United States v. VINCENT CANNADY, Southern District of New York (May 1, 2024) — Complaint

UNITED 
STATES 
DISTRICT 
COURT 
SOUTHERN 
DISTRICT 
OF 
NEW 
YORK 
UNITED 
STATES 
OF 
AMERICA 
V. 
VINCENT 
CANNADY, 
Defendant. 
SOUTHERN 
DISTRICT 
OF 
NEW 
YORK, 
ss.: 
AUSAs: 
Reyhan 
Watson; 
James 
McMahon 
SEALED 
COMPLAINT 
Violation 
of 
18 
U.S.
C. 
§ 
1951 
COUNTY 
OF 
OFFENSE
: 
WESTCHESTER 
and 
NEW 
YORK 
CARMEN 
CACIOPPO, 
being 
duly 
sworn, 
deposes 
and 
says 
that 
he 
is 
a  Special 
Agent 
with 
the 
Federal 
Bureau 
oflnvestigation 
("FBI"), 
and 
charges 
as 
follows: 
COUNT 
ONE 
(Extortion) 
1. 
From 
on 
or 
about 
June 
23, 
2023 
to 
on 
or 
about 
December 
23, 
2023, 
in 
the 
Southern 
District 
ofNew 
York 
and 
elsewhere, 
VINCENT 
CANNADY, 
the 
defendant, 
willfully 
and 
knowingly 
attempted 
to 
commit 
extortion, 
as 
that 
tennis 
defined 
in 
Title 
18, 
United 
States 
Code, 
Section 
1951(b)(2), 
and 
would 
and 
did 
thereby 
obstruct, 
delay, 
and 
affect 
commerce 
and 
the 
movement 
of 
aiticles 
and 
commodities 
in 
commerce, 
as 
that 
term 
is 
defined 
in 
Title 
18, 
United 
States 
Code, 
Section 
195 
l(b)(3), 
to 
wit, 
CANNADY 
threatened 
to 
publicly 
disclose 
confidential 
and 
proprietary 
information 
belonging 
to 
Victim-I, 
a publicly 
traded 
information 
technology 
company, 
unless 
Victim-I 
paid 
him 
up 
to 
$1.5 
million 
as 
a purported 
settlement. 
(Title 
18, 
United 
States 
Code, 
Sections 
1951 
and 
2.) 
The 
bases 
for 
my 
knowledge 
and for 
the 
foregoing 
charge 
are, 
in pait, 
as 
follows: 
2. 
I  am 
a  Special 
Agent 
with 
the 
FBI 
and 
I  have 
been 
personally 
involved 
in 
the 
investigation 
of 
this 
matter. 
This 
affidavit 
is 
based 
upon 
my 
personal 
participation 
in 
the 
investigation 
of 
this 
matter, 
my 
conversations 
with 
other 
law 
enforcement 
agents, 
witnesses, 
counsel 
for 
Victim-
I, and 
others, 
as 
well 
as 
my 
examination 
of 
docwnents 
and 
repmts. 
Because 
this 
affidavit 
is 
being 
submitted 
for 
the 
limited 
pmpose 
of 
establishing 
probable 
cause, 
it does 
not 
include 
all 
the 
facts 
that 
I have 
leained 
during 
the 
course 
of 
my 
investigation. 
Where 
the 
contents 
of 
documents 
and 
the 
actions, 
statements 
and 
conversations 
of 
others 
ai·e 
reported 
herein, 
they 
are 
reported 
in 
substance and 
in part 
except 
where 
indicated 
otherwise
. 
3. 
Based 
on 
my 
involvement 
in 
this 
investigation, 
and 
set 
forth 
in greater 
detail 
below, 
I  have 
leained 
that 
VINCENT 
CANNADY
,  the 
defendant, 
used 
threats 
of 
economic 
and 
reputational 
hann 
to 
extmt 
Victim-
I. 
Specifically, 
after 
learning 
that 
his 
engagement 
with 
Victim-
1 
had 
been 
tenninated, 
CANNADY 
improperly 
downloaded 
confidential 
and 
proprietary 

infmmation 
about 
Victim-1 
's 
cybersecurity 
and 
infonnation 
technology 
architecture 
("Victim-1 
's 
Infmmation") 
from 
Victim-1 
's 
database 
and 
threatened 
to publicly 
disclose 
it unless 
Victim-1 
paid 
him 
up 
to 
$1.5 
million 
as 
a purported 
settlement 
of 
his 
claim 
of 
employment 
discrimination
. 
The 
Defendant 
Was 
Te1minated 
by 
Victim-1 
and 
Then 
Stole 
Victim-1 
's 
Data 
4. 
In 
or 
around 
May 
2022, 
VINCENT 
CANNADY, 
the 
defendant, 
was 
a contractor 
at 
a  global 
information 
technology 
contracting 
and 
staffing 
company 
("Staffing 
Company-1 
"). 
