``` PROCUREUR GENERAL DU CANADA REPRESENTANT LES ETATS-UNIS D’AMERIQUE, ayant une adresse au Ministére do la Justice Canada, 284, Wellington Street, Ottawa, ON, Canada KIA OH. INTIME LISTE DES ANNEXES | Annexe 1 Enliasse + Request for Provisional Arrest to Canada * Statementof facts supporting the Provisional Arrest of Sebastien Vachon-Desjardins + Mandat d'arrestation émis par les Etats-Unis d'Amérique Annexe 2 Autorisation de demander émission d'un mandat d'arrestation provisoire EY ``` ----- ``` Annexe 5 Arété Introductf instance Annexe 6 Affidavit de Louisette Vachon (mére) Annexe 7 Affidavit de Robert Desjardins (pére) Annexe 8 Affidavit du Requérant Et J'AI SIGNE a Montréal, ce 3 mai 2021 IC 3 [) Me Régirial Victor Procurgut du\Requégant a ``` ----- ``` ur Supérieure Palais de justice de Gatineau 17 Rue Laurier, Gatineau, Québec JBX 4C1 Courriel :geriS50@justice.gouv.qc.ca PRENEZ AVIS que la présente requéte en mise en liberté sera présentée pour adjudication devant honorable juge Catherine Mandeville j.c:s. au palais de justice de Gatineau, sis 17 Rue Laurier, les 12 et 13 mai 2021, 4 9h30 ou aussitot que le Conseil pourra étre entendu. Veuillez agir en conséquence. SIGNE A MONTREAL Le 3 mai 2021 [ I~) ALL ie [REginal Victorin Propuireur du Reduérant V 2 ``` ----- ----- ``` “Fhe United States Ataeney's Office, Middle District ofFlorida, Tampa Division A IDENTIFICATION OF FUGITIVE; Name: SebastienVachon.Desjardins, sa Sebastien Vachon Country ofCitizenship: Conada (Quebes drvers license tached) Dateof ia: July 11, 1987 Place ofBirth: Unknow, Race: Caucasian Gender: Male HeightWeight 173 am, unkiova ‘Hair/EyeColor: Brown, Brown SearsOtherCharacteristics: Unknown Photographs Attached. Drivers License No. V2536-110787-04 State ssued: Quebec ‘SpecificAddressExact Location in Canada: 36 Rue Desfoges, JR 2W1, Gtineay, Quebec ``` ----- ``` . Charging Or Commitment Document Indictment (copy attached Number: $:20.c1366-T-025PF DateFiled: December 2, 2020 United States Distt Cour, Middle DistrictofFlorida, TampaDivision saraHas the the Charging US. Sate DocumentDeparuint been unsealed and a foreign (0, bocn govermncrt unsealed for for purposesth limited ofxtrdiony? purpose of YES 2 Minimum Sentence Offs for which extradition i requested sr punishable by at east ore year prison: yes 3. Statuteof Linitations (Atached) Does statueof limitations preclude prosecutiono incarcertion? xo 4 US. Arrest Warzant (tached) Fugitive s wanted to Sand Teta Number: 20.c-366-T-0257F Date Filed: December 2, 2020 sued By: Jessica Dahl ``` ----- ``` 2 Prosecutor Authorization Provide the nameof heprosecutorauliorizing this PA request Carlton Gammon Assistant US. Atomey 400 N. Tampa Stee, Suite 3200, Tap, Florida 33602 Phonc: (813) 301-3081 mail:Carlton Gammors@usdoj gov BY SUBMITTING THIS FORM, THE PROSECUTOR COMMITS TO: (1) PREPARING A FINAL FXTRADITION REQUEST WITILN THE TIME: SPECIFIED BY OIA UPON THEARRESTOF TIIE FUGITIVE IN CANADA; AND (2) ACCEPTING RESPONSIBILITY FOR EXTRADIFION-RELATED COSTS. ``` ----- ``` 2. Since at least as early as in ox around March 2020, NetWalker has been advertised as sensomvare-as-a-service ("RaaS")!mide up of developers end afilates. Under this model, developers (or the “NetWalker organization”) ar responsible for creating and updating fhe ransomware, and aking it availble through agreements with “afliates”. Aflates ar individualso groupsofindividuals who ‘onduet research in order to ident high-value victims, aad who actually lunch the slacks oa victim networks by using the ransomaare cod packsges aud tools oblained rom Netwalkes organization. FBI guts have observed, in connection with various Netwalker investigations, tat the NetWalker afflites are identification (1D) nunber and not by name. As more fully set orth below, the FBI has identificd Sebastien Vachon-Desjarding os an afliateof Netwalker, also known as User 125, 3. Aer a victim pays the demanded ransom according the instructions provided by the affiliate, the ransom is split between the Netwalker developers (he NetWalke organization) and afflstes in accordance with thei agreement. On or about March 20, 2020, an individual using the moniker “Bugatti” posted an sdvertsemet on acybercriminal foram for NetWalker es a ReaS. The post—witien inthe Russian language with Cyrillic characters—outlined the process to become a NetWalker aiiae, * Blagents with raininga experience i rarsommvar investigationssr war that“rasomvare” aac the useofspecific malicioss computer code fo inflate and niet ths ges compute. The code J bh eas to itheaccessarson”thedatand ncypt typically eyvariouspossesmadeforms i, na in iselfaformof dt,of valuablerypocurrey, such at commoeity Ui vncsuch-oftheascithr coi.daabecousecont Victims iti decryptaressential targetedoracesothe speileally lesoperations hey becuseof ay.the farted vik, or consistsof ighlysensitive persona or sania dataofdivas, whic, ecssod could viletheprivacy or ole hts ofth individu Tho roleofsuch informatio would ls expose the argoted victimto civil ardoreroial Gabi. TBI agents with tang and experience ia ransomvare investigations ae awaro that Netwatke rasomware products,ed ctor consistingwh intend ofbundictal seiofcomputer digital code daa and ls tools, for nancial is marketed gan nd sod on he dark web spciicaly to Page tof ``` ----- ``` ‘confidential etaofindividuals, whic,ifleased couldexpose those individualo he tered entity to civil or criminal Habit. 1€ victimdoes not py theransom, the stolen data is often published online. 6. Since a leas is or round May 2020, a website named “the NetWalker Blog? (the Blog) hes cxistod—also on the dark web—for the exclusive purpose of fcilatng the publication of stolen victimdata. The Blogis accessibletoanyonewhouses the darkweb, and might seektouse it as3 resource for the various types ofciminal conduct, 7. The NetWalker Blogi not encrypted, but is freely accessible to anyone onthedark web. FBI agents who accessed the Blog observed tha,atimes, the NetWalkerBlogbas provided links to a cloud storage and file hosting service, MEGANZ (MEGA), where stolen ransomuare vietim data had ‘en uploaded. The NetWalker Blo lists the victin company or entity, sunimaryofthe company’s servis, and either a lik tothe stolen data oF when it ill be published. The NetWalker Blog also posts inks to sxeenshotsof daa stolenfom victiuns, in an apparentatempt 1o prove hat thesensitivedeta has infact been stolen. RansomusareAttacks 8. OnoraboutMay 1, 2020, etelecommunications company headquartered inFlorida (Victim #1) received a ransom note on one or wore of its workstations indiceting its network had been ‘compromised by tae NetWalker Rausomware. Victim #1's confidential business data was stolen and encrypted. The tausora demandedwas approximately US $300,000i bicoin, whichVictim#1 did not pay. Victim 1, however, estimated having spent spproximately US $1.2 millon to respond to the atack, contain its damage, and restore operations o normal. Forcsic analysis by Vieim #1 of ifs computer network revealed that on or about April 30, 2020, aserverusing I addross 193.56.28100 later identified TheealerTorFalees tothe darkwe se conelled by the NeclkerdeslerheNether crgmization. vagezar7 ``` ----- ``` 11. FBI conducted surveillance of Poland Server #1 from tho United States, and discovered that it contained. un sbundanceof hacking tools, including those used to perform reconnaissance, clevate privileges, and steal information rom & computer or network. Poland Server #1 also contained folders with customized sansomware deployment packages, also known as a “build” Each build is a zip file containing an executable file, PowerShell script, and text file identifying the vitim—all the tools necessary fo execute a ransomware tack. Tn tote], investigators discovered 12 builds on Poland Server #1 that had names of identified NetWalker victims, including both Vietira #1 and Victim #2. 12. Onor about May 13, 2020, FB investigators observed a new build on Poland Server #1 fora transport logisticscompanyheadquaatered ia France(Victim#3), and notified the FBI Legal Attaché that covers France. Unforturately, thecompanydid not receive the notiiestion quickly enough. Victim #3 received a ransom uote on oceormore of its workstations onorahout May 15, 2020, indicating its network had been compromised by the NetWalker Ransomware. The initial ransom demanded was spproximatcly US $50,000, and subsequently increased to approximately US $2,000,000 the same day. Victim #3 did not pay the ransom. On or sbout May 26, 2020, FBI investigators observed on the NetWalker Blog that Victim #s stolen data would be published on or about May 30, 2020, and elso posted a screenshot ofthescasitivedata. FBI determined that, onorshout May 30, 2020, Victim #3's data was linked on the NetWalker Blog via MEGA, the cloud storage and file hosting service used by the NetWalker organization to post stolen date. 13. On orabout June 3, 2020, an education institution headguistered in California (Victim #4) received a ransom note indicating its network had ben compromised by the NetWelker Rensomware. * Pulse Secure VP, is a commercial service designed o provid secure, authenticatedaccessfo remoteand mobile usersfromanyweb enabieddevicetocorporate resources,I thicas, the VPNwasbeing usedbyVictim 135 partof ts norma business operations. Page3ol7 ``` ----- ``` ursaent 10 a Mutual Legal Assistance Treaty request. FBI authorities conducted & forensic analysis of the servers. Tho contents of Poland Server #1 had largely been wiped clean. The recyele bin, however, did contain a directory with the same files that investigators had previously observed, including those relatingto Victim #1, Victim #2, and Victim #3. 