Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 1 of 13

STATEMENT OF FACTS

Your affiant, Shawn Walsh, is a Task Force Officer (TFO) assigned to Federal Bureau of
Investigation (FBI) Joint Terrorism Task Force (JTTF) in Tampa, Fl. Currently, your affiant is
tasked with investigating criminal activity in and around the Capitol grounds on January 6, 2021.
As a TFO, I am authorized by law or by a Government agency to engage in or supervise the
prevention, detection, investigation, or prosecution of a violation of Federal criminal laws.

The U.S. Capitol is secured 24 hours a day by U.S. Capitol Police. Restrictions around the
U.S. Capitol include permanent and temporary security barriers and posts manned by U.S. Capitol
Police. Only authorized people with appropriate identification were allowed access inside the U.S.
Capitol. On January 6, 2021, the exterior plaza of the U.S. Capitol was also closed to members of
the public.

On January 6, 2021, a joint session of the United States Congress convened at the United
States Capitol, which is located at First Street, SE, in Washington, D.C. During the joint session,
elected members of the United States House of Representatives and the United States Senate were
meeting in separate chambers of the United States Capitol to certify the vote count of the Electoral
College of the 2020 Presidential Election, which had taken place on November 3, 2020. The joint
session began at approximately 1:00 p.m. Shortly thereafter, by approximately 1:30 p.m., the
House and Senate adjourned to separate chambers to resolve a particular objection. Vice President
Mike Pence was present and presiding, first in the joint session, and then in the Senate chamber.

As the proceedings continued in both the House and the Senate, and with Vice President
Mike Pence present and presiding over the Senate, a large crowd gathered outside the U.S. Capitol.
As noted above, temporary and permanent barricades were in place around the exterior of the U.S.
Capitol building, and U.S. Capitol Police were present and attempting to keep the crowd away
from the Capitol building and the proceedings underway inside.

At such time, the certification proceedings were still underway and the exterior doors and
windows of the U.S. Capitol were locked or otherwise secured. Members of the U.S. Capitol Police
attempted to maintain order and keep the crowd from entering the Capitol; however, around 2:00
p.m., individuals in the crowd forced entry into the U.S. Capitol, including by breaking windows
and by assaulting members of the U.S. Capitol Police, as others in the crowd encouraged and
assisted those acts.

Shortly thereafter, at approximately 2:20 p.m. members of the United States House of
Representatives and United States Senate, including the President of the Senate, Vice President
Mike Pence, were instructed to—and did—evacuate the chambers. Accordingly, the joint session
of the United States Congress was effectively suspended until shortly after 8:00 p.m. Vice
President Pence remained in the United States Capitol from the time he was evacuated from the
Senate Chamber until the sessions resumed.

During national news coverage of the aforementioned events, video footage which
appeared to be captured on mobile devices of persons present on the scene depicted evidence of

1
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 2 of 13

violations of local and federal law, including scores of individuals inside the U.S. Capitol building
without authority to be there.

On May 12, 2021 I learned that according to records obtained through a search warrant
served on Google, a mobile device associated with j*********@g****.com was present at the
U.S. Capitol on January 6, 2021. Google estimates device location using sources including GPS
data and information about nearby Wi-Fi access points and Bluetooth beacons. This location
data varies in its accuracy, depending on the source(s) of the data. As a result, Google assigns a
“maps display radius” for each location data point. Thus, where Google estimates that its
location data is accurate to within 10 meters, Google assigns a “maps display radius” of 10
meters to the location data point. Finally, Google reports that its “maps display radius” reflects
the actual location of the covered device approximately 68% of the time. In this case, Google
location data shows that a device associated with j*********@g****.com was within the U.S.
Capitol Building between approximately 2:19 p.m. and 2:38 p.m. on January 6, 2021. Google
records show that the “maps display radius” for this location data was less than 100 feet for 7 of
the 8 locations, which encompasses an area that is entirely within the U.S. Capitol Building.

As illustrated in in the map below, Figure 1, the listed locations encompass areas that are
entirely within the U.S. Capitol during the time period listed. Specifically, Google location data
shows that a device associated with j*********@g****.com was within the U.S. Capitol at the
times and locations shown in Figure 1 (at the locations reflected by each darker blue circle),
below, with the “maps display radius” reflected in Figure 1 (as reflected in a lighter blue ring
round each darker blue circle). As illustrated in Figure 1, the listed locations were entirely
within areas of the U.S. Capitol Grounds which were restricted on January 6, 2021.