Staffing 
Company-1 
placed 
CANNADY 
on 
a project 
for 
Victim-1, 
a  multinational 
information 
technology 
infrastructure 
services 
provider 
that 
is 
based 
in 
the 
Southern 
District 
of 
New 
York, 
including 
in 
Westchester 
and 
Manhattan. 
5. 
Under 
his 
engagement 
with 
Victim-1, 
VINCENT 
CANNADY, 
the 
defendant, 
among 
other 
things, 
analyzed 
information 
technology 
infrastructure 
vulnerabilities 
so 
that 
Victim-
1  could 
improve 
upon 
the 
security 
of 
its 
infrastructure 
services. 
His 
responsibilities 
included 
assessing 
and 
remediating 
potential 
vulnerabilities 
that 
an 
unauthorized 
party 
could 
use 
to 
steal 
from 
Victim-1 
's 
info1mation 
systems. 
As 
a 
result, 
CANNADY 
had 
access 
to 
Victim-1 
's 
Information. 
6. 
On 
or 
about 
June 
20, 
2023, 
Victim-1 
terminated 
VINCENT 
CANNADY's, 
the 
defendant's, 
engagement 
for 
performance 
reasons. 
Staffing 
Company-I 
informed 
CANNADY 
that 
his 
last 
working 
day 
on 
assigmnent 
with 
Victim-I 
would 
be 
June 
20, 
2023, 
and 
that 
CANNADY 
would 
be 
given 
two 
week's 
pay 
as 
severance. 
CANNADY 
confinned 
that 
he 
received 
notice 
to 
return 
devices 
Victim-1 
had 
issued 
to 
him 
in 
connection 
with 
his 
engagement. 
He 
sent 
an 
email 
to 
Victim-I 
stating 
that 
he 
would 
provide 
a 
rep011 
"[ a ]s  my 
final 
act 
for 
[Victim-
I] 
... 
later 
tonight 
or 
early 
tomon-ow 
as 
a thank 
you 
..
. for 
the 
severance 
I will 
receive." He 
then 
sent 
Victim-
1  another 
email 
attaching 
his 
resume, 
university 
transcripts, 
and 
a  letter 
of 
recognition, 
while 
expressing 
his 
"heartfelt 
wishes 
to 
work 
at 
[Victim-1] 
once 
more" 
and 
noting 
"I loved 
my 
job 
and 
the 
hmiful 
thing 
is 
not 
being 
able 
to 
do 
it anymore." 
7. 
On 
or 
about 
June 
23, 
2023, 
VINCENT 
CANNADY, 
the 
defendant, 
accessed 
Victim-1 
's 
systems 
from 
a  company-provided 
laptop, 
downloaded 
Victim-1 
's 
Information, 
and 
then 
transferred 
copies 
of 
Victim-1 
's 
Infonnation 
to 
destinations 
outside 
of 
Victim-1 
's 
control, 
including 
to 
a  private 
cloud 
storage 
account 
he 
controlled. 
The 
docwnents 
and 
infonnation 
CANNADY 
took 
included 
architectural 
maps 
ofVictim-1 
's 
servers 
and 
other 
infrastructure, 
trade 
secrets, 
lists 
and 
reports 
of 
potential 
vulnerabilities, 
and 
details 
on 
specific 
devices 
in 
Victim-
I 
's 
system 
that 
are 
vulnerable 
to 
attack 
by 
malicious 
third 
parties. 
Some 
but 
not 
all 
of 
the 
vulnerabilities 
contained 
in 
those 
documents 
have 
been 
remediated. 
8. 
VINCENT 
CANNADY's, 
the 
defendant's, 
access, 
download, 
and 
transfer 
of 
Victim-1 
's 
Infonnation 
was 
unauthorized 
and 
in 
breach 
of 
Victim-1 
's 
policies 
and 
procedures, 
as 
described 
in 
more 
detail 
below. 
CANNADY 
had 
agreed 
to 
comply 
with 
these 
policies 
and 
procedures 
as 
part 
of 
the 
on 
boarding 
process 
for 
his 
engagement 
with 
Victim
-
1. 
a. 
upon 
tennination: 
Victim-1 
's 
Code 
of 
Conduct 
required 
CANNADY 
to retmn 
Victim-1 
's 
data 
2 

You 
must 
return 
all 
[Victim-
I] 
assets, 
material, 
property 
and 
information 
you 
may 
have 
upon 
expiration 
or 
tennination 
of 
your 
engagement 
with 
[Victim-I], 
including 
information 
on 
personally 
owned 
electronic 
(BYO) 
devices, 
and 
you 
may 
not 
subsequently 
disclose 
any 
[Victim-I] 
infonnation 
to 
any 
third 
party. 
(Code 
of 
Conduct § 
2.1) 
b. 