15. The contentsofPolandServer#2 provided connections to a individual named “Sebastien Vachon.” On the server, FBI investigators discovered a fil named *2.png.” that depictedascreenshot af several files. According to the metadata attached o these files, * “Sebastien Vachon” had created snd ‘modified at least one ofthe files s recently as ino around June 2020, The server also provided clues ss to the locationof ts user. In or roundJune 2020,the Google Chromeautofillfanction indicated that the. userhid saved the address “36 Desforges, Gatineau, J8R 2/1.” Also, in July 2020, the user had viewed a webpage wracking the delivery ofa physical package that had been sent to Gatincay, Quebec. 16. The contentsofPoland Server #2 also provided additonal connections to the NetWalker Ransomware sorvices. According fo the web history data on thal server, NetWalkes Uses ID 128, whom the FBI hes reason to believe,based oncircumstantial dat, is Vachon,had registeredonthecybercriminel foram (discussed in paragraph 3, above), wher NetWelker was fist advertised. Additionally, the sae user had cither visited the email inbox or saved the usermame of email uddresses (megamogaup@protenmeil.com and syrs@pm.me), whick were connected 10 the individual who had uploaded data stolen from Victim #3 and Victim #4 on the Netwalker Blog Tho tm “metadata”as sed her refers 0data that provides informstion honothe dita, and specifically, th fil properties. Metadata co include the date when lewasexcted, modifcd, the deatof the user who created, modified oraccessed the fl, the locationwherethe file wascreatedand other information. Nota files ‘contain al pose formsofmeade and the metadsia can be sirippe or delecd froma le, in wholeofinpart. Pagosor7 ``` ----- ``` tlined herein, P51 believes that User ID 128 is Vachon. User ID 128 ranked second among affiliates in numberof buis* (144 builds), including the builds ofVictim #1, Victim #2, Victim 15, Vict #4, and many others. The BulgariaServercontained information rested to the NetWalker Blog, including nearly 500 fle depicting screenshots of sonsiive dat stolen fom vitims. Among those, User ID 128 was associated with 302ofthe screenshots. According o the miadataofthose 302 files, “Sebestcn Vachon” was eitherth “cxeator”or “author”of 73 serocnshot,inudingthoserelated 10 Victim # and Victim 4 “Th metadata attache (0 thebalanceof th serocshots did no contain informationegardingthe“author” or “creator”of those fils. 20. Accordingto ecords from Google, lawfully obtined in the United Sats, aroundth ime Victim #5 was attacked by the NetWalker Ransome (o or about May 15, 2020, Poland Server #1's 1 adress (hich ad been identified in connection withthe ransomware atack on Victim #37] had Togaed into Google accouat skankhusher@gmaL com. Records for thatsccount,lll obtainedinthe United Stats, indicated that it ws controlled by Scbesticn Vachon. 21. The second email sent from skenkiuntber@gmsil comonor about September 25, 2017, approzimately six deys afte the account's creation (on of about September 19, 2017), was sent t cal address svachon@hotmailf as described in the next section, this address hus been confirmedto belong 0 Vachon). Additcnally, on January 17, 2013, skankhunthex@gmaslcom received an email receipt fons ‘Googe forthe purchaseofa “GoogleHomeMin,”which had benshipped t “Sebastien Vachon 1 “36 Rue Desforges, Gatineau, QC, J8R 2W1, Canada.” 22. Google also provided records, sof September 2020ofmre then 35,000 incre searches conducted and websites visited by the skankhenthex@gmail.com accoursholder, which revealed epi wagesar? ``` ----- ``` hon.” I addition to the subscriber information, the contents ofthe account established thatit was controledby Vachon. The account contained to photosofVachon holding his Quobe driver's license and a sheet of paper bearing his full name as Sebastien Vachon Desjardias, a date, and the nameof a cyposurrency exchungs. Those photographs re attached to this request. The email account also contained correspondence from Banque Nationale du Canada (National BeakofCanada) in Vachon's name, and listing Vachon's known address (36 Rue Desforges, Gatiacau (QC) J8R 2W1). The account also contained a bill fom Bell Canad, = Canadian telecommunications ‘company, that was addressed to Vachon at tissemeaddress. 24. Thecontentsof the svachon@hotmailf account elo linkedVachon directly totheransom payment of a NetWalker Ransorviere attack of an education company headguirtered in the State of Washinglon (Vietim #5). Tn or around May 2020, Victim #5 was victimized by the NetWalker Ransomware. Victim #5 pad approximately 10.479 bitcoin [approximately US $94,877 on thedateof the transaction] in ransom. A. review of the svachon@hotmalfr sccount revealed two unrelated bitcoin transactions thet Vachon had conducted on or about Mey 22 and 24, 2020. Those transection hashes revealed that the cluster’ outofwhich Vachon paid, had received 8.16856429 bitin [epproximately $72,374.21 on the dateof the transaction)ofthe Victim #5 ransom on of about Mey 26, 2020. As further omaboration, investigators discovered a build for this victim on Poland Scrver #1, and Vachon had researched this vietim using the skanklunther@gmail.com account. Additionally, according to the ‘metadata ofthe scrccashots found on the Bulgaria Server, “Sebastien Vachon” create all fivescreenshots associatod with Victim 5. 25. Throughout the entire course of the investigation, Vachon has been linked (0 36 Rue Desforges, Gatineau, QC, J8R 2W1, Canad, including through: (1) his current Quebec-issued driver's ‘ode?A”lustor lustris isacollectioni esateofitcolnofladdresses he bic addrese thtare asssted ind to 0s be cin) controled continbyone nperson 3 ussor bean iy In wales theror Pager? ``` ----- ``` sjardins, astien”. 27. In 2020 lone, US. thriies have identified dozensofNetwelker Ransomwars atacks, resulting inthepayment of1433.57674 itoin in ransom ( curent valueofmore than US S27 milion). Based on the data obtined fiom the Bulgaria Server, Vachon isthe mostprofitable NeeWalke afte “This substantial amountof cyptocurrency— whichinvestigators havebeen unable 0tack 0date—would eatly fuciltate is Right from prosccstion. Additonal, as ofthe dateofthe most recent records from Google, lawfully obtained in the United States on or sbout September 2020, Vachon was actively escarching neve victims 0attackwiththeNetWalker Rasomwre,thecebypresentinganongoing danger 1o thes. I edditon toVachon's potential Bight, itis verylikely that he has, and will continue,to conduct ransomwareattacks, hereby presenting eal and penitent danger to others. 28. Aspastofa coordinated, nemationllowenforcement ation, FB isplewingo sce and disble the Bulgaria Server in January 2021, effectively ceasing the operation of the NetWalker Ransomware. As part ofthe persion, FB! will eplce the NetWalker Tor Panel welcome page with arms indicating, that lw enforcement has taken ove the website, I is Hkely that most, if ot al, dovelopers and afFlats, including Vachon, will immediately become aware of is law enforcement action. U.S. authorities request that Vachon's amt be conducted conlemprancously with the ation, so 510 nojeopardizeth vestigationby giving Vachonan ppotunityto fle,ordestroy and tamper with evidence. 29. Theprosecutor conumits o: (1) Preparing a formal exruditon request within the ime specified by the Office of Tnesnationsl ARBis/US. DepartmentofHusic, pon the amet ofthe fugitive in Canada; wid ©) scsspting responsibilityfo extradition elated costs. Page7or ``` ----- ``` : | hl 388g i : iwd | HE8 5g will iHS iiHH hih £m { yam 14 3 LE ¥ 4 a ``` ----- ----- ``` Yuan = gnley 5 ``` ----- ``` To: Anysoredoe nforesmntoffisr Ji YOU ARE COMMANDED toames and bringbefore 8UnitedSatemagistats judgewithoutunnecessary delay foams feinbers)_SEBASTIENVACHONDESIAROINS __/___ + horsseus of ffs orvillion ised he Fallow doc Fid ihdscor of cman ©Swpreding fimens © aloo 0Sparse nfometon ©Comps 3Probation Vicon Pelion © SupervisedRls ViléaPaiion 3VilaionNace 5 OnderoftheCout hi ors i bi dsb lows: / Conspiracyo oni Compster Frau iiaof18US. § 371 Conseto Commi isFu,[ n][vision] [of] marion aage 8 rossCo he. vlan [of] 150.5. 6[ TSHENSHAL] [(HNO,] AAO ard SCREX:smsSonsratinsSeg ella Domogia aPrtciedCompu, lain[of] THUSCS ORENTHB). (HNC). 