2
Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 3 of 13

Figure 1

3
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 4 of 13

Law enforcement officers, to the best of their ability, have compiled a list (the “Exclusion
List”) of any Identification Numbers, related devices, and information related to individuals who
were authorized to be inside the U.S. Capitol during the events of January 6, 2021, described
above. Such authorized individuals include: Congressional Members and Staffers, responding law
enforcement agents and officers, Secret Service Protectees, otherwise authorized governmental
employees, and responding medical staff. The mobile device associated with
j*********@g****.com is not on the Exclusion List. Accordingly, I believe that the individual
possessing this device was not authorized to be within the U.S. Capitol Building on January 6,
2021.

I reviewed the above information on May 12, 2021. In addition ot the information in the
preceding paragraphs, Google indicated the mobile device with the number ending in 5582 had a
related Google account of #390910008048. I later obtained subscriber and account information
for Google Account identification #390910008048 which showed the account was created on
July 23, 2009 and was subscribed to “Jon Heneghan” with an email address of
j*********@g****.com with a physical address located in Clearwater, Florida. Google listed
the recovery SMS as a telephone number ending in 5582.

On September 21, 2021 I obtained subscriber and account information for the mobile
directory assigned phone number ending in 5582 and was provided the following information;
the mobile directory assigned phone number ending in 5582 is assigned to the T-Mobile network
under related account #945649352 and was effective on September 25, 2014. The subscriber
was “Jon N Heneghan” with the same listed address in Clearwater, Florida as associated with the
Google Account described above.

I also learned that on May 13, 2021 HENEGHAN had changed his home address on file
in the DHSMV database to an address in Dunedin, Florida. 34698. I conducted additional
research at the Pinellas County, Florida Property Appraiser's Office (Florida) related to the
address in Dunedin, Florida and discovered it is owned by a Carol O'Neal KICINSKI. Law
enforcement and public database searches linked the telephone number ending in 3333 to James
O’Neal, Thomas Kicinksi and Carol Kicinski, the latter residing at the same address in Dunedin,
Florida. Further research in law enforcement databases showed that the phone number ending in
3333 was used by KICINSKI to make an insurance claim in June of 2020.

I obtained telephone records from T-Mobile which indicated the phone number ending in
3333 was assigned the subscriber ID #63794642011 and was effective on December 20, 2020.
The subscriber was listed as “Thomas Kicinski” with a listed billing address in Dunedin, Florida
of Thomas Kicinski. Your affiant conducted further research and determined Thomas Kicinski
died in 2017.

I reviewed surveillance footage from the United States Capitol Police for January 6, 2021
and located HENEGHAN in several videos. In three videos, he was accompanied by a white

4
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 5 of 13

female with dark hair who was wearing a grey colored jacket, blue jeans, red shirt and wearing a
blue “TRUMP” hat with red writing on it. I further researched KICINSKI to determine if she
was the person with HENEGHAN on January 6, 2021 depicted in the surveillance footage.

I conducted research within the Florida Department of Highway Safety and Motor
Vehicles (DHSMV) database while attempting to locate and interview HENEGHAN. I compared
his driver’s license photograph with the below image [Figure 2] posted publicly on
HENEGHAN’s Instagram account that used the vanity name “heneghanjon”. Both images
appear to depict the same person:

Figure 2

I also conducted an open source search, and located the photograph below of Jon
HENEGHAN on “shrtpoker.com”:

5
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 6 of 13

Several images of HENEGHAN and of HENEGHAN and a woman posing together were
located on HENEGHAN’S Instagram account, as well as a photograph of HENEGHAN at a
poker table. These images are depicted below Figures 3-6:

6
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 7 of 13

Figure 3 Figure 4

Figure 5 Figure 6

I also located the website “simplygluten-free.com” which listed the founder and editor as Carol
Kicinski next to her image [Figure 7]:

7
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 8 of 13

Figure 7

While conducting my research at the Florida DHSMV I viewed the driver’s license image
on file for KICINSKI. The driver’s license image was consistent with the female depicted on the
Instagram webite page for “heneghanjon” as posing with HEHEGHAN (Figures 4-6) (above)
and with the images of the woman with HENEGHAN in the CCTV footage discussed below.