CANNADY 
was 
authorized 
to 
use 
Victim-1 
's 
data 
only 
for 
purposes 
of 
his 
engagement 
with 
Victim-I, 
and 
he 
was 
not 
authorized 
to 
transfer 
or 
otherwise 
move 
Victim-1 
's 
data 
without 
its 
prior 
written 
authorization: 
Computer 
systems 
provided 
by 
[Victim-I] 
to 
you 
for 
use 
in 
your 
work 
for 
[Victim-I] 
must 
only 
be 
used 
for 
conducting 
[Victin1-l 
's] 
business 
or 
for 
purposes 
authorized 
by 
[Victin1-l] 
management. 
All 
electronic 
documents 
created, 
stored, 
or 
communicated 
using 
[Victim-1 
's] 
computers 
are 
the 
property 
of, 
or 
under 
the 
custody 
of, 
[Victim-
I]. 
(Security 
and 
Use 
Standards 
§ 2.1) 
[Victim-1 
's] 
property, 
assets 
and 
infonnation 
must 
only 
be 
used 
for 
[Victim-I] 
business 
purposes. 
This 
includes, 
for 
example, 
[Victim-
1 's] 
network, 
equipment, 
facilities, 
information 
and 
communication 
systems, 
connections 
to 
the 
Internet 
and 
supplies. 
(Code 
of 
Conduct 
§ 2.1) 
[Victim-I] 
equipment/assets 
remain 
the 
property 
of 
[Victim-I] 
and 
are 
provided 
for 
use 
only 
on 
[Victim-I] 
premises 
where 
I am 
located 
and 
only 
for 
the 
purposes 
of 
my 
assignment 
at 
[Victim-
I] .  Such 
equipment/assets 
will 
not 
be 
altered 
or 
moved 
without 
[Victim-1 
's] 
written 
permission. 
(Security 
Guidelines 
§ 2(a)) 
[CANNADY] 
will 
not 
connect 
or 
allow 
connection 
to 
an 
[Victim-
1 ]-owned 
computer 
without 
prior 
written  approval 
of 
[Victim-I], 
and 
will 
only 
connect 
with, 
interact 
with, 
inspect 
and/or 
use 
those 
programs, 
tools 
or 
routines 
specifically 
made 
available 
by 
[Victim-
1] 
and 
which 
are 
necessary 
for 
me 
to 
provide 
services 
for 
my 
assigmnent. 
(Security 
Guidelines 
§ 3(a)) 
c. 
CANNADY 
was 
instmcted 
not 
to 
store 
Victim-1 
's 
confidential 
information 
on 
systems 
not 
controlled 
by 
Victim-I: 
"Do 
not 
store 
or 
process 
[Victim-I] 
Confidential 
infonnation 
on 
systems 
that 
are 
not 
controlled 
by 
you 
or 
[Victim-I]." 
(Security 
and 
Use 
Standards 
§ 2.3.3). 
9. 
Based 
on 
my 
conversations 
with 
counsel 
for 
Victim-I 
authorized
. to 
speak 
on 
Victim-1 
's 
behalf 
and 
my 
review 
of 
comi 
filings 
by 
Victim-I 
in 
federal 
court 
litigation 
involving 
VINCENT 
CANNADY, 
the 
defendant, 
Victim-I 
never 
authorized 
CANNADY 
to 
access 
Victim-
3 

1 
's 
systems 
after 
CANNADY'S 
engagement 
was 
tenninated
. 
Nor 
did 
Victim-I 
authorize 
CANNADY 
to 
transfer 
its 
data 
to 
outside 
of 
Victim
-1 ' s control, 
including 
to 
any 
personal 
cloud 
storage 
accounts 
or 
devices 
owned 
or 
controlled by 
him. 
10. 
Additionally
,   based 
on 
my 
conversations 
with 
counsel 
for 
Victim-I, 
after 
VINCENT 
CANNADY
, the 
defendant
, downloaded 
Victim-1 
's 
Infonnation, 
CANNADY 
cut 
off 
any 
internet 
access 
to 
the 
laptop 
issued 
to 
him 
by, 
and 
belonging 
to , Victim-I, 
which 
had 
the 
effect 
of 
defeating 
Victim-1 
's 
"lock-out" 
protocols
, 
i.
e., 
Victim-1 
's 
ability 
to 
protect 
its 
data 
by 
disabling 
the 
laptop 
remotely. 
The 
Defendant 
Demanded 
a "Settlement" 
when 
Confronted 
about 
the 
Data 
He 
Stole 
11. 
On 
or 
about 
July 
3, 
2023, 
Staffing 
Company-I 
reached 
out 
to 
VINCENT 
CANNADY
, the 
defendant, 
at Victim-1 
's request
, to 
schedule 
an 
exit interview: 
[Victin1-l 
' s Computer 
Security 
Incident 
Response 
Team] 
detected 
multiple 
files 
shared 
to 
[CANNADY's] 
private 
[cloud 
storage 
account] 
and 
notified 
corporate 
security 
of 
the 
activity. 
As 
a result
, 
as 
part 
of 
our 
n01mal 
procedure 
we 
would 
like 
to 
understand 
why 
this 
has 
happened, 
and 
we 
wanted 
to 
be 
sure 
to 
protect 
and 
delete 
all 
[Victim-I] 
data 
that 
was 
shared. 