7 owe BEC 83200 — Gesgeer BELLpsi — Gyms: TomoPoids J. SupASEmsoednsStsoctcont iainte Ren mamaTisvarawas sev ona TTT ndeprensa oe: / J [—] TR TTT — ``` ----- ----- ``` LEPROCUREUR GENERAL DU CANADA (aunom des Bats-Unis &Amérique) —em SEBASTIEN VACHON-DESJARDINS AUSST CONNU SOUSLEENOM DE SEBASTIEN VACHON AUTORISATIONDE DEMANDERL'EMISSIONDUN. 'MANDATDARRESTATION PROVISOIRE (Article 12 deaLotsur extradition) Les Etats-Unis dAmérique ont demandé au Canada de procéder 3 Farrestation provisoirc de Sebastien YachonDesjardins aussi conn Sous le nom de Sébastien Vachon Le Procureur ginéral du Canada est autorisé demander Fémision dun mandat arrestation provisore. Faith Gatincau le 24 jour de janvier 2021, 17 IN CathChoy, Avocate-conseil Service Ghnrjide nerntionale Cenuetetainistredela Justice du Canada ``` ----- ----- ``` REQUETE EX PARTE VISANT L'OBTENTION D'UN WANDAT D’ARRESTATION PROVISOIRE Adie 13 de a Lolsurfoxtraition A L'UN DES HONORABLES JUGES DE LA COUR SUPERIEURE DE LA PROVINCE DE QUEBEC, SIEGEANT EN CHAMBRE, LE REQUERANT EXPOSE CE QUI SUIT : 1. Les Etats-Unis d/Amérique ont proserté une demande d'arestation provisoira visant Sébastien VACHON-DESJARDINS, aussi connu sous le nom do Sébastien Vachon (ciaprés « linéressé »), en attendant la présentation d'une demande pour son extradition. Lademande d'arrostation provisoiro otante 4 a présonte requéte Sous Fannexe A; 2. Me Cathy Chalfour, coprésentante du ministre, a émis lo 22 janvier 2021 une autorisation au Procureur général du Canada fin de présener une demande pour artestation provisolre de fintérosse. Une copio do cette autorisation est inte a1a présente requéte sous fannexe B; 3. Sylvain Desormeaux, détectivelsergent au sain du Service de police de fa Ville ce Gatineau, a d6posé un affidavit qui est joint & la présente requéte sous (annexe c 4. Les Elals-Unis d'Amérique ont confiré qu'une demande pour fextradiion de Tintéressé sera présentée au Canada dans les soixante (60) jours de son attestation provisoire; ``` ----- ``` EMETTRE un mandatpour 'amestation provisolrede lintéressé; EMETTRE une autorisation de pénétrer dans la maison d'habitation sise 5135 ue Destorges, Gatineau, Qube, on vor d Farle 529 du Code criminel; RENDRE fou sur ordonnancejugée pporune Signé a Gatineau, district de Gatineau, ce 26 Janvier 2021 Lo ED Ud JOSS We Véronique Rousseau Subst du procurour général du Canada ``` ----- ``` eee AFFIDAVIT erm. Jo, DétectvelSergent Sylvain Desormeaux, agent dola paix au sein du Servis de police do la Vill do Gatineau, exergant au 590, boulevard Gréber, Gatineau, Québec, ayant été doment ‘assermentée, déclere co qui sult: 1. Je suis membre du Senvce de police de fa Vile do Gatncau (chaprés « SPVG ») ol Tocoupe le rang de détectivelsergent. 2. Jai 46 informé que les Euals-Unis Amérique (d-aprés « Etats-Unis ») solictent farmestation provisoirs de Sébastien VACHON-DESJARDINS, aussi connu sous le nom do Sébastien Vachon, nolo 11/07/1987. 3. Dans le cadre do celte affair, fai pris connaissance de ka domande damestation Provisoire, incluant [identification de VACHON-DESJARDINS, envoyée par les Etats- Unis. 4. Selon le Federal Bureau of Investigation (c-apres « FB »), VACHON-DESJARDINS a utlisé lo rangongicil « Netwalker» afin de voler de diverses viclimes dos fichiors do données numeiquespossédantdes informations sensiblespouroblenirun gain financier. 5. Unrangongicil est un type de malicel qui nfilre Fordinateur ou le systéme informatique de sa victime ef bloguo acobs ses données. Latiaquant exige une rangon payable, habitusllemant en monaie numérique (ex- bilcoin), du propritaire des données avant auilelle puisse récupérer ses fchirs. ``` ----- ``` o: = 1 est rcharché pares Etats-Unis aff de subirun procs pour des accusations sériouses do raudes commises par crimteur + En 200 2018, Io FBI début ne enauete visant VAGHONDESJARDINS of autres comme ataquan qui ulsent e rangongice « Netwalker» pou nfecier les réseau iformatiues do plusieurs victimes. VACHON,DESJARDIN ef os atoquants exigentqnrangon soi pays pendant une mts do amps on victimes veulent sofa remee leurs fichiers: + ortaines des vicimes ce VACHON.DESJARDINS sont des tabissements densoignement, uno eniopise de. logisiaue de anspor ainsi quume compagnie do tlécommunicatons. Ges organismsse font wer des conden confidentelcs of menacer que cesrensignomentsseont publ en ligne 14 rangan cost pes payee: + La preuve cionsancile abit que VACHON-DESUARDINS fst aff avec Torgarisaion « Netvalker » et so ert du om ulfistour« User 128.5; + Suite 4 une analyse médicorégala du serveur informatique en Bulgare qui héberge le « Nfvalke Tor Panel » fe site de Fnernet candestn comolé par Targanisaion«Netwaker »), I FBI détorming que « Uso 126.»eetac dep Je mols dav 2020 of ul est utlisteur ayant amass to plus grand nombre do rangons, soit une valeur approxmalve de 27 millon a dolers U.S, an boi; + Le FBI cblient do dossiers letroniques cs Google et détomine que Fadresss Inlemet «Poland Server #1 », uiséo lors de Tataquo da rangongicel des victimes, stat connect au comple email skarkhurthor@gmaicom: ``` ----- ``` Les motifs durgence pour farrestation provisoire de VACHON-DESJARDINS * Le 27 janvier 2021, a Gendarmerie royale du Canada pianifie d'exécuter un mandat236ue do Desforges perquisiion3Galinea,a maison Québec; dhabitelon deVACHON-DESUARDINS sss + En méme temps que le manda de perquisiton chdassus sera exéouté, le FBI attend de désealiver le serveur informatique en Bulgari sur lequel opére le rangongicil « Netwalker ». A ce moment, un message sur site ndquer que des organisms application de Ia of coirole Ie ste web cu « Ntwalker Tor Panel» donc les ullsateurs, incuznt VAGHON-DESJARDINS, seron avisés dss que visteronto site; + Selon les informations abtenues par le FB, VACHON.DESARDINS est afiis «Netvalker» le plus proffable ce forgerisaton. Il posséde une quanits substantille de cryplo-momnaie,ce qui poural faciter sa fut afin déviter des poursules juccilros; + Los plusrécants(ssptombre2020)dossiers électriques de Google éiabissent quo VACHON-DESIARDINS recharche des nouvelles vicimes & poursue avec le rangongiciel« Netwalker . Par conséquen!, i demeurs un danger pour Ia sécurte publique. ``` ----- ``` Asserments devant mo & Gatineau, Distrlct de Gatineau, ca 26 janvier 2021 Coast jms. —— Hon Catherine Mandevite, 2.55. ``` ----- ``` ETATTEN)a ut ct oocom at coin drs pec lrort rtGoin Be eS Fl CESry, CE ADRES LES PESBUTES OXPu BET OE US EAIOHOREAU HOM OF 6A MAIESTECARRTER WEOTEVENT ss] EF x CAMENER DEVARY|4S. TEREFOR 70 COMMAS Yo. HE BASES HABE POR 10 ESTHEPERSONSOUGHTA410 BANG HERA SE nsSt pir in | opus Co ofBuin RoR RLLE Sot ARLE S08CL 755D riAEROS To ATIENOU qu gt otssaego sauTies oun Sear WHEREAS os ssl aae et i ees (6 REE CORSE PPR STE rerade FE ——— eniaooieShain aa or Pt tose re ee eee ee ed Epo hecotarons Es Sit oonayoht Seng or,Era LS rs a thge ov GoPIC CONFORIE TRUE COPY | i | fon dss Situa iromque procures Rozesasyints du Cana! ountorto ory Conse ofGove hun canons we 2st - son HON, CATHERINE NANDEVILLE, 4.5. Abarat it J Cs wnenssstie ``` ----- ----- ``` (FBI) has been investigating VACHON-—a Canadian citizen who resides in Gatincau, Quebec—and others for thir participation in ransomware attacks involvinga rnsomware: variant named “NetWalker.” Ransomware is a typeof malware that is used to compromise: ‘and restrict access to a victim's computer network in an effort to extract ransom. 3. FBI Special Agent Daniel Sirmons (“SA Simons”), would testify as. follows: He is the case agent primarily responsible for this investigation and he has been a ‘Special Agent with the FBI for approximately 25 years. SASirmonshas attended over 500 hours of training in various aspects of criminal investigation, including classes dealing specifically with cyber investigations and cyber-related technical training. In bis capacity as a special agent with the FBI, he has conducted investigations into both criminal and national security matters 4. Since at least as early as March 2020, NetWalker has been advertised as ransomware-as-a-service (‘RaaS”) on eybercriminal forums, featuring developers and affiliates.! For example, on March 20, 2020, an individual using the moniker “Bugatti” SA7 Sirmons will esify tht under the Raa model, developers se responsible for crating and updating th ransomware, and making it availableto afte. Based onNetWalkeradvriseanets on cybereiminal 1 ``` ----- ``` am. We ar interested in people who work for quality, buforquantity. We give preference to those who knows how to work with large networks and hs their own material. ‘We are hiringa limited numberofpartners andwestop hing unil positions ‘become available. We offer youa fast locker with flexible configuration, ‘convenient administrative] panel in TOR, and automatic service. Access (0 service is via encryption offiles from AV. VErified adverts are sud ready material in the format (ipldomain admin accountaccess to nslinfo about AViorganization namelrevenue) for network processing. The locker has been operational since September 2019 and has gained a good reputation, and it cannot be decrypted. More details about the locker and tems of of the job will be provided once you complete an application in PM. Application format; 1) What is your areaofexpertise? 