would send gore edit videos that included flashing gory and war images put toRussian music via Snapchat. Casap told the classmate he intended to kill his parents by shootingthem but did not have access to a gun. He later told the classmate that he would befriend someonewith a gun and then steal the gun. Casap told the classmate he was in contact with a male in Russiavia Telegram and they were planning to overthrow the government of the United States andassassinate President Trump. Casap told the classmate that when they saw 10 consecutive attacksin the news, it would have been him.34. In sum, Casap appears to have written a manifesto calling for the assassination ofthe President of the United States. He was in touch with other parties about his plan to kill thePresident and overthrow the government of the United States. And he paid for, at least in part, adrone and explosives to be used as a weapon of mass destruction to commit an attack. The killingof his parents appeared to be an effort to obtain the financial means and autonomy necessary
to
carrying out his plan. Other parties, with whom Casap was in contact, appear to have been awareof his plan and actions and to have provided assistance to Casap in carrying them out.IDENTIFICATION OF THE DEVICES TO BE EXAMINED35. The property to be searched includes a series of devices which were seized pursuantto state search warrants in the State of Wisconsin Waukesha County Circuit Court and executedby Waukesha County Sheriff’s Office (WCSO) as described below.36. On February 28, 2025, and March 3, 2025, respectively, search warrants weresigned in the State of Wisconsin Waukesha County Circuit Court which authorized the search of12
Case 2:25-mj-00038-WED Filed 03/18/25 Page 14 of 26 Document 1
the residence located at S38W27056 Cider Hills Drive, Waukesha, Wisconsin. During theexecution of these warrants, the following items were seized:a. WCSO Item Al -Computer, HP Pavilion 523W, SIN MX24490881b. WCSO Item A2 -Computer, HP Tower MX892907YSc. WCSO Item A3 -Computer, HP Prodeskd. WCSO Item A4 -Hard Drive, Cloud Key F492BF732E03e. WCSO Item A5 -Laptop, Apple Laptop Model A21 79, SINFVFDNUE2MNHR
f.
WCSO Item A6 -Laptop, Apple Laptop Model A1466 SINCl 7QP4LRG940g. WCSO Item A8 -Computer, HP Pavilion Slimlineh. WCSO Item Al0 -Laptop, Panasonic NIB Laptop
1.
WCSO Item Al 2 -Cell Phone, Cell phone from cabinet in Kitchen, iPhoneA1661J. WCSO Item A13 -Camerai.Sony Cyber Shotii.Kodak AZ421iii.Coolpix B500k. WCSO Item A14 -Computer Tablet, iPad in Purple Case
1.
WCSO Item A15 -Computer Tablet, Blue iPad Air, Heavy Damagem. WCSO Item B 1 – 6) Home Security Cameras recovered from cabinet inDining Room areai.Yi Camera Identifier: YFUSY94RZI13
Case 2:25-mj-00038-WED Filed 03/18/25 Page 15 of 26 Document 1
ii.Yi Camera Identifier: 47USYMDEYTiii.Yi Camera Identifier: 47USYMDEYTiv.Yi Camera Identifier: YFUSY941Llv.Yi Camera Identifier: 47USY6I9XNvi.SimpliSafe Camera Model: CM006 Identifier: Fl 157F53n. WCSO Item B6 -DVR Ubiquiti Video MAC ID 1633F802AA84FFC93with Cordo. WCSO Item Dl -Trail Camera Campak Model T40 Camo Front BlackBackp. WCSO Item D2 -Trail Camera Ronitry Brand Camo Front Black Back3 7. Also on March 3 2025 a search warrant was signed in the State of WisconsinWaukesha County Circuit Court which authorized the search of the following two devices whichwere seized by WaKeeney Kansas Police Department during their arrest of Nikita Casap onFebruary 28 2025:a. WCSO Item E3 -Cell phone Gray iPhone in a green and gold LonasicBrand Caseb. WCSO Item E4 -Cell phone Rose gold with Gold trim iPhone in a BlackLeather Case38. On March 3 2025 a search warrant was signed in the State of Wisconsin WaukeshaCounty Circuit Court which authorized the search of a black 2018 Volkswagen Atlas withWisconsin Registration AUJ-4219 and VIN: 1V2MR2CA2JC591194 registered to Donald S.Mayer date of birth March 16 1973. During the execution of the warrant the following itemswere seized:14
Case 2:25-mj-00038-WED Filed 03/18/25 Page 16 of 26 Document 1
a. WCSO Item G 1 -Hard Drive, WD External Hard Driveb. WCSO Item G 10 -External Storage
1.