Please 
let 
us 
know 
when 
we 
can 
discuss 
this 
matter 
to 
better 
understand 
why this 
occmTed 
and 
when 
you 
can 
delete 
all 
the 
data 
and 
sign 
an 
attestation 
of 
deletion. 
CANNADY 
responded 
on 
or 
about 
July 
3,  2023, 
by 
saying 
he 
had 
received 
"disparate 
and 
discriminatory 
treatment" 
and 
fmiher 
stated 
"I  cannot 
talk 
to 
you 
due 
to 
my 
health 
for 
at 
least 
a 
month
."
1 
10. 
On 
or 
about 
July 
17, 
2023, 
Staffing 
Company-I 
again 
reached 
out 
to 
VINCENT 
CANNADY
, the 
defendant, 
"due 
to 
the 
sense 
of 
urgency;" 
asked 
"to 
get 
on 
a meeting 
with 
us 
as 
soon 
as 
possible 
to 
delete 
the 
files;" 
and 
requested 
a  doctor's 
note 
supp01iing 
CANNADY's 
alleged 
inability 
to 
speak 
with 
Staffing 
Company-
I  for 
a month 
"so 
we 
have 
docmnentation 
for 
legal 
purpo
s
es 
as 
to 
the 
delay 
in 
resolving 
this 
situation 
as 
soon 
as 
possible
."  CANNADY 
responded, 
"As 
[Staffing 
Company-I] 
has 
stated 
to 
the 
[Missouri] 
Unemployment 
that 
I  did 
not 
perfonn 
my 
duties 
assigned 
to 
me 
to 
normal 
standards 
those 
docmnents 
will 
be 
used 
in 
the 
impending 
legal 
actions." 
11. 
On 
or 
about 
July 
20
, 2023, 
the 
general 
counsel 
of 
Staffing 
Company-I 
reached 
out 
to 
VINCENT 
CANNADY, 
the 
defendant, 
informing 
him 
that 
he 
was 
aware 
of 
CANNADY's 
unauthorized 
download 
and 
transfer 
of 
Victim-l's 
Information
, and 
demanded 
that 
CANNADY, 
by 
July 
24, 
2023, 
contact 
Staffing 
Company-I 
to 
coordinate 
a supervised 
deletion 
of 
the 
files
. The 
general 
counsel 
also 
noted 
that 
he 
was 
aware 
of 
concerns 
CANNADY 
had 
regarding 
his 
assignment 
with 
Victim-I, 
but 
that 
CANNADY 
had 
not 
provided 
any 
details 
about 
those 
concerns 
with 
Staffing 
Company-
I so 
that 
it could 
investig
ate 
those 
concerns. 
1 
Direct 
quotes 
attributed 
to 
VINCENT 
CANNADY
, the 
defendant, 
are 
included 
in this 
Complaint 
as 
written 
by 
him 
and, 
therefore, 
may 
include 
typographical 
or 
grammatical 
en-ors. 
4 

12. 
That 
same 
day, 
in 
response 
to 
the general 
counsel 
of 
Staffing 
Company-1 
's 
email, 
VINCENT 
CANNADY, 
the 
defendant, 
copied 
two 
journalists 
and 
responded 
"[Y]our 
threats 
of 
Legal 
Action 
is  not 
sufficient 
to 
make 
me 
delete 
those 
files" 
and 
"I 
am 
allowed 
to 
kept 
these 
files 
in 
my 
defense 
or 
use 
them 
to 
file 
an 
affomative 
complaint  with 
any 
Court 
of 
Subject 
Matter 
Jurisdiction
." CANNADY 
added: 
I will 
be 
in 
touch 
but 
will 
not 
answer 
any 
more 
emails 
untill 
I see 
a 
need 
to. 
Should 
[Staffing 
Company-1] 
be 
willing 
to 
settle 
this 
matter 
out 
of 
Court 
I am 
willing 
to 
accept 
5 years 
salary 
otherwise 
we 
will 
let 
the 
Comis 
decide. 
CANNADY 
also 
included 
a sentence 
directed 
to 
the 
journalists 
he 
copied 
to 
the 
email: 
"I 
have 
a 
great 
business 
news 
story 
for 
you 
to 
share 
with 
your 
Editors." 
13
. 
On 
or 
about 
August 
17, 
2023
,  VINCENT 
CANNADY
,  the 
defendant, 
emailed 
Victim-
I,  Staffing 
Company-I, 
and 
several 
journalists, 
noting 
that 
he 
did 
not 
receive 
a response 
from 
Victim-I 
or 
Staffing 
Company-I 
about 
his 
demand 
for 
a  "settlement," 
and 
demanding 
"5 
years 
salary 
from 
[Staffing 
Company-I] 
for 
their 
discriminatory 
actions" 
and 
"10 
years 
salary 
from 
[Victim-I] 
under 
intentional 
infliction 
of 
emotional 
distress 
law." 