2) Your experience. ‘What partner programs have you worked with and what profit have you ‘had? 3) How much material do you have and when are you ready to star’? How much material do you plan on processing? 6. Tased on victim interviews, SA Sirmonshas eamed and would testify that a victim company generally cams that ts computer network has been compromised and its data encrypted via the deliveryof a ransom note in the formof a file. Below, a representative ransom note has been recreated in part Hil Your files are encrypted by Netwalker If for some reason you read thistextbefore the encryption ended, this can be understoodbythe fact that the computer slows down, and your heart rte has increased due to the ability to tum it off, then we recommend that you move away from the forums, interviews of NetWolker vcs, ad evidence obtained from a sever locied in Bulgari, SA Simons is expected totes tha afc ar responsible for identifying and tackinghigh vali victims ith the ransomwar. Aferavem pays, then th developersan af sis spsh nso 2 ``` ----- ``` ng entrance, the victim is provided with the amount of ransom demanded (in bitcoin), and instructions for payment. The vietim can also communicate directly with a NetWalker developer and/or affiliate on the NetWalker Tor Panel via a chat function. 8. Based on victim interviews, SA Simons has learned and would testify that NetWalker is used not only to encrypt vietim data, but it is also used to steal victim data, fa victim does not pay theransom, the stolen datai often published online. Since at least May 12,2020, website named “the NetWalker Blog” has existed on Tor for the exclusive purpose of facilitating the publication of stolen victim data. The NetWalker Blog is accessible to anyone who uses the dark web, and might seek to use it as a resource for various types of criminal conduct. The stolen victim data may consistof he company’s sensitive intellectual property or financial records, or personally identifiable information ofthe company’s customers. Such data may be used bothtothe advantageof the criminal, and detriment to the victim company. For example, stolen personally identifiable 7 SA Simons wil sity has the Onion Roser (“Tor”) i ewokofcomputers disor sound hc ‘worlddesignedoconcat he ru I addresses fhenetwork's wes,TheTor networkalsoenables websics 0 operste in: mannerha cancelsthe tr P adress ofthe serve hosting he website 3 ``` ----- ``` summary of the company's services, and either lnk to the stolen data (refered ton the NetWalker Blogas “secret data”) ora date when the stolen data would be published. The NetWalker Blog has also posted links to screenshotsof dat stolen rom vietims, nan apparent attempt to prove tht he sensitive dat had infatbeen olen. RansomwareAttacks 11. Victim #1 is a company based in Florida. A company representative of ‘Victim #1 is expected to testify that on May 1,2020,it received a ransom note on maltile workstations indicating its network had been compromised by the NetWalker Ransomware. The ransom demanded was $300,000 in bicoin, which Victim #1 did not pay. To date, Victim #1 estimates having spent approximately $1.2 millon to respond to the attack, contain its damage, and restore operations to normal. Forensic analysis conducted by Vietim #1 revealed that on April 30, 2020 at 23:57 UTC, server using IP address 193.56.28.100 (ater identified by the FBI as “PolandServer #1), which was not authorized to acces the Victim's network, had gained unsuthorized access to is network 4 ``` ----- ``` lker Tor Panel a instructed by the ransom note. Victim #2 provided investigators with forensic copyof the compromised servers, which revealed tha from May 6, 2020, to May §, 2020, Poland Server#1 had aso gained unauthorized access 0 its network vi the company's Pulse Secure Virtual Private Network 13. Computer Scientist Frampton would testify that in response to Poland Server #1°s unauthorized acces to the networks of Victim #1 and Victim #2 around the time of NetWalker Ransomware attacks, he uscd an intemet-connected computer to connect o tatIPaddress from May 11,2020, to May 26, 2020. At times, the surveillance sevesled the names, properties, and contentoffiles stored on PolandServer #1. Through his surveillance, Compute Scientist Frampton discovered that Poland Server #1 contained an abundanceofsoftware. SA Simons will tsi th Pulse Scar Vial Private Netvark, or Puc VPN, purport 10 provide sect, subenticated esas for emete and be wets fom an epamsbed device 1 rpc 353Simon will cy ths Windows PowerSel ss sutamaion cine ad sping gage cs designed coo nd uma skies ofWindows psa yess ud he ppIanons. SA Simons wil iy te aMDS hah 3 32. sheen Gods a an b aed 10 aml denyfle s ``` ----- ``` 15. Computer Scientist Frampton would testify that he discovered 12 builds on Poland Server #1 that had names of identified NetWalker victims, including Victim #1 and Victim #2. Computer Scientist Frampton alsodiscovered—and identified by MDS hash—the exact PowerShell script that Victim #1 had found on muliple workstations affected by the May 1, 2020, NetWalker Ransomware attack. Computer Scicntist Frampton ‘would further testify that on May 13, 2020, he observeda new build on PolandServer#1 for Victim #3—a company based in France6 16. A company representative of Victim #3 is expected to testify that on or about May 15, 2020, Victim #3 received a ransom note indicating its network had been ‘compromised by the NetWalker Ransome. The initial ransom demanded was $50,000, and subsequently inorcased t0 $2,000,000 th sme day. Victim #3 did not pay the ransom. 17. Computer Scientist Frampton would testify that on May 26, 2020, he observed that the NetWalker Blog indicated that Victim #3's stolen data would be SA Sirmonswouldety atde tothe lbs ssl of the cies, mile domestic 32d frig aw enforcement agencies re conducing paral imvstgaion of the parpertors, melding the Preach authorities. The FBI has coodinaied wilh French lw enforcement thoughout th invesiguton and Secordingly determined the ocaionofVien 5. 6 ``` ----- ``` linked to that accountholder: syrsfatlpmme, megamegauplatprotonmailcom, vicinonus{atjprotonmail com, and valultion{stJprotonmail com. MEGA suspended the offending account afte tleamed ofthe above conduct 20. Victim #4 is a company located in Califoreia. A company representative of Victim #4 would testify that on June 3, 2020, i observed “security incident” that occured within ts network on June 1, 2020. The ransom demanded was $3,000,000 in bitcoin. It ulimately paid $1.14 million (in bicoin) in ransom into a bitcoin wallet identified on the NetWalkerTor Panel, 21. Computer Scientist Frampton would esify that on June 3, 2020, he visited the NetWalker Blog and observed that it indicated that Victim #4's stolen data SA Sirmons wil etythat Protons sa Switerandase aml provide th ons te dons pin” and pronmalcom.” Th vl servicis cadto-ed cncypled, nd 20 person infomation {eedtocri an account. Thee Furs, ke in conjuncion with it Swi pvacy vs,hive mde {very popular with bereimint. © A MEGA representative woul esti ht when an sccounvder sess MEGA's website, MEGA collectscotainnformaion, cluding hebrowser ht he scouteduss. Though rovae eogoion, MEGA 1c 0 i ny subscaetysrsed acco 10h orin cot 7 ``` ----- ``` voor om. MEGA al provid sg irs rn coil iiss tt bd ic tt coum, eligite lied to te slotin of Visi £5 vim ut: rlcroommntaom, nome, megmegsalonmaion, icnamlaprocanaon, 1 suinfpronnilcon. Agkin, MEGA suspended the ofin sect sf md ote stevcone 20 MEGA do eit the IF aress ving ged foscons (Polen Scr 47) MEGA iid Fold Sse 2 hing ee he EG esses prscncan, bso nek rocuse the cen odd by se 0. 20. Sa Sons i iy tht at coming te IF adbeses in fe morn Lastg Sele ra rninof i Be aTei . ``` ----- ``` suant to the MAT request, ‘Computer Scientist Frampton would testy that be reviewed the copies. The contents of Poland Server #1 had largely been wiped clean. The folder where deleted items are temporarily stored, commonly identified as » “recycle bin” however, did contain a directory withthe same fils that Computer Scientist Frampton had observed in May 2020. 