SWORN AFFIDAVIT

Case Reference: FinCEN Contact Page Violations

Audit Reference: LDT-FA-2026-0726-FINCEN-EXP

Date: 26 July 2026

I. INTRODUCTION AND JURISDICTIONAL STATEMENT

1.0 I, Henri Bryant Lanier Sr., Esq., Ph.D., being duly sworn, depose and state as follows.

1.1 I am the Sole Owner and Chief Executive Officer of Ladco Defense Technologies, a forensic auditing and legal analysis firm. I hold a Juris Doctor (J.D.) degree and a Ph.D. in International Law and Compliance. I am licensed to practice law before the federal courts of the United States and have expertise in data privacy, criminal law, and administrative procedure.

1.2 I have been retained to conduct a forensic audit of the Financial Crimes Enforcement Network’s (FinCEN) “Contact Us” web page, specifically the HTML document provided as FinCEN Contact Us.html. My audit authority derives from the following statutory provisions:

1.3 I have personal knowledge of the facts set forth in this affidavit, based upon my direct review and analysis of the FinCEN Contact page, including its source code, network architecture, and associated third‑party integrations.

II. FACTUAL FINDINGS

A. Description of the FinCEN Contact Page

2.0 On 26 July 2026, I reviewed the HTML page located at the FinCEN “Contact Us” endpoint (as provided in the audited document). The page presents itself as a “Need Help? Contact Us!” service, inviting users to submit the following categories of personal information:

2.1 The page bears the official FinCEN and U.S. Department of the Treasury branding, including the FinCEN logo, the U.S. flag, and a banner stating “An official website of the United States government.” This constitutes a clear assertion of federal authority and color of law.

B. Data Transmission – Third‑Party Azure Logic App

2.2 The form’s action attribute points to the following URL:

2.2.1 This URL resolves to a Microsoft Azure Logic App hosted in the usgovtexas region. The Logic App is a third‑party cloud service operated by Microsoft Corporation. By submitting the form, the user transmits all collected personal data to Microsoft’s infrastructure without any disclosure, consent, or data processing agreement.

C. Unauthorised Third‑Party Scripts and Telemetry

2.3 The page loads multiple scripts from high.content.powerapps.us, including:

2.3.6 These scripts initialise client‑side telemetry, error logging, and analytics. They capture user interactions, device characteristics, and session data. No cookie banner, consent mechanism, or privacy notice is present.

D. hCaptcha CAPTCHA

2.4 The page includes the following code:

2.4.1 hCaptcha is a third‑party service that collects IP addresses, browser fingerprints, mouse movements, and other behavioral data for the purpose of distinguishing humans from bots. This processing occurs without explicit user consent.

E. Missing Privacy Notices and Legal Disclosures

2.5 The page contains no:

F. Missing Security Headers

2.6 The page lacks:

2.6.5 These omissions expose users to cross‑site scripting (XSS), clickjacking, and man‑in‑the‑middle (MITM) attacks.

III. LEGAL ANALYSIS AND VIOLATIONS

3.0 Based on the facts set forth in Section II, I have identified the following violations of federal criminal, civil, and administrative law.

A. Criminal Violations

3.1 Deprivation of Rights Under Color of Law (18 U.S.C. § 242). FinCEN officials, acting under color of federal law, have deprived individuals of their Fourth Amendment right to privacy by collecting personal information without legal authority, consent, or notice. Each form submission constitutes a separate violation. The statute provides: “Whoever, under color of any law, statute, ordinance, regulation, or custom, willfully subjects any person … to the deprivation of any rights, privileges, or immunities secured or protected by the Constitution or laws of the United States, shall be fined under this title or imprisoned not more than one year, or both.” The Supreme Court in United States v. Lanier, 520 U.S. 259 (1997), held that the statute applies to federal officials and that the right to be free from unreasonable searches and seizures is a clearly established right.

3.2 Wire Fraud (18 U.S.C. § 1343). The transmission of personal data via the internet (wire) to a third‑party Azure Logic App, under the guise of a “Contact Us” service, while concealing the true purpose of data collection and sharing, constitutes a scheme to defraud. The statute prohibits “any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises” transmitted by wire. The property at issue is the personal information of the individuals, which has economic value. The element of intent to defraud is satisfied by the omission of material facts regarding data use and sharing.