He 
also 
stated, 
"I 
will 
file 
a Lawsuit 
in 
14 
days 
from 
this 
email 
and 
recieve 
and 
serve 
summons 
on 
[Victim-I] 
14 
days 
after 
that." 
CANNADY 
also 
recommended 
that 
his 
demand 
be 
forwarded 
to 
Victim-1 
's 
legal 
depaiiment, 
which 
is 
based 
in 
Westchester, 
to 
"have 
them 
respond 
to 
this 
email." 
He 
added: 
I worked 
very 
hard 
for 
you 
and 
you 
should 
have 
not 
colluded 
to 
fire 
me 
after 
all 
the 
hard work 
I did 
for 
[Victim-
I] 
and 
lying 
and 
saying 
my 
work 
was 
substand 
is 
the 
main 
reason 
I  am 
going 
to 
sue 
all 
of 
you. 
14. 
As 
of 
on 
or 
about 
August 
31, 
2023, 
VINCENT 
CANNADY, 
the 
defendant, 
had 
not 
filed 
a lawsuit 
against 
either 
Victim-I 
or 
Staffing 
Company-I. 
Instead, 
he 
sent 
an 
email 
to 
Victim-
1, 
Staffing 
Company-I, 
and 
several 
journalists, 
among 
others, 
as 
of 
that 
date 
threatening 
the 
disclosure 
of 
Victin1-l 
' s Infonnation 
and 
again 
demanding 
a "settlement": 
As 
[Staffing 
Company-I] 
and 
[Victim-I] 
were 
stating 
my 
work 
was 
substandard 
I  will 
be 
uploading 
all 
of 
the 
documents 
in 
my 
possession 
to 
the 
Comi 
via 
Pacer 
immediately 
ie 
once 
the 
case 
is 
filed 
and 
I have 
electronic 
access 
to 
file 
documents. 
As 
we 
all 
know 
those 
documents 
will 
imperil 
[Victim-1 
's] 
reputation 
and 
shake 
investor 
confidence, 
and 
will 
include 
documents 
being 
shared 
with 
regulatory 
agencies 
here 
and 
in 
the 
EU. 
I will 
not 
be 
communicating 
with 
[Victim-I] 
or 
Staffing 
[Company-
1] 
anymore 
unless 
the 
communication 
is 
initiated 
by 
them 
in 
order 
to 
Settle 
this 
issue 
.... 
5 

The 
Defendant 
Continued 
His 
Threats 
Despite 
Victim-1 
's 
Judicial 
Intervention 
15. 
In 
the 
summer 
of 
2023, 
Victim-I 
obtained 
a  temporary 
restraining 
order 
from 
a 
federal 
dish·ict 
comi 
that 
prohibited 
VINCENT 
CANNADY, 
the 
defendant, 
from 
disclosing 
Victim-1 
's 
Infonnation. 
16. 
On 
or 
about 
September 
5, 
2023, 
and 
following 
Victim-1 
's 
obtaining 
a temporary 
restraining 
order, 
VINCENT 
CANNADY, 
the 
defendant, 
sent 
counsel 
for 
Victim-1 
an 
email 
demanding 
$1.5 
million 
in 
exchange 
for 
his 
agreement 
to 
destroy 
and 
not 
disclose 
Victim-1 
's 
Info1mation: 
I am 
writting 
you 
today 
with 
the 
hopes 
that 
you 
and 
[Victim-
I] 
are 
willing 
to 
settle 
this  and 
any 
other 
future 
litigation 
either 
here 
in 
America 
and 
abroad. 
As 
I stated 
in 
my 
Motion 
that 
the 
US 
District 
Comi 
TRO 
in place 
only 
is 
in 
effect 
in the USA. 
Also 
the 
TRO 
does 
not 
limit 
my 
1st 
Amendment 
Rights 
only 
supplying 
the 
documents 
to 
a pubilically 
accessible 
forum. 
I require 
a 
10 
year 
Certificate 
of 
Deposit 
for 
1.5 
million dollars. 
That 
will 
buy 
a  attestation 
of 
all 
files 
destroyed 
by 
me 
and 
a  gag 
order 
preventing 
me 
from 
ever 
talking 
about 
what 
I saw 
or 
the 
documents 
I had 
in 
my 
possession 
or 
the 
documents 
I had 
created 
at 
[Victim-1] 
or 
downloaded 
.... 
Finally 
If 
you 
are 
not 
willing 
to 
settle 
and 
I have 
to 
get 
an 
attorney 
I 
will 
do 
what 
ever 
I can 
within 
the 
boundaries 
of 
the 
TRO! 
Ifl 
get 
an 
attorney 
I will 
seek 
3 times 
the 
amount 
in 
settlement 
so 
I  can 
pay 
them 
their 
30%. 
If 
you 
refuse 
[mediation] 
then 
I  will 
be 
forced 
to 
seek 
relief 
in 
another 
Jurisdiction. 