26. The contents of Poland Server #2 provided a ink fo an individual named “Sebastien Vachon.” On the server, Computer Scientist Frampton discovered a file named “2png,” that depicted a screenshot of several fle. According to the file's metadata,0 “Sebastien Vachon” created the file on May 29, 2020, and had last modified the file on June 2, 2020. The server also provided cus as o the location ofits use. Fo example, on July 15, 2020, th user had viewed a webpage filled, “Canada Post - Track a package by tracking number” The link tracked package that had been sent to Gatineau, Quebec. ‘Additionally, on June 20, 2020, the Google Chrome autofill function indicated that the user Sirmons9SA wouldte hat he tn “ntact,” sd here refs o deta te provides nformsion about thr dt, ad special, fhe Ge Papas Metab con cloedt hen levas creel, a ah mo me peeoofee ppdor deleted fom 1. inwhol rnpr. 9 ``` ----- ``` Ransomwiare | XSSis” Additionally, the user ad visited the email inbox of megamegaup{aprotonmaicom on June 2, 2020, and the Google Chrome autofl function indicated that the user had saved the usemame “syrs{atmme” on June 21, 2020, As discussed above, bothof these ProtonMail mil addresses were linked to the uploader of Victim #3 and Victim #4's dat onthe Netwalker Blog. 28. On April 15,2020, an FBI Online Covert Employee (“OCE") accessed the NetWalker Tor Panel. The OCE would testify that while there, she was able to observe the websites index peg entity tag and the date that the index page had last been modified 29. SA Sirmons would testify that investigators then queried Shodan and Consys—wo independent commercial tos tha scanth inemet and collet information 4SAStrmons will styht the Google uch bower, Chrome, has an autos uncon. Tris fcion lows th owt ord evi wt re en eBBe eplr suse can be rivedFm oc ache, he bowie cs noted (ake oh ado eqn tte Server Gensel, nytagar i ene In ``` ----- ``` y that based on his forensic analysis of the Bulgaria Server, the server appears to be the backend server of the NetWalker Tor Panel and NetWalker Blog" 31. The BulgariaServer contained detailed transactional information a to each affiliate. The records revealed hat from February 29, 2020, to September 14, 2020, 68 affiliates had ben active, 910builds had been generated, and victims had paid more than $38 million (3,657.84 bitcoin) in ransoms. Affiliate “User ID 128” had been active since Apr 13, 2020, and ranked first among affiliates in amountofbitcoin received in ransoms, collecting more than SIS million (1,433.57674 bitin). “User ID 128" ranked second among affiliates in numberofbuilds (144 builds), includingthe buildsofVictim#1, Vietim #2, Victim #3, Victim #4, and many others 32. The Bulgaria Server contained information related to the NetWalker Blog, including when the blog entries were created in the database (but not when they were posted online). The Bulgaria Server also contained nearly 500 files depicting screenshots 37SASrmonswilletyha bckend servers seveatypically contains ll afhe rw fomation that is used 1m 3 webs or software appication nu ``` ----- ``` . ©Victim |Screenshot| Build og En [Com | om | om, | cere| Vieum BL NA 05032020 03.38 TNA Victim #2 1 N/A 05/07/2020 22:17 NA | Victim £3 05/13720202157 | 05/13/20202333 me =—7) | 2245 |0601/2020 23:54| 0/01/2020 23:54 34. Asan example, acordingtothemetadataofacetanscreenshot taken fiom the Bulgaria Server, depictinga Victim #4 aplication form, “Scbasien Vachon” crested he file on May 31,2020. SA Simons will testify that pacar sescenhot is denticl to the screenshot posted by BlecpingComputer.comon June 3, 2020, except the applicant's personally identifiable information hid not been redacted in the version ound on the Bulgaria Server B. MdentificationofSebastienVachon-Desardins Sursatiomame 35. SA Sirmons will testify that HackForums.net (“HackForums®) is an Intemet forum, and a representative from web traffic analysis companyAlexa Internet, Inc is expected to testify ha th foun rkssecondon the Internet in temsofweb caffe in the category of “hacking.” SA Sirmons is cxpscid to tesify hat according o records 2 ``` ----- ``` 36. User “syrius0l” originally registered on HackForums with email address ‘svachonat]hounailfr.By May 22, 2019, however, theuserhad changedhis/herregistered ‘email addresson the forum to syrs{atlpm.me, oneofthe ProtonMail email addresses linked to the uploadingofVictim #3 and Victim #4 data ‘Skankbuntherfatj¢mail.com 37. OnJune23,2020,a U.S. Magistrate Judge signedanorder requiring Google. to provide records relating to Poland Server #1. A Google company representative will, if necessary, be able to authenticate these records. The results revealed that twice on May 14,2020, azound the time Victim #3 was attacked by the NetWalker Ransomware, Poland Server #1's TP address had logged into Google account skankhuntherfat]gmailcom. 3 ``` ----- ``` nt. SA Sirmons will tesify that he reviewed the Google results, which indicated that was controlledbyVACHON. The second email sent from skankhunther{stjgmail com, just six days after the account’s creation, was sen to email address svachon(atJhotmail f(s described in the next section, tisis VACHON's known email address). The subject of the email read “test” and the body read “1” ‘Additionally, on January 17, 2018, skankhunther{atjgmailcom received an email fom the Google Store with the subject, “Your Google Store order has shipped.” The body of the email containeda receiptfor a Google Home Mis, which had been shipped to “Sebastien Vachon” at “36 Rue Desforges, Gatineau, QC, JSR 2W1,Canada” —the same address saved by Google Chrome on Poland Server #2. Last, the account's search and web history includes numerous queris for fast food restaurants in close proximity to VACHON's residence in Gatineau, Quebec. 39. Googe also provided recordsofmore than 35,000 searches conducted and websites visited by the skankhunther(atJgmail com acsountholder. Tis search and web SrmonsSA willcsifythtGrad Broflvas fos chr on th aimed television ses South Prk. In Sexson 20, Eide 2. ted “Skank Hun Broflovki anonymously yberbulls her members of he src ing th monic Skankhitd2.” in ``` ----- ``` arch terms “intruder,” “attack.” and “vpn.” And on May 20, 2020, the accountholder searched “ransomware negotiation conversations.” 40. SA Sirmons wil testify that ZoomInfo s a subscription-based service that sells access to its databaseofinformation about companies and their employees. A query ofa company name can retum awealthofinformation, such as annual revenue, number of employees, and employee contact information. The skankhunther{atjgmail.com accountholder also researched more than 350 companies on Zoominfo, atleast $9ofwhich are identified NetWalker victims. These companies include Victim #1, Victim #2, Victim #3, and Victim #4. For example, on May 1, 2020, the accountholder searched “[Victim #1).com revenue,” and “what is [Victim #1.” On May 20, 2020, the term “[Victim #1)" is included in more than 20 searches and websites visited, including searches such as “([Vietim #1] zoominfo," “[Vietim #1] contracts with federal,” and “(Victim #1] backup system.” On dozens of occasions, the accountholder also rescarched the specific vulnerability used to attack Victim #1 and Victim#2'snetwork—the Pulse Secure Virtual Private Network. For example, on April 21, 2020, the accountholder searched “pulse vpn 1s ``` ----- ``` Zoominfo.” and on May 24, 2020, the accountholder searched “[Victim #3] revenue ‘zoomino.” The accountholder searched [Victim #4].cdu Zoominfo" on May 31, 2020, 3 day before Victim #4 realized ts network hadbeen compromised. The sccountholder again searched [Victim#4] edu Zoominfo" on June1,2020,and June 9,2020. On July 15,2020, the accountholder searched “[Vietim #4] ransom 114m," and visited a webpage titled, “How hackers extorted $1. 14m from UniversityofCalifornia, [Victim #1]... 42. The search and webhistoryalso connected the account to the uploading of vietim data on MEGA. As discussed above, MEGA liked the anal address sys{atlpmme to the uploading of Victim #3 and Victim #4's data. According fo the web history for skankhuntherfatlgmail.com, on October 26, 2019, the accountholder visited the email inbox. of syrs{atlpm.me. Also, as discussed above, MEGA suspended several MEGA accounts aie learning they were involved with uploading victim data, On June 12,2020, the accountholder for skankinntheratlgmailcom searched “megan give reports to vere14SirmonsSA methwil for esi publiclythat knownthe Common inform Veinsscary inetabs and Exposuresand cpo58s. (CVE) sytem provides 3 16 ``` ----- ``` entative wil, if necessary, be abl to authenticate these cords. Microsoft provided the following subscriber information fo the account: [ome BE — svachon]at]hotmail.fr — ~ - riouState | Quebe -— Postal Code |JSVOMS EE 44. In addition to the subscriber information, SA Sirmons will testify tht he reviewed the coments ofthe svachon{atThotmail i sccoun, which established that it was controled by VACHON. The account contained the two photos depicted below (one of ‘which is depicted in Exhibit A to thisRecordofthe Case) of VACHON holding bis Quebec. driver’ license and a sheet of paper bearing his mame, a dat, and the name of a cryptocurrency exchange (Bit Buy and KuCoin). SASimons will sity thatcypocreney exchanges commonlyeq somes submit potssich tein contim day n ``` ----- ``` 45. VACHON dateoftitombisdie sense Gly 1, 1957) consis ‘with the statement made by “syrius01” on HackForums in June 2016 that he was 28 years ld. The account conned similar photo ofSar Eni Laocguete individ hose information ad ben sve nhs auto ctionof Poland Serr #2 46. The sachonshomailf csounconecorcsponden romBangs Nationale du Canada (National Bank of Canada) in VACHON's name, and listing VACHON's known address (36 Rue Desforges, Gatineau (QC) JSR 2W1) and phone ibe (819) 5982055).The coun sso connedi ro Bll Canada,Canadian telecommunications company, which was addressed to VACHON at his known address. 