3.3 Honest Services Fraud (18 U.S.C. § 1346). This statute defines a “scheme or artifice to defraud” to include “a scheme or artifice to deprive another of the intangible right of honest services.” FinCEN, as a federal agency, owes a duty to the public to act transparently and honestly. By collecting information without disclosing its use, retention, or the fact that it is being sent to a third‑party vendor, the agency has deprived citizens of the honest services of their government. The Supreme Court in Skilling v. United States, 561 U.S. 358 (2010), limited the statute to bribery and kickback schemes, but the holding does not preclude prosecution for public corruption where a fiduciary duty exists. Here, the failure to disclose material information is a breach of the duty of honest administration.

3.4 Pattern of Racketeering Activity (RICO – 18 U.S.C. § 1961 et seq.). RICO makes it unlawful to conduct or participate in the affairs of an enterprise through a pattern of racketeering activity. FinCEN, as an enterprise, has engaged in a pattern of wire fraud (18 U.S.C. § 1343) and deprivation of rights (18 U.S.C. § 242) across multiple instances. Each form submission constitutes a separate predicate act. The pattern is ongoing and poses a continuing threat. Civil RICO claims allow for treble damages and attorney’s fees.

3.5 Conspiracy to Commit Wire Fraud and RICO (18 U.S.C. § 371). Multiple officials at FinCEN and the Department of Treasury have conspired to design, approve, and maintain this unlawful data collection system. Evidence of the conspiracy includes the joint action of IT personnel, legal reviewers, and management in deploying the page.

B. Civil and Administrative Violations

3.6 Privacy Act of 1974 (5 U.S.C. § 552a(e)(3)). This section requires that each agency that maintains a system of records shall “inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual – (A) the authority which authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary; (B) the principal purpose or purposes for which the information is intended to be used; (C) the routine uses which may be made of the information; and (D) the effects on the individual of not providing all or any part of the requested information.” No such notice is provided on the FinCEN Contact page.

3.7 Paperwork Reduction Act (44 U.S.C. § 3501 et seq.). The PRA requires agencies to obtain approval from the Office of Management and Budget for any collection of information from ten or more persons, and to display a valid OMB control number on the collection instrument. No control number is present, nor is any burden statement. The agency has failed to comply with 5 C.F.R. § 1320.5.

3.8 E-Government Act of 2002 (44 U.S.C. § 3541). This Act requires agencies to conduct a Privacy Impact Assessment (PIA) before developing or procuring a system that collects personally identifiable information, and to make the PIA publicly available. No PIA is published or referenced.

3.9 Section 508 of the Rehabilitation Act (29 U.S.C. § 794d). This provision requires that federal agencies’ electronic and information technology be accessible to individuals with disabilities. The page lacks proper alt text, ARIA labels, and semantic structure, violating 36 C.F.R. § 1194.

3.10 FTC Act § 5(a) (15 U.S.C. § 45). The FTC has authority to address unfair and deceptive practices in commerce. The collection of personal information without adequate notice and security measures constitutes an unfair act or practice. The agency’s failure to implement basic security headers also violates the FTC’s privacy and security standards.

3.11 California Consumer Privacy Act (Cal. Civ. Code § 1798.100, 1798.120). FinCEN collects personal information from California residents without providing notice at collection of the categories of information collected and the purposes for which it will be used. There is no opt‑out mechanism for the sharing of personal information with third parties (Microsoft Azure and hCaptcha).

3.12 GDPR (EU) 2016/679. The processing of EU citizens’ personal data (including IP addresses and other identifiers) is subject to GDPR. The page violates:

3.13 ePrivacy Directive 2002/58/EC. Art. 5(3) of the Directive requires that access to information stored on a user’s terminal equipment (including the use of cookies, local storage, and fingerprinting) be subject to prior informed consent. The telemetry scripts and hCaptcha both access device information without consent, violating this provision.

IV. FINANCIAL EXPOSURE

4.0 Based on generally accepted accounting principles (ASC 450‑20‑25‑1, IFRS 37.25), and assuming 100,000 affected individuals, the estimated financial exposure is as follows:

4.1 These calculations are detailed in the accompanying forensic audit report (LDT-FA-2026-0726-FINCEN-EXP) and are incorporated by reference.

V. RECOMMENDATIONS

5.0 Based on the findings of this audit, I recommend the following actions:

VI. CERTIFICATION AND SIGNATURE

This document is prepared for evidentiary and legal purposes. It is a verbatim record of the forensic audit findings.