On June 16, 2021, FBI Task Force Officer (TFO) Steven Costa and I contacted
KICINSKI at her residence in Dunedin, Florida during an attempt to interview HENEGHAN and
KICINSKI. TFO Costa and your affiant met with KICINSKI and positively identified her as the
subject depicted in the driver’s license photograph, in the images from HENEGHAN’S
Instagram account, and in the Janaury 6, 2021 CCTV footage described below.

Your affiant located the initial GPS point captured on the Google warrant data for
HENEGHAN’s device at approximately 2:19 p.m. Eastern Standard Time (EST) near the first
floor northwest doors to the Capitol building (Senate Wing Doors). The GPS point was cross-
referenced in the DCAP database against video files generated from a camera located inside the
northwest corner of the Capitol Building. HENEGHAN and KINSINKI are observed entering
the U.S. Capitol Building through the northwest first floor doors, also known as the Senate Wing
Doors near S 139 depecited below in Figure 8.

8
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 9 of 13

Figure 8

I reviewed video files from Hallway at approximately 2:35 p.m. (EST) which captured
HENEGHAN and KICINSKI walking down a hallway inside the Capitol Building on Janury 6,
2021 as depicted below in Figure 9.

Figure 9

9
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 10 of 13

At approximately 2:37 p.m. (EST) HENEGHAN and KICINSKI are observed walking
through the Rotunda, where they were observed looking down at their cell phones. They
gathered in a group of people and eventually walked out of view of the CCTV as depicted below
in Figure 10.

Figure 10

At approximately 2:51 p.m. (EST) HENEGHAN and KICINSKI are observed on near
RHOB Taxi Stnd outside, near the Capitol Building on a sidewalk as depicted in Figure 11
below:

10
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 11 of 13

Figure 11

In September, 2021, I identified the ex-wife of HENEGHAN who was residing in

11
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 12 of 13

Figure 12

Lastly, I obtained historic cellular site data from T-Mobile for HENEGHAN’s mobile
device with a telephone number ending in 5582 and KICINSKI’s mobile device with a telephone
number ending in 3333. I reviewed that data which indicated both devices registered on cellular
towers in Tampa, Florida on January 5, 2021. The data also indicated both devices registered on
cellular towers in the area of the Capitol Building on January 6, 2021at approximately 2:30 p.m.
(EST).

Based on the foregoing, your affiant submits that there is probable cause to believe that
JON NICHOLAS HENEGHAN (“HENEGHAN”) and CAROL O'NEAL KICINSKI
(“KICINSKI”) violated 18 U.S.C. § 1752(a)(1) and (2), which makes it a crime to (1) knowingly
enter or remain in any restricted building or grounds without lawful authority to do; and (2)
knowingly, and with intent to impede or disrupt the orderly conduct of Government business or
official functions, engage in disorderly or disruptive conduct in, or within such proximity to, any
restricted building or grounds when, or so that, such conduct, in fact, impedes or disrupts the
orderly conduct of Government business or official functions; or attempts or conspires to do so.

12
 Case 1:22-mj-00036-RMM Document 1-1 Filed 02/22/22 Page 13 of 13

For purposes of Section 1752 of Title 18, a “restricted building” includes a posted, cordoned off,
or otherwise restricted area of a building or grounds where the President or other person protected
by the Secret Service, including the Vice President, is or will be temporarily visiting; or any
building or grounds so restricted in conjunction with an event designated as a special event of
national significance.

Your affiant submits there is also probable cause to believe that HENEGHAN nad
KICINSKI violated 40 U.S.C. § 5104(e)(2)(D) utter loud, threatening, or abusive language, or
engage in disorderly or disruptive conduct, at any place in the Grounds or in any of the Capitol
Buildings with the intent to impede, disrupt, or disturb the orderly conduct of a session of Congress
or either House of Congress, or the orderly conduct in that building of a hearing before, or any
deliberations of, a committee of Congress or either House of Congress and (G) parade,
demonstrate, or picket in any of the Capitol Buildings.

_________________________________
Shawn Walsh
Task Force Officer
Federal Bureau of Investigation

Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1 by
telephone, this 22nd day of February, 2022 Robin M. Meriweather
2022.02.22 16:18:27
-05'00'
_____________________________________
HONORABLE ROBIN M. MERIWEATHER
UNITED STATES MAGISTRATE JUDGE

13