You 
have 
until 
the 
end 
of 
the 
week 
to 
either 
agree 
to 
my 
terms 
or 
enter 
a  counter 
off 
er 
after 
that 
time 
I  will 
answer 
calls 
from 
the 
media 
and 
regulatory 
agencies 
and 
begin 
in 
earnest 
seeking 
representation 
(  I 
have 
only 
contacted 
two 
attomies 
so 
far 
as 
this 
case 
is 
only 
4 days 
old). 
17. 
In 
a 
second 
email 
to 
counsel 
for 
Victim-1 
later 
that 
same 
day, 
VINCENT 
CANNADY, 
the 
defendant, 
said: 
[Victim-1] 
sued 
me 
to 
keep 
md 
quiet 
but 
the 
TRO 
only 
refers 
to 
the 
documents 
not 
my 
first 
amendment 
right 
to 
FREE 
SPEECH. 
I await 
your 
counter 
or 
no 
offer 
by 
COB 
FRIDAY 
then 
I test 
international 
law 
freedoms 
of 
communicating 
with 
regulators. 
6 

18. 
On 
or 
about 
September 
14, 
2023, 
VINCENT 
CANNADY, the 
defendant, 
sent 
an 
email 
to 
Staffing 
Company-I, 
offering 
to 
not 
disclose 
Victim-1 
's 
Infonnation 
and 
drop 
his 
lawsuits 
against 
Victim-I 
and 
Staffing 
Company-I 
in 
exchange 
for 
$535,000
.  CANNADY 
also 
noted, 
"Because 
I  could 
make 
300k 
or 
400k 
on 
a  book 
deal 
or 
get 
a job 
at 
CNN 
or 
ABC 
News 
if 
I 
published 
this 
story 
I am 
demanding 
those 
amounts 
wich 
is 
including 
punitive 
and 
compensatory 
damages." 
19
. 
On 
or 
about 
September 
18, 
2023, 
VINCENT 
CANNADY, the 
defendant, 
sent 
an 
email 
to 
Staffing 
Company-I, 
"inqui1ing 
as 
to 
the 
status 
of 
the 
settlement." 
An 
attorney 
for 
Victim-
1 
responded 
with 
a 
request 
for 
"assurances 
that 
no 
documents 
or 
information 
has 
been 
disseminated 
or 
will 
be 
in 
the 
future." 
CANNADY 
responded: 
I  am 
not 
a  fool 
why 
would 
I  desh
·oy 
my 
only 
leverage 
with 
out 
a 
moneta1y 
agreement. 
Until 
you 
present 
me 
with 
either 
yes 
or 
no 
to 
my 
settlement 
requirement 
( or 
counter 
offer) 
I will 
not 
be 
discussing 
what 
I will 
or 
can 
do 
to 
assuage 
[Victim-I] 
or 
[Staffing 
Company-
1] 
fear 
of 
damaged 
reputation 
as 
mine 
is 
already 
damaged. 
So 
if 
you 
want 
to 
continue 
hard 
ball 
go 
ahead 
there 
will 
be 
no 
response 
from 
me 
until 
a money 
amount 
is 
given. 
20. 
On 
or 
about 
September 
18, 
2023, 
VINCENT 
CANNADY, 
the 
defendant, 
stated 
"I 
would 
destroy 
the 
copies 
and 
sign 
an 
attestation 
of 
desh·uction 
pending 
issuance 
of 
the 
settlement 
funds," 
and 
requested 
"Payment 
by 
Friday 
( with 
destruction 
of 
files 
on 
Friday 
pending 
payment)
." 
21. 
On 
or 
about 
September 
20, 
2023, 
VINCENT 
CANNADY, the 
defendant, 
stated 
"I 
will 
not 
sign 
[a 
settlement] 
for 
no 
less 
than 
what 
a book 
deal 
would 
get 
me 
... 
I will 
not 
provide 
assertions 
of 
destrnction 
for 
$500, 
that 
will 
cost 
you 
$50,000 
so 
the 
initial 
payment 
will 
be 
$50,000 
not 
five 
hundred 
or 
we 
continue 
litigation
." 
22. 
On 
or 
about 
September 
21, 
2023, 
VINCENT 
CANNADY, 
the 
defendant, 
stated, 
in 
response 
to 
Victim-1 
's 
request 
that 
CANNADY 
provide 
Victim-I 
access 
to 
his 
personal 
cloud 
storage 
server 
to 
ensure 
deletion 
ofVictim-1 
's 
information, 
"What 
I offer 
is 
a zoom 
meeting 
where 
the 
destruction can 
be 
witnesses 
by 
who 
ever, 
the 
cd's 
that 
guarantee 
that 
I 
do 
not 
publish 
any 
data 
that 
I might 
have 
nor 
go 
to 
any 
regulatory 
agencies." 
On 
that 
same 
day, 
in 
response 
to 
counsel 
for 
Victim-1 
's 
email 
advising 
CANNADY 
that 
he 
would 
relay 
CANNADY's 
settlement 
position 
to 
Victim-I, 
CANNADY 
referenced 
several 
"aiticles" 
that 
he 
wanted 
to 
write 
about 
Victim-I 
containing 
hatmful 
infonnation. 