(6) Thumb Drives
11. (
4) Micro SD Cards
111.
(4) SD Cardsc. WCSO Item G14 -Two Digital Watches, Apple watchesd. WCSO Item G16 -Cell phone, Black iPhone Model A1429e. WCSO Item Gl 7-Cellphone, Black Apple iPhone inclearcasew/Nikita sSchool ID
f.
WCSO Item G 18 -Laptop, ThinkPad Lenovo SIN PFZ0BS3g. WCSO Item G 19 -Laptop, ThinkPad Laptoph. WCSO Item G20 -Tablet, iPad in Blue Case A2270, H9DH0NQQ1 GJ
1.
WCSO Item G21 -Digital Book, KindleJ. WCSO Item G37 -Laptop, MacBook Pro Model A1398 SINC02NM0TRG3QNk. WCSO Item G38 -iPad, iPad from Waukesha School District
1.
WCSO Item G39 -iPad, iPad Silver Model A139, SIN DKV90EKDFJOm. WCSO Item G40 -iPad, Model A1701 SIN DMPVR5YBHP51, BlackLeather Casen. WCSO Item G41 -Laptop, Dell Latitude 3390 2 IN 1 SIN B7TY1P2o. WCSO Item G42 -Laptop, HP Spectre X360 SIN SCD93863SFp. WCSO Item G43 -iPad, iPad Air in Colorful Case, Model AZ588 SINHC3024WWK915
Case 2:25-mj-00038-WED Filed 03/18/25 Page 17 of 26 Document 1
q. WCSO Item G44 -iPad, Rose Gold iPad, Model A1566, SINDLXNKBNHG5W0r. WCSO Item G45 -iPad, Rose Gold iPad, Model A1566, SINDMQRTAH8GSW0s. WCSO Item G46 -iPad, Silver iPad Model A2327 SIN L3DONRLL2Wt. WCSO Item G56-Surveillance Camera, Yi Camera and SimpliSafe Sensor39. WSCO Items Al-A6, A8, Al0, A12-A15, Bl, B6, Dl, D2,E3, E4, Gl, Gl0, G14,G 16-G21, G3 7-G46, and G56 ( collectively the Devices ) are currently located at the WCSOComputer Forensic Lab (CFL) located at 515 West Moreland Boulevard, Waukesha, WI 53188.40. The applied-for warrant would authorize the forensic examination of the Devicesfor the purpose ofidentifying electronically stored data particularly described in Attachment B.ELECTRONIC STORAGE AND FORENSIC ANALYSIS41. Based on my knowledge, training, and experience, I know that electronic devicescan store information for long periods of time. Similarly, things that have been viewed via theInternet are typically stored for some period of time on the device. I know it is common forindividuals to use multiple devices that can connect to the internet. Information from devices canbe backed up via online services directly or indirectly which may then be linked or synchronizedwith other devices. Cameras can store data natively and via removeable memory. Cameras areoften used by individuals to video record manifestos and perform target reconnaissance. Securitycameras can store data in various ways that include natively on the device, removeable media, andvia internet services. The nature of this matter involves radicalization materials that can be storedas images or electronic documents which can be viewed by the user on devices with a screen andoperating system. Additionally, the modem internet-of-things connects multiple devices that16
Case 2:25-mj-00038-WED Filed 03/18/25 Page 18 of 26 Document 1
connect to the same internet network to store and access data across devices. Smart-devices thatinclude wearables retain information natively in order to synchronize with cloud-based accountsand linked devices when re-connected. Digital video recorders (DVR) have native storage mediathat can store user programming including security and surveillance footage. This information cansometimes be recovered with forensics tools.42. As further described in Attachment B, this application seeks permission to locatenot only electronically stored information that might serve as direct evidence of the crimesdescribed on the warrant, but also forensic evidence that establishes how the Device was used, thepurpose of its use, who used it, and when. There is probable cause to believe that this forensicelectronic evidence might be on the Device because:a. Data on the storage medium can provide evidence of a file that was once onthe storage medium but has since been deleted or edited, or of a deleted portion ofa file (such as a paragraph that has been deleted from a word