Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 1 of 13

Jul 26, 2021

MD
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MARYLAND

UNITED STATES OF AMERICA *

AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT AND ARREST WARRANT

I, Brett D. Rowland, a Special Agent with the U.S. Department of Health and Human

Services - Office of Inspector General (“HHS-OIG”), being duly sworn, depose and state as

follows:

Introduction

1. I am an investigative and law enforcement officer within the meaning of 18 U.S.C.

§ 2510(7), that is, an officer of the United States who is empowered by law to conduct

investigations of, and to make arrests for, offenses enumerated in 18 U.S.C. § 2516. I have been

employed as a Special Agent with HHS-OIG for approximately eleven years. Prior to my

employment with HHS-OIG, I was employed as a Special Agent for the U.S. Department of State,

Bureau of Diplomatic Security (“DSS”) for approximately four years. In the performance of my

duties as a Special Agent for HHS-OIG and DSS, I have led, conducted, and participated in the

protection of Cabinet-level Secretaries, Ambassadors, Foreign Dignitaries, and Heads of State, and

conducted investigations pertaining to violations of federal laws involving threats to government

officials, passport and visa fraud, and health care fraud.

1
 Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 2 of 13 21-mj-2170-TJS

2. I set forth below only those facts that I believe are necessary to establish probable

cause. I have not, however, excluded any information known to me that would defeat a

determination of probable cause. The information contained in this Affidavit is based on my

personal knowledge, review of documents and other evidence, and conversations with other law

enforcement officers and other individuals.

3. Based on the information below, I respectfully submit that there is probable cause

to believe that THOMAS PATRICK CONNALLY, JR. (“CONNALLY”) committed violations

of 18 U.S.C. § 115(b)(4) (Threats Against a Federal Official) and 18 U.S.C. § 875(c) (Interstate

Communication Containing a Threat to Harm) from approximately December 28, 2020, to July

21, 2021.

Probable Cause

I. Introduction

4. In response to a growing number of threats directed against the current Director of

the National Institute of Allergy and Infectious Diseases (“NIAID”), Dr. Anthony Fauci, and in

order to provide a safe and secure environment within which the Unites States’ response to the

COVID-19 pandemic could be conducted, HHS-OIG began protective operations around Dr. Fauci

in March 2020. Part of those protective operations involve the vetting of threats received by

various means, including mail, voicemail, and emails. Some of these threats have been sent to Dr.

Fauci at the NIAID. NIAID is a part of the National Institutes of Health (“NIH”), located in

Bethesda, Maryland. Dr. Fauci also currently serves as the President of the United States’ Chief

Medical Advisor.

2
Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 3 of 13 21-mj-2170-TJS
Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 4 of 13 21-mj-2170-TJS
Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 5 of 13 21-mj-2170-TJS
Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 6 of 13 21-mj-2170-TJS
Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 7 of 13 21-mj-2170-TJS
 Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 8 of 13 21-mj-2170-TJS

12. On July 21, 2021, Dr. Fauci received two emails from

naturtheateralhena@protonmail.com with the subject line “Anthony Fauci is a liar and a fraud, and

I would say that to his face”:

III. CONNALLY’s Control of naturtheateralhena@protonmail.com

13. Through the Swiss Confederation, ProtonMail provided registration details

regarding naturtheateralhena@protonmail.com. The email account was registered on February 4,

2018.

14. Pursuant to legal process, agents discovered that

naturtheateralhena@protonmail.com was linked, for verification purposes, to the creator of the

similar Instagram username “Naturtheater Alhena.” Additionally, the Instagram account was

created on May 14, 2020, from an Internet Protocol (“IP”) address that was associated since April

17, 2014, to a property rented by CONNALLY from April 16, 2020, through June 1, 2020, which

includes the date when the “Naturtheater Alhena” Instagram account was created.

8
 Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 9 of 13 21-mj-2170-TJS

15. On April 27, 2020, CONNALLY executed an extension of his rental of the cabin,

using the same IP address that was used to create the “Naturtheater Alhena” Instagram account.

In the rental extension, CONNALLY listed his phone number ending in 1340 and a separate email

account in his name at mail.com (the “Mail.com Account”).

16. Pursuant to a search warrant, law enforcement obtained emails from the Mail.com

Account showing that CONNALLY had been consistently using this account since July 2014.

CONNALLY used the Mail.com Account to communicate with

naturtheateralhena@protonmail.com and two additional ProtonMail accounts in his name. One of

the additional ProtonMail accounts (“CONNALLY ProtonMail Account”) was registered on

January 31, 2018, four days before CONNALLY registered naturtheateralhena@protonmail.com.

On February 28, 2018, CONNALLY sent an email from the Mail.com Account to another

individual advising them that the CONNALLY ProtonMail Account was CONNALLY’s new

account and that future communications should be directed to that account. Explaining why he

switched to ProtonMail, CONNALLY highlighted that ProtonMail “[f]alls under Swiss privacy

laws” and had “[f]ull end-to-end encryption.” A review of the Mail.com Account returns showed

that CONNALLY communicated between his Mail.com Account and the CONNALLY

ProtonMail Account or copied the CONNALLY ProtonMail Account on emails sent to other

individuals.