23. 
On 
or 
about 
September 
25, 
2023, 
VINCENT 
CANNADY, 
the 
defendant, 
stated 
"I 
am 
willing 
to 
sign 
an 
attestation 
of 
destruction 
of 
the 
flash 
drives 
and 
files 
on 
hard 
drives 
( even 
willing 
to 
let 
you 
view 
that 
by 
Zoom 
as 
well). 
With 
the 
flash 
drive 
meeting 
happening 
after 
the 
remaining 
150K 
Deposited 
into 
my 
account 
as 
a settlement." 
24. 
On 
or 
about 
September 
28, 
2023, 
VINCENT 
CANNADY
, the 
defendant, 
stated
, in 
response 
to 
counsel 
for 
Victim-1 
's 
request 
to 
be 
given 
information 
about 
how 
many 
of 
7 

CANNADY
' s devices 
contain 
Victim-1 
's 
data: 
"I 
simply 
cannot 
tell 
you 
anything 
about 
the 
files, 
how 
many 
devices, 
or 
even 
where 
they 
are 
without 
some 
sort 
of 
financial 
recompense 
... 
Paym 
me 
the 
initial 
amount 
and 
I will 
tell 
you 
how 
many 
devices 
and 
send 
them 
ones 
I can 
to 
you 
for 
you 
to 
destroy 
.. .. 
" 
25. 
On 
or 
about 
September 
25, 
2023
,  VINCENT 
CANNADY
,  the 
defendant, 
again 
sought 
to 
leverage 
the 
potential 
hann 
to 
Victim-1 
from 
Victim-1 
's 
lnfonnation 
to 
try 
to 
induce 
Victim-1 
to 
agree 
to 
a "settlement," 
stating: 
If 
this 
is 
not 
acceptible 
I will 
cease 
settlement 
negotiations,and 
seek 
recompense 
with 
publication 
and 
litigation 
of 
my 
1st 
Amendment 
Right 
to 
publish 
a Cyber 
Security 
Policy 
paper 
based 
on 
the 
research 
of 
the 
work 
I perfonned 
and 
my 
own 
Professional 
experience 
that 
[Victim-1 
's] 
Risk 
Acceptance 
Policies 
puts 
[Victim-1 
's] 
investors 
at risk 
of 
a major 
data 
breach. 
26. 
On 
or 
about 
October 
1, 
2023, 
counsel 
for 
Victim-1 
sent 
VINCENT 
CANNADY
, 
the 
defendant
, a draft 
settlement 
agreement. 
CANNADY 
and 
Victim-1 
engaged 
in 
several 
back-
and-forth 
discussions concerning 
the 
terms 
of 
settlement. 
27
. 
On 
or 
about 
October 
26, 
2023, 
VINCENT 
CANNADY
,  the 
defendant, 
sent 
an 
email 
to, 
among 
other 
people, 
Victim-1 
's 
counsel 
in 
the 
Southern 
District 
of 
New 
York 
and 
elsewhere, 
assuring 
Victim-1 
that 
he 
had 
not 
disclosed 
any 
of 
Victim-1 
's 
documents
, stating 
"As 
I stated 
in 
June 
I shared 
information 
with 
[Newspaper-I], 
[Newspaper-2], 
and 
other 
Agencies 
not 
documents 
because 
I wanted 
negotiating 
leveage 
for 
a settlement." 
28. 
At 
several 
points 
during 
his 
attempt 
to 
obtain 
a 
"settlement," 
VINCENT 
CANNADY
, the 
defendant, 
sought 
to 
protect 
himself 
from 
a criminal 
prosecution 
for 
his 
actions 
in 
connection 
with 
the 
"settlement": 
a. 
On 
or 
about 
September 
24
,  2023, 
CANNADY 
stated 
"I 
want 
to 
add 
that 
[Victim-1] 
nor 
[Staffing 
Company-I] 
will 
ever 
seek 
criminal 
charges 
against 
me
." 
b. 
On 
or 
about 
October 
4,  2023
,  after 
Victim-1 
sent 
CANNADY 
a  draft 
settlement 
agreement, 
CANNADY 
stated 
"I 
had 
previously 
asked 
that 
[Victim-1] 
and 
[Staffing 
Company-1 
's] 
state 
that 
they 
will 
not 
seek 
criminal 
charges
, nor 
refer 
the 
case 
for 
criminal review 
nor 
report 
the 
case 
to 
any 
agency 
for 
criminal 
review 
after 
the 
completion 
of 
the 
agreement. 
I ask 
that 
you 
place 
those 
terms 
in 
the 
agreement." 
c. 
On 
or 
about 
October 
5, 
2023, 
CANNADY 
sought 
to 
add 
to 
the 
draft 
settlement 
agreement 
the 
term 
"If 
[Victim-1] 
or 
[Staffing 
Company-
I '
s] 
files 
charges 
or 
refers 
the 
case 
for 
criminal 
prosecution 
they 
forfeit 
any 
and  all 
funds 
given 
in 
the 
settlement 
agreement." 
d. 