47. On November 30, 2018, sachonfschomaile sent wn cml to abasic vchonig. gc. Th body ofthe mil contin a fink to VACHON's six-page curriculum vitae. The curriculum vitae indicated that VACHON had held a variety is ``` ----- ``` 48. The contentsof the svachon{atlhotmailfr account also licked VACHON directly to the ransom paymentof at least one NetWalker Ransomsvare atack. Victim #5 is a company located in the State of Washington. A company representative of Victim #5 is expected to testify that on May 13, 2020, it was vieimized by the NetWalker Ransomware, and on May 26, 2020, Victim #5 paid 10479 bitcoin in ransom (approximately $94,877 onthe dateof the transaction). 49. SASirmons would testify tha thebitinblockchinisan open, distributed ledger that records transactions of bitcoin between two addresses efficiently and in a verifiableand permancat way. Because the blockehainservesas a searchable public ledger of every bitcoin transaction, investigators can observe addresses invalved in certain transactions, and tha information anbe used 0 identity therbitin addresses that likely belong to the same owner (also known as a cluster) 50. A review of the svachonatJhotmailf account revealed two unrelated bitcoin transactions that VACHON had conducted on May 22 and 24, 2019. Those 19 ``` ----- ``` s discussed above in paragraphs 48-50, Victim #5 has paid a total a ransomof $94,877, and Vachon's split is $72,374.21. The developers would receive the balance of the ransom. ‘This percentage split between affiliate and developer (roughly 75% to affiliate and 25% to developer) is consistent with practices that U.S. authorities have observed on the Bulgaria Server. 52. Computer Scientist Frampton would testify that he had discovereda build for Victim #5 on Poland Server #1, and VACHON had searched this victim using the skankhunther(at]gmail.com account as early as May 11, 2020. Additionally, according to the metadataofthe screenshots found on the Bulgaria Server, “Sebastien Vachon” created all five screenshots associated with Victim #5, $3. VACHON's last known address prior to his provisional arrest was 36 Rue Desforges, Gatineau (QC) JSR 2W1. His identifiers aras follows: Date of Birth July 11,1987 Place ofBirth: Unknown 7$4Sirmonswilcay tat »sanscion hac sn alphumerc cod hat ca be cto snc identity le. 20 ``` ----- ``` 21 ``` ----- ``` Exhibit A ``` ----- ``` Koongl lon ``` ----- ``` Date CarltonC. Gammons soA tan ``` ----- ----- ``` LE PROCUREUR GENERAL DU CANADA (aunom des Etats-Unis Amérique) Let SEBASTIEN VACHON-DESJARDINS AUSSI CONNU SOUS SEBASTIEN VACHON ARRETEINTRODUCTIFD'INSTANCE (Article 15 Lof sur IExtradition) Le ministre dela Justice du Canada autorise le Procureur général du Canada3 procéder devant la Cour supérieure du Québec afin de rechercher une ordonnance dincarcération pour Sébastien Vachon-Desjardins aussi conn sous Sébastien Vachon qui est recherché par les Etats-Unis aux fins de poursauite. infraction qui, au Canada, correspond la conduite alléguée est + Extorsion, contrairementa article 346 du Code criminel. DATE & Gatineau, Québec ce 26¢ jourd'avril 2021. WH Mt Cathy Chalift.f, Aocate-consell Service d'eftaide internationale Pour le wifistre déla Justice du Canada ``` ----- ----- ``` code postal JBV 2M7, depuis septembre 1903; 2. Je vis avec mon conjoint Robert Desjardins, depuis 41 ans; 3. Mon numéro de téléphone de résidence est: (819) 246-9782 4. Comme occupation, je travaille comme coiffeuse au salon Coiffure. Sébastien, silué au 1079 Rue Saint-Louis, Gatineau, QC JeT 252, téléphone (819) 243-4903; B. LIEN AVEC LE PREVENU : 5. Je suis la mére de Sébastien Vachon Desjardins. Jai une trés bonne relation avec mon fis et il a du respect pour moi et sachant que je suis impliquée comme caution, je sus convaincue quil S'agit d'un élément supplémentaire qui le motivera a respecter ses conditions. Sébastien est mon fils unique, je suis prét a lider et encadrer de tout mon cceur et en faisant de mon mieux; C. INFORMATION SUR LE PREVENU : 6. Mon fils Sébastien Vachon-Desjardins est né le 11 juillet 1987; D. AUTRES INFORMATIONS EXIGEES 7. Jen'agis pas en tant que caution pour d'autres personnes; 8. Je n'ai aucun antécédent ni aucune cause pendants; ``` ----- ``` Conspiracy to Commit Wire Fraud, in violation of 18 U.S.C. 1349; Intentional Damageto a Protected Computer in violationof 18 U.S.C. 1030(2)(5)XA). (C)ANAINI. (X4XANIXVI), and (c)4)(B); and Transmitting a Demand in Relation fo Damaging a Protected Computer, in violation of 18 U.S.C. 1030(a7)(@). (aX7)C). and (©)3)A) 11. Jai été inform du contenu des documents actuellement divulgués dans le dossier relatifa la demande extradition. J'ai pris connaissance notamment des mandats darrestation du Canada et des Etats-Unis ¢'Amérique et jo joinsunecopie desdils mandats avec mes initales pour en attester ma prise de connaissance; (A-1) F. AUTRES INCULPATIONS PENDANTES VISANT LE PREVENU 12. Je comprends également que mon fils est accusé d'autres infractions & la ‘Cour du Québec a Gatineau, distrct de Gatineau, dans le dossier de Cour portant le numéro 550-01-118357-203; 13. Jo comprends que dans le dossier 550-01-118357-203, mon fils fail face & des accusations de : a. Trafic de stupéfiants; b. Possession de plusieurs sortes de stupéfiants en vue d'en faire le faire le trafic; c. Recel; ``` ----- ``` 47. Jai pris connaissance de la liste de ses antécédents judiciaires ot je joins une copie desdis antécédents avec mes initiles pour en attester ma prise de connaissance; (A-3) H. ENGAGEMENT MONETAIRE OU DEPOT 18. En tant que caution pour mon fils je suis disposée 4 _m'engager a verser au tribunal la somme de cent mille dollars (100 000.00S) conjointement avec mon conjoint Robert Desjardins; 19. Sile tribunal exige le dépdt de la somme decentmille dollars (100 000.00 $) au lieu dun engagement pour ce montant, mon conjoint et mokméme sommes préts 4 en faire le dépdt; 20. Si le tribunal exige un engagement pour un montant plus important, mon conjoint et moi-méme sommes disposes & faire le sacrifice pour en offic plus si nécessaire; 21. Siremis en liberté mon fils viendra demeurer chez moi; I AUTRES GARANTIES 22. Je suis au courant que les infractions en lien avec la demande d extradition auraient été perpétiées par [utlisation dintemet et dordinateur. Actuellement, nous avons pas dordinateur dans notre résidence ni de ``` ----- ``` 24. Jo comprends que le défaut de mon fis de respecter les conditions de fordonnance de mise en liberté ou de son engagement pourrait entrainer Ia confiscation de la somme engagée ou déposée a ftre de caution; 25. Je comprends que je peux en tout temps présente une demande pour éire. relevée de mes fonctions en tant que caution (article 766 du Code criminel), amener le prévenu devant le tribunal afin d'éte libérée de mes obligations (article 767 du Code criminel) ou de le faire mettre sous garde (article 768 du Code criminel); 26. Malgré les antécédents judiciaires de mon fis, jai confiance en lui pour respecter ses conditions, parce que je sais quil me respecte et quil mesure timportance de cette somme pour moi considérant ma situation; 27. Je comprends qui titre de caution, jaccepte délre responsable dune personne accusée d'un acte criminel et quil s'agit d'un engagement sérieux; 28. Je sais qua titre de caution, mes obligations seront notamment de a. Massurerque mon fils comparaisse devant le tribunal a heute ot aux dates prévues; b. Massurer que mon fis respecte toutes les conditions de fordonnance de mise en liberté sous caution; ©. Ne pas faire au nom de mon fils, quelque chose que ses conditions de remise en bere lui interdit de faire directement ou indirectement; ``` ----- ``` Louisette VACHON Déclaré solennellement devant moi A Gatineau, ce 3 mai 2021 Commissaire a lassermentation ``` ----- ``` il est fait mention dans laffidavit de Louisette Vachon Assermenté devant moi a Gatineau, province de Québec, le 3 mai 2021 Commissaire assermentation ``` ----- ``` Tor Anyauthorizedlawenorme ofc 7 YOU ARECOMMANDEDtosrsad ing efor United Stats judg without sassysy roefront rie) SEBASTIEN ACHONDESIAROMS___ SE hotscusedofa ffns orvt basedone ll dco! i ih hs cour. of Idicmen © Supesediotodicnen © nfomaton// © Spesiogforaion 3Comply ©Pobeton Violation eiion 1Serie ReeseVionPetion 0ViiaonNote ©OverofhsCot Thi oe isbit died lls: ConspkasyoCome CapuaFauciiain of 18UA. § 371 Conspacyl Comt Vice Frau inviominof anSumsge03Fone Cot vaso 30.5.6. 