17. On July 22, 2019, CONNALLY used the CONNALLY ProtonMail Account to

email the Mail.com Account. The subject and body of the email contained the same text:

“Naturtheater for logic and MainStage.” Logic Pro is an application for the production of music

developed by Apple Inc. MainStage is also a music application developed by Apple Inc. for use

in live performances. The Mail.com Account contained emails regarding Logic and MainStage.

9
 Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 10 of 13 21-mj-2170-TJS

For example, on March 10, 2020, CONNALLY used a Google account to send his Mail.com

Account a link to a forum containing tips regarding how to use Logic. Similarly, on August 4,

2020, CONNALLY emailed himself using his Mail.com Account with the subject “stereo

options.” The email contained what appeared to be notes from CONNALLY regarding audio

hardware he was looking to purchase that would work with Logic and MainStage (referred to as

“MS” in the email). Based on my training and experience, I know that individuals who use an

online alias may use such an alias in multiple different contexts, including as a username when

registering for online accounts or with other companies and in some cases as passwords for

accounts. Based on the above, I believe that CONNALLY used “Naturtheater”—a variation on

the email account used to send the threatening emails—to register for Logic and MainStage or to

purchase these software applications.

18. On January 20, 2020, naturtheateralhena@protonmail.com sent an email to the

Mail.com Account with the subject, “JOBS SHORT LIST.” The email contained twelve links to

Indeed.com, which is a website for job listings. The links were for open technical writer positions

with various companies. A review of the Mail.com Account revealed CONNALLY’s resume.

On his resume, CONNALLY describes himself as an “Information Architect, Editor, Senior

Technical Writer.” CONNALLY’s resume shows that he has been a technical writer since around

1996. A review of the Mail.com account shows approximately thirty-nine emails from

Indeed.com, including that CONNALLY had an account with Indeed.com, that CONNALLY

posted his resume on Indeed.com, and that CONNALLY applied for technical writer positions on

Indeed.com. Additionally, at around the time when CONNALLY’s Mail.com Account received

the list of jobs from the naturtheateralhena@protonmail.com account, on January 28, 2020,

CONNALLY communicated with job headhunters regarding remote technical writer positions.

10
 Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 11 of 13 21-mj-2170-TJS

19. CONNALLY also emailed himself usernames and passwords for his accounts,

including naturtheateralhena@protonmail.com. For example, on November 25, 2019,

naturtheateralhena@protonmail.com sent an email to the Mail.com Account with the subject,

“naturtheateralhena.” The body of the email contained what, based on my training and experience,

appears to be a password. Subsequently, on June 4, 2020, CONNALLY’s Mail.com Account

received an email from a ProtonMail account (“CONNALLY Second ProtonMail Account”) with

the subject “addresses.” The body of the June 4, 2020, email contained what, based on my training

and experience, appear to be a username and password. On the same day, CONNALLY’s

Mail.com Account received a second email from the CONNALLY Second ProtonMail Account

with the subject “addresses2.” The body of the email contained what, based on my training and

experience, appear to be information related to a username and password.

20. Based on my training and experience working with Digital Investigators from HHS-

OIG’s Digital Investigation Branch, I know that individuals who possess and operate multiple

accounts, including email accounts, store details regarding their accounts in locations that are only

accessible by the owner. This can include sending the usernames and passwords for the accounts

to a personal email account. I believe that CONNALLY emailed himself the password for the

naturtheateralhena@protonmail.com on November 25, 2019. Subsequently, on June 4, 2020,

using the CONNALLY Second ProtonMail Account, CONNALLY emailed himself passwords

for the ProtonMail accounts in his control, including the CONNALLY ProtonMail Account, the

CONNALLY Second ProtonMail Account, and naturtheateralhena@protonmail.com. Based on

the fact that all three accounts have similar passwords, and the other information above, I believe

that CONNALLY controls the three accounts.

11
Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 12 of 13 21-mj-2170-TJS
 Case 8:21-mj-02170-TJS Document 1-1 Filed 07/26/21 Page 13 of 13 21-mj-2170-TJS

Conclusion

25. Based on the foregoing facts, I respectfully submit that there is probable cause to

believe that CONNALLY used the email account naturtheateralhena@protonmail.com to commit

violations of 18 U.S.C. §§ 115(b)(4) and 875(c) from approximately December 28, 2020, to July

21, 2021.

______________________________________
Special Agent Brett D. Rowland
U.S. Department of Health and Human Services –
Office of Inspector General

Affidavit submitted by email and attested to me as true and accurate by telephone consistent with
Fed. R. Crim. P. 4.1 and 4(d) this 26th day of July, 2021.

______________________________________
Honorable Timothy J. Sullivan
United States, Magistrate Judge

13