According to a criminal complaint against Preston Alexander McWaters, who allegedly “[conveyed] false or misleading information regarding an explosive device”, the VPN provider “Private Internet Access” doesn’t log.
McWaters, 25, appears to be an individual who can’t move on from relationships. On March 27, 2015, police were called to an address about a stalking complaint. The victims, Devon Kenney and her mother, complained that McWaters was stalking Kenney. When police arrived, Kenney told them that McWaters was hiding outside of her house and that when she went outside, McWaters confronted her. He didn’t leave until she called police.
Kenney claims that McWaters has repeatedly called her, texted her, messaged her on Facebook, and showed up at her house. It’s been estimated that McWaters has tried to contact her around 100 times. When she asked McWaters to stop, he said that if he couldn’t have her, then no one could.
Police spoke with McWaters and he told them that he and Kenney used to date and that he was “trying to patch things up.” Kenney obtained a “Threat Protection Order” against McWaters which is still in effect as of today.
From December 2015 to March 2016, several bomb threats were made to high schools, middle schools, elementary schools, airports, and companies from accounts that would appear to be associated with “Eric Mead” who is Kenney’s current boyfriend. In some instances, McWaters used accounts that would appear to be associated with Kenney.
The bomb threats made was almost identical to each other; a bomb will go off unless a ransom is delivered to an address, and if law enforcement is notified, the bomb the will go off.
The addresses in the emails were the home addresses of Mead and Kenney. In one instance, McWaters used the address of Mead’s mother.
“We have placed 10 pounds of C4 plastic explosive around the interior of Jupiter community high school. If you do not bring $10,000,000.00 in cash to 2500 Via Royale Apt. 2508, Jupiter, Fl 33458 by 12pm on Friday, then we will blow up your school and everyone inside. This is not a negotiable term. Don’t be heroes and get people killed. Bring the cash and your school will be spared the blood of infidels. Allah Akbar.”
“I have placed several pounds of c4 plastic explosive at one of your offices. 1920 Wekiva Way Suite 200 West Palm Beach , Fl 3341 if you do not comply with my demands then I will detonate the bombs and bring your building to the ground with everyone inside. I want $500,000 deliver to the address 2111 white pine cir, apt C in greenacres, Florida 33415. You have 24 hours to comply. If you call the cops or any other funny business then you will cost a lot of lives. Don’t do anything stupid or else . . . Kaboom ! ! !”
Every bomb threat that McWaters made was done using either email or Twitter.
For the threats that were made via Twitter, it was determined that the accounts that were used were verified using Tracfones (prepaid phones) which were purchased at Walmart. The phones were registered under Mead’s identity. Walmart provided security footage and transaction information to the FBI who were able to roughly make out who McWaters was:
“Upon looking at the still photographs of the individual making the purchases, the suspect appears to be a white male, medium build, 20 to 30 years of age, with slight facial hair. He appears to be wearing the same hat in both of these transactions, possibly a tan colored baseball hat with the University of Georgia emblem on it . ln the first transaction, he appears to be wearing a rather unique jacket, one that is a black and camouflage pattern. In the second transaction, the suspect can be seen leaving the store driving a newer model reddish in color Chevrolet Camaro.”
With a rough idea of who McWaters is now in mind, Walmart security was told by the FBI to be on the lookout for him. One officer identified him at a gas station near Walmart and took a picture of him and his car along with its license plate. DMV records show that the license plate number is registered to McWaters and his mother.
The FBI began surveillance on McWaters and later requested AT&T to provide toll records and location data for the Tracfones. The data showed that the phones were around the University of Georgia, which is where McWaters works, and his address when the threats were sent.
During the investigation, subpoenas and search warrants were sent to several companies, including 1&1 and Facebook, in an attempt to find the IP address that the threats were being sent from. All of them responded with an IP address that traced back to a company named “London Trust Media” who runs Private Internet Access.
When a subpoena was sent to them, they couldn’t provide McWaters’ IP address. However, “the only information they could provide is that the cluster of IP addresses being used was from the east coast of the United States .” McWaters does live on the east coast of the United States.
London Trust also told the FBI that they accept credit card payments and other forms of payment but McWaters didn’t make a payment to London Trust. The criminal complaint noted he did however make a payment to AnchorFree who runs Hotspot Shield VPN.
The FBI was able to correlate McWaters’ bank records to the purchases of the Tracfones:
“On February 29, 2016, a subpoena was sent to the First Madison Bank in Athens, Georgia requesting banking records for Preston McWaters. First Madison responded with the requested information. The banking records show that McWaters listed his address as the 155 Snapfinger Lane in Athens, Georgia. The banking records also show that on December 11, 2015, McWaters made a cash withdrawal of $80.00 and on January 22, 2016, he made a cash withdrawal of $60.00. These dates are significant because these are the exact same dates that the prepaid Tracfones discussed previously in this affidavit were purchased from Walmart in Athens with cash. On the January 22, 2016, transaction, the cash tendered at the register was $60.00, the exact amount that McWaters withdrew from his bank account that day.”
These records coupled together with the video footage makes a very damning case against McWaters.
“First Madison also provided video surveillance photos of McWaters making the withdrawals on those two dates. On December 11th, the photo shows McWaters face directly in front of the camera making the withdrawal at 11:44 am. In the photo you can also see that he is wearing sunglasses, a black and camouflage colored jacket, and a baseball style hat with the University of Georgia emblem on it. He is driving a dark colored Jeep SUV. This clothing matches the description of the clothing worn by the suspect purchasing the first tracfone referred to in this affidavit, 561-797-9 156, at the Walmart store on this same date at 12:11 pm. Therefore, your Affiant believes that it was McWaters who purchased the Tracfone on December 11, 2015.”
“The FBI took a picture of 155 Snapfinger Lane while conducting surveillance on February 29, 2016. McWaters’ red in color Camaro and a dark colored Jeep SUV were parked in the driveway. The video surveillance photos also show the transaction that occurred on January 22, 2016. At 8:14 am. McWaters drives up to the ATM in his red in color Camaro. The camera angle did not capture a picture of his face because the vehicle sits too low to the ground. However, the vehicle matches the description of the vehicle that the suspect drove to Walmart on that same day to purchase the second Tracfone referred to in this affidavit, 561-601-3416, at 10:04 am. Based on the surveillance video from the bank and Walmart, your Affiant believes that it was McWaters who purchased the second Tracfone on January 22, 2016.”
On March 4th, McWaters sent yet another bomb threat, this time to Palm Beach County Elementary school from the email address “[email protected]”.
“We have placed 13 chemical weapons throughout your facilities.They will detonate at 10:30 a.m. March 7, 2016 if you do not comply with our demands and bring $20,000,000.00 to 2500 Via Royale Apt. 2508. Jupiter, FL 33458 by the time of detonation. If you even try to contact the authorities and alert them to the situation then we will detonate the weapons early and everyone of your students will die. You have 4 days. Do not fuck with us! We are watching you ”Leslie Bolte” and your family.”
On March 7th, the FBI obtained a search warrant for McWater’s home and on the 8th, McWaters’ home was raided. He was found in his bedroom with his iPhone. The Private Internet Access app was found on the iPhone and every email address account used in the bomb threats. When his car was searched, car chargers that are believed to have been used with the Tracphones were found along with a note that had his Private Internet Access account details on it.
Lee concluded his statement with, “This report makes it clear that PIA does not log user activity and we continue to stand by our commitment to our users.”