On 
or 
about 
October 
9,  2023
,  CANNADY 
stated 
"I  will 
put 
together 
my 
own 
little 
settlement 
agreement 
dealing 
with 
[Victim-1] 
or 
[Staffing 
Company-1 
'
s] 
waiving 
their 
right 
to 
pursue 
Charges 
and add 
it into 
the 
one 
you 
sent 
me." 
8 

e. 
On 
or 
about 
October 
11, 
2023, 
after 
allegedly 
seeking 
the 
advice 
of 
counsel 
in 
connection 
with 
the 
settlement 
agreement, 
CANNADY 
stated 
"[I]f 
you 
will 
not 
add 
the 
preclusion 
of 
Criminal 
referral 
then 
I will 
add 
it." 
f. 
On 
or 
about 
November 
13, 
2023, 
CANNADY 
stated 
"I 
am 
also 
willing 
to 
accept 
the 
settlement 
Agreement 
with 
the 
terms 
previously 
provided 
with 
an 
email 
stating 
that 
[Victim-I] 
will 
not 
seek 
Criminal 
charges 
against 
me 
in the 
future 
after 
I have 
given 
them 
the 
files, 
destroyed 
the 
files 
I have 
gave 
etc 
...
. . " 
29
. 
On 
or 
about 
December 
1, 
2023, 
VINCENT 
CANNADY, 
the 
defendant, 
through 
his 
counsel, 
sent 
an 
email 
to, 
among 
other 
people, 
Victim-1 
's 
counsel 
in 
the 
Southern 
District 
of 
New 
York 
and 
elsewhere, 
inquiring 
"why 
settlement 
fell 
apart." 
30. 
On 
or 
about 
December 
14, 
2023, 
Victim-I, 
through 
its 
counsel, 
sent 
an 
email 
requesting 
that 
VINCENT 
CANNADY, 
the 
defendant, 
provide 
(1) 
"a 
list 
of 
every 
[Victim-
I] 
file 
he 
has" 
and 
"5-10 
representative 
files 
in 
order 
to 
show 
that 
he 
has 
the 
files 
and 
is 
able 
to 
deliver 
them 
in 
exchange 
for 
any 
payment 
that's 
made 
to 
him." 
That 
same 
day, 
CANNADY's 
counsel 
stated: 
"I'm 
almost 
certain 
he 
will 
not 
agree 
to 
do 
so 
absent 
a settlement 
agreement." 
31. 
On 
or 
about 
December 
22, 
2023, 
VINCENT 
CANNADY, 
the 
defendant, 
tlu·ough 
his 
counsel, 
sent 
an 
email 
relating 
to 
Victim-1 
's 
December 
14, 
2023, 
request 
for 
information 
about 
the 
documents 
CANNADY 
had, 
stating 
that 
"if 
everyone 
returned 
to 
the 
original 
settlement 
agreement 
then 
... 
[Victim-1 
's] 
fears 
of 
not 
having 
the 
infonnation 
would 
be 
alleviated 
in 
that 
the 
way 
the 
settlement 
is 
structured 
is 
amounts 
are 
given 
at 
different 
phases 
upon 
verifying 
that 
infmmation." 
32
. 
On 
or 
about 
December 
23, 
2023, 
VINCENT 
CANNADY, 
the 
defendant, 
emailed 
Victim-1 
's 
counsel 
directly, 
including 
Victim-1 
's 
counsel 
in 
the 
Southern 
Dish·ict 
of 
New 
York, 
stating 
that 
Victim-I 
already 
had 
the 
information 
it was 
seeking 
and 
"If 
you 
want 
any 
infonnation 
from 
me 
that 
I have 
akeady 
not 
provided 
then 
produce 
a settlement 
agreement." 
CANNADY 
also 
said: 
I am 
a Cyber 
Security 
Forensic 
Expe1i 
who 
has 
been 
in 
IT 
for 
over 
29 
years, 
if 
your 
client 
had 
proper 
off 
boarding 
then 
we 
would 
not 
be 
talking 
right 
now 
and 
in 
fact 
I  moaned 
at 
the 
Management 
that 
the 
off 
boarding  policy 
was 
too 
laxed 
for 
proper 
Cyber 
Security 
Standards. 
9 

WHEREFORE, 
I respectfully 
request that 
a warrant 
be 
issued 
for 
the 
arrest 
of 
VINCENT 
CANNADY, 
the 
defendant
, and 
that 
he 
be 
arrested, 
and 
imprisoned 
or 
bailed, 
as 
the 
case 
may 
be
. 
to 
before 
me 
this 
day 
ofEebruary, 
2024 
Carmen 
Cacioppo 
Special 
Agent 
Federal 
Bureau 
of 
Investigation 
A 
REZNIK 
D 
STATES 
GI 
TE 
JUDGE 
I 
SOUTHERN 
DISTRIC
[l 
F NEW 
YORK