processing file).b. Forensic evidence on a device can also indicate who has used or controlledthe device. This user attribution evidence is analogous to the search for indiciaof occupancy while executing a search warrant at a residence.c. A person with appropriate familiarity with how an electronic device w01ksmay, after examining this forensic evidence in its proper context, be able to drawconclusions about how electronic devices were used, the purpose of their use, whoused them, and when.d. The process of identifying the exact electronically stored information on astorage medium that is necessary to draw an accurate conclusion is a dynamicprocess. Electronic evidence is not always data that can be merely reviewed by a
17
Case 2:25-mj-00038-WED Filed 03/18/25 Page 19 of 26 Document 1
review team and passed along to investigators. Whether data stored on a computeris evidence may depend on other information stored on the computer and theapplication of knowledge about how a computer behaves. Therefore, contextualinformation necessary to understand other evidence also falls within the scope ofthe warrant.e. Further, in finding evidence of how a device was used, the purpose of itsuse, who used it, and when, sometimes it is necessary to establish that a particularthing is not present on a storage medium.
f.
I know that when an individual uses an electronic device to facilitate orfurther a crime, the individual s electronic device will generally serve both as aninstrumentality for committing the crime, and also as a storage medium forevidence of the crime. The electronic device is then an instrumentality of the crimebecause it is used as a means of committing the criminal offense. The electronicdevice is also likely to be a storage medium for evidence of crime. From my trainingand experience, I believe that an electronic device used to commit a crime of thistype may contain: data that is evidence of how the electronic device was used; datathat was sent or received; and other records that indicate the nature of the offense.43. Based on the foregoing, the warrant I am applying for would permit theexamination of the devices consistent with the warrant. The examination may require authoritiesto employ techniques, including but not limited to computer-assisted scans of the entire medium,that might expose many parts of the device to human inspection in order to determine whether itis evidence described by the warrant.
18
Case 2:25-mj-00038-WED Filed 03/18/25 Page 20 of 26 Document 1
44. Because this warrant seeks only permission to examine a device already in lawenforcement s possession, the execution of this warrant does not involve the physical intrusiononto a premises. Consequently, I submit there is reasonable cause for the Court to authorizeexecution of the warrant at any time in the day or night.
19
Case 2:25-mj-00038-WED Filed 03/18/25 Page 21 of 26 Document 1
TT CHMENT
The property to be searched are:1. WCSO Item Al -Computer, HP Pavilion 523W, SIN Mx:244908812. WCSO Item A2 -Computer, HP Tower MX892907YS3. WCSO Item A3 -Computer, HP Prodesk4. WCSO Item A4 -Hard Drive, Cloud Key F492BF732E035. WCSO Item AS -Laptop, Apple Laptop Model A2179, SIN FVFDNUE2MNHR6. WCSO Item A6 -Laptop, Apple Laptop Model A1466 SIN Cl 7QP4LRG9407. WCSO Item AS -Computer, HP Pavilion Slimline8. WCSO Item Al0 -Laptop, Panasonic NIB Laptop9. WCSO Item A 12 -Cell Phone, Cell phone from cabinet in Kitchen, iPhone A 166110. WCSO Item A13 -Camerasa. Sony Cyber Shotb. Kodak AZ421c. Coolpix B50011. WCSO Item A14 -Computer Tablet, iPad in Purple Case12. WCSO Item A15 -Computer Tablet, Blue iPad Air, Heavy Damage13. WCSO Item B 1 – 6) Home Security Cameras recovered from cabinet in Dining Roomareaa. Yi Camera Identifier: YFUSY94RZIb. Yi Camera Identifier: 4 7USYMDEYTc. Yi Camera Identifier: 4 7USYMDEYTd. Yi Camera Identifier: YFUSY941Ll20