53 EOSIN(II, {GAYAYGHVI).and(H4XBXT) andTransmitlingaDemyindinRelakionlo Damaging aProtectedComputer,inviolationof 18U.S.C. § 1030(a)7)(B),(a)7)(C).and(cX3)A). owe 0EC 03 2020 (ers. ; . em Hoan GenUL Cityand state: _Tompo,Florida / mer EAEABETHWARREN,drench lot \e0dStsBohCout ..., Ter [— tbeponvs oon mts J TT onc: J — TrBT TTT niwdve ede ``` ----- ``` TAT 50 sc th oi ptco rotackn | ANDWHEEAS rs isovioosis oursIo GosIk 1.3secessionoais cra 5smscco onntocs ner. oe rt. EE Een 1 otoS TAT yo re rent Coats AT ty orssre rattsrs ERS nees pe Sr EPR htrstcrtst dt Ir Ghana porSA apar Sao es ne ber pled dot cote Sp Ls rei ee Ee pn Rl Ee aH house,T2501 0rd10 elev afo PersonSOUTHS recon ns etn Pon pr alone xs EETcoer Spre) — JOR ae rn AA 75. at gs ``` ----- ``` il est fait mention dans [affidavit de Louisette Vachon Assermenté devant moi a Gatineau, province de Québec, le 3 mai 2021 Commissaire a Iassermentation ``` ----- ``` Goncecnant Stéphane FESCOTE (001), Sbatien VAGHEN BESIDES (002, Alesandce Ee ie Tr nv Le 16 sermser 2020, 3 + vategoscto afore? so ouliell of ellen “ELS i GI Comatehnt inet Ticta criminal prave” 3 ‘Laceicie S01 (31a) en ia Eek Comomans ieatien cH OHO (1D, Meanie hGLTO-ST- HEIR (G00 Tor "aa vn bau possessionah ves dram faire In Seale, sen. MEhenphetimiote; Corationt inal Thats. crinirel ‘provi 3 Lackicie $310 de 1a ok Concemmant sbsatien VACION SERMDINS (002), NesandesINIT:ST-NOON 653) aon vreau 16 feveier 1020, 3 Gotinens 5% Vob-seroBote, ALSCELCE do Gatinens, eu Su possession Su Canaria on we do Le dLsvEipseE on Conzarention su Farastapnnjrpedipion 30111 someteint ainsy I acte Cririned peivs 8 article SCE) FAI So Concetnant Sébastien YACKSN DESTASDINS (00), Aloxandee NILTOH-SI-RO0R (053) aren vers 1a 16 Fuveier 2020, & Govinehs 0 Jaloihe-Bots, SLovEien de Guciness. Gkectutene 5s GosiesctenantGe 14 pacpiczation, au Casace, dune. intsuction EoLeniote sus acts a scommakion, donc Le wsiese SAsie 3000.5, Sometiont sine Et tne Siow 4 omeions Soeini asa) de Code criminal CanoaraantOi BO0STT (001), Sdbastian VACKO DESINDING (02), Nlssandce Tron so oo : Er Wtteier 2030, 0 vatsestets, dszicrdocrn,onto on FEU a CT 2 a ol Tien sestaines ``` ----- ``` ELEm SenS SL MATS,Be LS SL AS5,EB CnetCtSS tt oe fn AAOIEE TI rteto enns. ES eal, Shel TeaS EE I RLEL EIST Ev——n “ ETT TTiutacmepeatntoss TTT mee TTT . . ``` ----- ``` il est fait mention dans raffidavit de Losisati Vachon Assermenté devant moi a Gatineau, Province de Québe, lo 3 mal 2021 Commissaire a l'assermentation ``` ----- ----- ----- ----- ----- ----- ``` code postal J8V 2M7, depuis septembre 1993; 2. Je vis avec ma conjointe Louisette Vachon, depuis 41 ans; 3. Mon numéro de téléphone de résidence est: (819) 246.9782 4. Jessuis retralté depuis environ 7 ans; B. LIEN AVEC LE PREVENU : 5. Jesuisle pére de Sébastien Vachon Desjardins. J'ai une trés bonne relation avec mon fils et il a du respect pour mo et sachant que je suis mpliqué ‘comme caution, je suis convaincu qui agit d'un élément supplémentaire quile motivera & respecter ses conditions. Sébastien est mon fils unique, je suis prét & lider et l'encadrer comme tout bon pére de famille; C. INFORMATION SUR LE PREVENU : 6. Mon fils Sebastien Vachon-Desjardins est né le 11 juillet 1987; D. AUTRES INFORMATIONS EXIGEES 7. Jo nagis pas en tant que caution pour d'autres personnes; 8. Jo n'ai aucun antécédent ni aucune cause pendante; ``` ----- ``` Intentional Damageto a Protected Computerinviolation of 18 U.S.C. 1030(@)(5)(A), (CYA)AXIND, (CHANANIVD, and (cH4)B)): and Transmitting a Demand in Relation to Damaging a Protected Computer, in violation of 18 U.S.C. 1030(a)(7)(B), (aX7)C), and (©X3)A) 11. Jai été informé du contenu des documents actuellement divulgués dans le dossier relalifa la demande d'extradition. Jai pis connaissance notamment des mandats d'arrestation du Canada et des Etats-Unis dAmérique et je joins une copie desdits mandats avec mes initales pour en attester ma prise: de connaissance; (A-1) F. AUTRES INCULPATIONS PENDANTES VISANT LE PREVENU 12. Je comprends également que mon fils est accusé d'autres infractions & la Cour du Québec a Gatineau, district de Gatineau, dans le dossier de Cour portant le numéro 550-01-118357-203; 13. Je comprends que dans le dossier 550-01-118357-203, mon fi fait face & des accusations de a. Trafic de stupéfiants; b. Possession de plusieurs sortes de stupéfiants en vue d'en faire le faire le trafic; ©. Recel; 14. Jai été informé sommairement du contenu de la preuve dans ce dossier. Jai pris connaissance notamment de la dénonciation dans le dossier 550- ``` ----- ``` une copie desdis antécédents avec mes iniles pour en attester ma prise de connaissance; (A-3) H. ENGAGEMENT MONETAIRE OU DEPOT 18. En tant que caution pour mon fis je suis disposé & mengager a verser au tribunal la somme de cent mille dollars (100 000.00 $) conjointement avec ‘ma conjointe Louisette Vachon; 19. Sile tribunal exige le dépdt de la somme de cent mille dollars (100 000.00 $) au lieu d'un engagementpour ce montant, ma conjointe et mok-méme sommes préts a en faire le dépot; 20. Site tribunal exige un engagement pour un montant plus important, ma conjointe et mol-méme sommes disposés faire le sacrifice pour en offic plus si nécessaire; 21. Siremis en liberté mon fils viendra demeurer chez moi; I AUTRES GARANTIES 22. Je suis au courant que les infractions en lien avec la demande ‘extradition auraient été pemétrées par [utiisation dlintemet ot dordinateur. Actuellement, nous n'avons pas dordinateur dans notre résidence ni de connexion internet. Nous avions pas prévu installer internet non plus. ``` ----- ``` 24. Je comprends que le défaut de mon fils de respecter les conditions de fordonnancea confiscation de de mise en la somme liberté engagée ou de ou son déposee engagement a ire de pourrait caution; entrainer 25. Je comprends que je peux en tout temps présenter une demande pour etre relevée de mes fonctions en tant que caution (article 766 du Code criminel), amener le prévenu devant le tribunal afin d'étre libéré de mes obligations (article 767 du Code criminel) ou de le faire mettre sous garde (aricle 768 du Code criminel); 26. Malgré les antécédents judiciaires de mon fils, jai confiance en lui pour respecter ses conditions, parce que je sais qui me respecte et quil mesure Vimportance de cette somme pour moi considérant ma situation; 27. Je comprends qua titre de caution, jaccepte détre responsable d'une personne accusée dun acte criminel et quil s'agit d'un engagement sérieux; 28. Je sais qua tire de caution, mes obligations seront notamment de : a. Massurer que mon fils comparaisse devant le tribunal a eure et aux dates prévues; b. Massurer que mon fis respecte toutes les conditions de fordonnance de mise en liverté sous caution; ©. Nepasfaire au nom de mon fils, quelque chose que ses conditions de remise en liberté lui interdit de faire directement ou indirectement; ``` ----- ``` Robert Desjardins Déclaré solennellement devant moi A Gatineau, ce 3 mai 2021 Commissaire & Fassermentation ``` ----- ``` ilDearing est fait mention dans Iaffidavit de Robert Assermenté devant moi a Gatineau, province de Québec, le 3 mai 2021 Commissaire & lassermentation oo ``` ----- ``` To: Anysthorzedlowexertoffs 5 YOU ARECOMMANDEDtorstad ing efor UtdStmagic fodgewithont ccs ely refprontbrie) SEBASTIENVACHONDESIAROMS agreeereeenreeia? hot esdofaa offenseorvitobis th ll dour Teilscout of Inticmen 0 Superdog ndcmen. Information 3Supssding lafomaion 0 Compl 3 FoobotonViconPrion 0Supeviscd Reese Vionakion 0 Viiaion Notice ©Orderof he Court This offreis ifydeserved a lls: Consissy toCorn Compulr Fraud, iolaonof 18 A.C. 371; Conspscy aComet WisFru,invatonof TBUSC:S 1348 Inlndond)Oamape oaPrtaciod Coyfulr invaste 1.0.5.6 8 1033053.(XNA CHOXANON)0d CKINEX:andTamsinaCry i Raton 0Oat55% 8ProsedComp rion of T8US.C55O3ENTIE).(ITN.ond HIN owe DEC 03200 Geren OO freer Ciymdsue: Tomparods / _ clsetmewssneces esseonto Tetra one [— epeeaw ny tants of 4 JE Tr mT ``` ----- ``` LAT 307ErLlns ctSOE ATemet Am entedlr petbo nc coinec, a A no cen mentscu ——— LE 0 Co 0 iedSeLo een BT PARAGRAPHETLE SUIVANT) eT ee im se en S ESEToTcgittsti01 ns i Ci ieot uscn ts hdc satns a ere BLSlA a FETE er ae Ere [oie dissa, a rire Ec, ——. we sin rem "HON. CATHERINEMANDEVILLE, 4.C.8. ei Cs —— | eliemT 0 yee ``` ----- ``` REASys areenhrs on is. Siemans span HSSCoT: (001, $escien AGH OESIAROTS (601, iersnize EEFUTme rn dow st ae oe ti 1cats, wire commarean”dune substance Sloe TREYincorita Seaman4 L'amnexs pears“I ou OILprésentée TSS,oa tems commeTH elie. onemETantET Sonucommer Siberianvee dour SRT te 16 penieieion, VACHS OLSIROIN faves 3030, SLA 4h 3 ie Givinens (O12), SH ater Alerades, fois or eben LuSLI Sevtics NLACH-37-90R Een oh are Meneses 0% (063) os, REAa an-sa-enor Concasnant Sibasian TACK CRAIMOTNS (003, Aexande IONGLION-S3-REAR. (063) RRC ter rioyine hevg rakiariing toro J Savage Tih Conend MTn Troets ovine pete 3 TeAR AT GoncernantGreeeon vent Sibarsien ie Tafe ottenon VACKH Tovar DESMOND 30%, sacha 3 Gottman (G62), a tau Alexa oh on Thee preci INTONTRbaton oh Coes Siren (055) eetrent, Shnenet irene tu keatiln me Connie soe cea Elbo acts SLC, doo Le Sinise Soba, Cornea Shae] DLL TR TTI Sa de Somtasnanntsb tpaecact (061), Sibastion YACKN DESH (052), Nsaxandcs is oy ST Gu vars 0 16 favre: 2020, 8 Val-dus-ols, aistrics de Gacinens, cnt as an Baroni ate tude ba are S87 aloe a TE hee” Sh Te SiEa ``` ----- ``` STcesarATIEND0011 dnd 0TCconrts SGcmos ae aceipsi WHEREAS, Tory hrAR asrteBe rectRrbern Ll Tae utarenao ns (ST Cr) SeseesEhCd Atone, SES CAUSES,ou nomcrSo ls ptesu cr ur ci de vs THEREFORE.TS1 coudyo. or Meet rae, iElbitvrs Ga SosanLvsvots Caensi ev Se to at rein rsRgnesSy sdibarramedia beootom ak Boo dobo or Aatnaas 14sec 2020 n TTSmasnnemeien CT advert TT ima TTT eden ``` ----- ``` Desjardins Assermenté devant moi a Gatineau, province de Québec, le 3 mai 2021 Commissaire a lassermentation ``` ----- ----- ----- ----- ``` ssport ou ttre de Voyage d'aucun autre pays; 3. En date du 27 janvier 2021, fai été amété par la GRC en fien avec une demande damrestafion provisoire présentée par les Etats-Unis Amérique en vue d'une demande d'extradion me concernant ; 4. Je fais le présent affidavit pour soutenir ma demande de remise en liberté en attendant la décisionsurla demande d'extradition ; 5. aJai iste des de antécédents mes antécédents judiciaires judiciaires, pour lesquels pour valoirfai purgé comme une peine si était en récité 2015. au Je longjoins dans mon affidavit ; (Annexe 1); 6. Au moment de mon amestation, jétais sous condition dans un dossier pendant a 1a Cour du Québec, 4 Gatineau, dossier portant le numéro 550-01-118357-203, Dans cedossierje fais face & des accusations en lien avec : - Trafic de stupéfiants; + Possession de plusieurs sortes de stupéfiants en vue d'en faire le aire le trafic; - Recel; 7. Jaitoujours respects les conditions qui mont été imposées par la Cour; 8. Depuis ma détention le 27 janvier 2021, et durant toute détention antérieure, e n'ai Jamas fait robjet de rapport disciplinaire. Lorsque fai été en fibération conditionnelle, ai toujours respecté les conditions qui mont é16 imposes; 9. Comme garanties au respect des conditions de remise en liberté, je suis prét & souscrire aux engagements suivants : ``` ----- ``` © Ne pas étre contact avec des gens qui & ma connaissance ont des antécédents criminels; 10. Dopuis mon incarcération, 'ai 16 placé en quarantaineadeux occasions, pour un total de 1 mois. Les conditions de détention deviennent plus diffcies pendant ces périodes de quarantaine. A titre d'exemple, jai été confiné en cellule 24/24 avec une sortie de 15 minutes par jour, et certaines joumées cette sortie de 15 minutes dans Ia cour ne fut pas accordée. En raison de la pandémis actuelle, il ny a pas 98 cours & Fécole do la prison, aucune visite n'est permise, les communications avec a famille sont plus diffcies étant donné le nombre de personnes désireuses dutliserdifficutéa le rejoindre téléphone. mon Parfois,avocat leen téléphone raison des n'est restrictions: pas disponible. J'éprouve de la 1. Lapremiére quarantaine a été imposéelorsde mon arrivée & Ia prison lo 27 janvier 2021. La deuxiéme quarantaine a été imposse du 3 avril au 17 avil parce quil y avait une éclosion qui sévissalt dans le centre détention; 12. Actuellement, je suis toujours considéré un employé des Services publics et Approvisionnement Canada (SPAC), mais, ma cote de secure a 81 suspendue durant fenquete effectuseparles SPAC. La cote de sécurité est un préalable & l'emploi au sein des Services publics et Approvisionnement Canada (SPAC) en vertu de la Loisur femploi dans la fonction publique dés lors, je ne suis Plus aulorisé & avoir acces aux informations, aux biens, aux établissements ainsi Qu'aux employés de SPAC, jusqua la conclusion de la révision pour motif valabie; 13. Advenant maremiseen liberts, Je suis prt 4 faire des démarches pour trouver un ‘emploi légitime ef rémunéré dans lequel je aura acces a aucun ordinateur ou qui nexige pas usage internet; ``` ----- ``` je respecte mes parents et habiter sous leur toit est pour moi un grand réconfort; 18. Je m'engage a me livrer aux autorités policiéres immeédiatement si le tribunal ‘ordonnemon incarcération en attendant que je sois livré aux autorités américaines dans le cadre de la procédure d'extradition; 19. A ma connaissance, il n'y a pas d'intemet ni dordinateur 4 la résidence demes parents et je m'engage a ne pas utiliser intemet ni un ordinateur selon les paramétres que la Cour pourra déterminer; 20. Tous les faits allégués dans le présent affidavit sont vrais au meilleur de ma connaissance, EN FOI DE QUOI JAI SIGNE AGatineau le 3 mai 2021 Sabai,Vabgy oh ‘Sébastien Vachon-Desjardins. AFFIRME SOLLENNELLEMENTDEVANT OI A Gatineau le 3 mai 2021 A oil i —— rs ce 4 Tassermentation {EEQe,i ``` ----- ``` il est fait mention dans laffidavit de Sébastien Vachon-Desjardins Assermenté devant moi a Gatineau, province de Québec, le 3 mai 2021 I J mimi ‘alassermentation / / on, Fee, Qe ``` ----- ----- ----- ----- ``` | 8 - 8 | LH le g: 58 |§ : & | FE2 | 2g é5 ag$ 25 % 5 2388:£e.0 | |g | td 2 9 33 w 3 g, HH cEgl 8521 Esi: ig: § £8 azzi 8 | 3 g = ES : 2.0 g | © $0 od § E © Be g Se 00 & fee : of Eek er § g 28 gEd F | ; EE3 8st | =| |&a8 8% gE | BEE 2 ~ — J ``` ----- ``` T S— EE | { | | 3 = | 22 2s3 - 3gC | y 2 EE) E | 3 FI 0 |E £ 32 8 g £5, 8 2 zg 2 > 5 § Fresco | § | Ea a 3g z z $ ERE £ | gk 8 a3 i £ So feeds | § | a3 21 3: z I] 83 jes2 | i838] 5% §ie| 3 || fn 3 |3 g = 42 ¢ u 3 E520 | | 3 sg EE t+ ffsE | 8 zs Eh 3 : FC | [i 28 § 2 u 2 § IE w bh § ZZ ¥ 3 g i E23 8g% © Ls 8 Eg E2E ``` ----- ----- ``` to this Applicant. More detail about our monitaring technology and programsis avalabl in our ‘Compliance Monitoring Program for Criminal Cases document. Thisletterassumes that document has been provided together with tis eter, 1, Stephen Tan,Director of Operations for RSC, have been contacted by counsel or[ Sebastien] [Vachon] Besjarcins the Applicant. | confirm thatf the Applicant is granted bail with the requirement to be monitored with a GPS ankle bracelet, RSC is prepared to provide that sevice. The technician would instal the bracelet at a location and within a window of me required by the court, for cramle, at the detention centreor within 24 or 48 hours a th residence. Ashorterwindow of ime for instalation is possible, pending the specific requirements and confirmationby[RSC.] understand that the Applicant proposestoreside at 23 Rue Ragueneau, Gatineau, Quebec. | confirm that ths address is in an area of cellar coverage,so ha the GPS bracelet willbeable to communicate its data, and themonitoringwil be functional. Thisfetter does not reflect any assessment by RSCofwhetherthe Applicant and[ the][ overall][ plan][ of] supervision meet the appicabe legal test for release. (GPS monitoring performs two primary functions (1) t creates a continuous recordofthe wearer's location and (2) it generates alerts when the accused leaves an area they ar [required][ to][ remain][within] or enters an area they are not permitted to enter, Whenageographic restriction such as a house arrest or curfew has no exceptions, the alert generated when [the][ wearer][ eaves][o][ enters][ the][ relevant][ area][ will] result in immediate action on ourpart.When terms alow exceptionstoa geographic restriction, sich as Surety-accompanied leave, or special purpose eaves (for work, school, meeting [with][ counsel][ tc),][ the] Systemsgenerated alertb itself wil not be sufficientto incicateavilaion. We therefore perform additional steps to verify compliance. When an exception permits the accused to leave the residence n the companyof[ a][ surety,] [we][use][two] tool. Every such leave must be preceded by the surety makinga cal to ur vice[ verification][ sytem.] When we see the alert Indicating tha the accused has le the residence, we [check][ immediately][ to][ see] whetherthe surety has passed the voice verification test. All surety-sccomparied [leaves are] so Subject to random spot checks rearing the surety to submit ive video showing thesuretywith the accused usingour vevideoapp installed on their mobile phone. Both of these[ tools][ result][ in][ immediate] action on our partif not complied with. Readiness/Commitment etterfoSebastien VACHON-DESIARDINS ``` ----- ``` Since une201,thre hovebeen ver 1500bls ane in provinces 5, A, S, WB, ON, CN, NS here ourmonirinwe ar of he al hing ovr330SuperrCoun comtenssai rainllsand 25 Cour of pes bt. Rh morte40 eae deve on oo rineof Quebec. FC caren manos over 500 pape onl Toe Applicant or copay forthe Applicant responsefor css Theres costohep the own, cou, even fe ae rerei cence of sion. Wo sn pot, he Alcorn orpayors inal make peyment rhe manor,SCwil eper onpov RCohcome 10Brovie themonnlhpoe a Crownas ha in 0 rr hl cure of son Tos po, 5 hesemiratesior tee cove ot roBene 1am svatfor any further information or ssonce. Snare —Stephon Tom Oecorof Operations Recor Sores Corporation To416.3371400or 18632275232 Readings Commie tr for ehstienVACHONDESATOINS ``` -----