Mar 8, 2011 - I know that a forensic image is an exact physical copy of the data storage media. ... 1'he recovery of suc
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 1 of 39
Page ID#: 1
AO 106 (Rev. 7/87) Affidavit for Search Warrant ~
United States District Court OREGON
DISTRICT OF
In the Matter of the Search of INama, address o~ Criof dosc~ipti0n o~ person. prope~y or ?ramisns to ba saarGhed)
The property located at 15825 SW 80th Avenue, Tigard, Oregon 97224; described as a two-story residence, beige with teal trim, a brown front door that faces east and the numbers "15825" on the garage
APPLICATION ANb-AFFIDAVIT FOR SEARCH WARRA'YT CASE NUMBER:
'11 -MC-906 ~ ,being duly sworn depose and say:
Special ALent Joseph R. LaMonica
I,
and have reason to believe
am a(n) Special Aqent - Federal Bureau of Investicaation Official 'ille
that ~ on the person of or ~ on the property or premises known as came das~-~~~~~~ ~~.n~~~ ~~~ano~~ "I~he property located at 15825 SW Roth Avenue,l~igard, Oregon 97224; described as a two-stor}~ residence, beige
~~~ith teal trim, a brown front door that faces east and the numbers "15825" on the garage. OrePon District of in the there is Hour concealed a certain person or property, Ida R~Iely (describe tha person or properly tO be seized) See ~~~~~~~~~~~~B W rllCh I$ (state one cr more bases for search anA sai~ure sal lorth under Rule 41(6) of the Fetleral Kules cf Criminal Procedure)
evidence, contraband, fruits, and instrumentalities ofcrimes against the United States, concerning a violation of Title
18
United States code, Sections)
1341 & 1343
The facts to support a finding of Probable Cause are as follows: See Attached Affidavit of Special Joseph R LaMonica, hereby incorporated by reference as if fully restated herein.
Continued on the attached sheet and made a part hereof.
~ Yes
~ No
/ ~,
Si
~
/
tur of Affiant
Sworn to before me, and subscribed in my presence
March 8, 2011 Date
Janice M. Stewart United States Magistrate Judge Name and Title of Judicial Officer
at
Portland, Oregon amity and State
_
Signature of Judicial Officer
Case 3:11-mc-09065
State c~f~nregon
Document 1
Filed 03/08/11
Page 2 of 39
Page ID#: 2
) SS
C~~u~Ity of Multnomah) I, Joseph R. LaMonica, being first duly sworn, depose and say: I am a Special Agent of the I'edcral Bureau of Investigation (FBI), t;nited States Department of Justice, and have been employed in this capacity for 19 years. I am currently assigned to the Pr~i-tland, Oregon, office of the FBI. I am currently assigned to the White Collar Crime Squad, where my duties include the investigation of fraud, including Mail Fraud, Fraud by Wire, Bank Fraud and other federal violations. 2.
This afftdavit is submitted in support of an Application for Search Warrant for
evidence, contraband, fruits, and instc~umentalities of violations of Title 18, United Slates Code, Section 1341, Mail Fraud, and "I_itle 18, United States Code, Section 1343, Fraud by Wire. As set forth below, t have probable cause to believe that such items, as set forth in Attachment B, which is attached hereto and incorporated herein by this reference, are currentl}~ on the premises located at 15825 SW 80th Avenue, Tigard. Ore~un 97224. The premises located at 15825 SW 80th Avenue, ~figard, Oregon 97224 is rnc~re fully described in Attachment A, which is attached hereto and incorporated herein by this reference. 3.
The facts set forth in this affidavit are based on the following: my own personal
knowledge; kn~~wledge obtained from other individuals during my participation in this investigation, including other law enforcement officers: interviews of witnesses; my review of records related to this investigation; communications with others who have knowledge of the events and circumstances described herein; and information gained through my training and experience. Because this affidavit is submitted for the limited purpose of establishing probable AFFIDAVIT -Page 1
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 3 of 39
Page ID#: 3
cause in support of the application for a search warrant, it does not set forth each and ever}' fact that I or others have learned during the course of this investigation. Title 18, United States Code, Section 1341, Mail Fraud, states, in part, that: VJh~e~~er, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises...for the purpose ot~executing such a scheme or artifice or attempting to do so, places in any past office or authorized depository for mail matter, any matter or thing whatever to be sent or delivered by the Postai Service, or deposits or causes to be deposited any matter or thing whatever to he sent or delivered by any private ar commercial interstate carrier, or takes or receives therefrom, any such matter or thing, or knowingly causes to be delivered by mail or such carrier according to the direction thereon, or at the place at which it is directed to be delivered by the person to whom it is addressed, any such matter or thing, shall be tined under tI~is title or imprisoned not more than 20 years, or both. Title 18, United States Code, Section 1343, Fraud by ~~Jire, states that: Whoever, having devised or intending to devise any scheme or artifice to defraud, or for r>btaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose cif executing such a scheme ur artifice, shall be fined or imprisoned not more than 20 years, ~r both. 6.
Based upon the facts set forth in this affidavit, I believe that there is probable
cause that LAWRF,NCE ~I~NRY HEIM devised and executed a scheme to defraud individuals by illegally mailing invoices to the individual and causing then to mail payments to llim for the
nFFIDAVIT -Page 2
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 4 of 39
Page ID#: 4
purchase of gold and silver coins that he did not deliver to them, in violation of Title 18, United States Code, Section 1341, Mail Fraud, and Title 18, United States Code, Section 1343, Fraud by Wire.
SCHEME TO DEFRAUD 7.
The FBI is conducting an investigation of the activities of LAWRENCE HENRY
IIEIM, also known as (a.k.a.) LARRY HEIM. HEIM owned and operated a company known as LJ.S. GOLD &SILVER INVEST:~~ENTS, INC.(USGSI) in Portland, Oregon. The scheme involved HEIM promising to sell gold and silver coins to customers across the country through USGSI. HELM would enter into transactions with customers who would then send checks to HEIM in Portland, Oregon, typically via the U.S. Postal Service. HEIM would typically send Invoices with details of the transaction to his customers via the li.S. Postal Service or- via fax. HL-;IM would deposit the customers' checks into a Wells 1~'argo Bank account under the name USGSI in the llistrict of Oregon. HEIM would not provide the customers with the gold and silver coins that they had purchased. HI~1M we#sometimes promised his customers that he ~.~~~ would send them a refund of their payment, but he c#i~d failed to send refunds to them. 1NVES"I'IGA"1'IV~;(~VE12VlEW 8.
LAWRENCE HENRY HEIM owned and operatcd U.S. GOLD &SILVER
I'~1VF,STMENTS, II~C.(USGSI). As part of his business, HEIM has an Internet wcbsitc (or USGSI at ~vww.tioirs.com/invest. Un the wcbsite, HELM identified himself as the President of~ USGSI, and provided his "calculation" of the future value of gold. HEI'~I promoted a radio program that he hosted, and periodically posted his comments on the status of gold and silver prices. As recently as February 14, 201 1, the wcbsitc instructed readers to "Buy gold and silver AFFIDAVI"C - Pagc 3
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 5 of 39
Page ID#: 5
NOVA': "l~he sell-off may be over. Remember, my calculations say that gold is going to $11,500 per ounce. That is about 8 times where it is right now. Call 800-631-8292 or 503-228-9553 and buy now from U.S (sic) Gold &Silver. It is as easy as a phone call." J.
The ~vww.noirs.com/in~~est. website has recently been shut down, and there is a
notice on it that states "U.S. Gold &Silver Investments. Inc. has been a trusted business partner since 1972. The current economic situation in the U.S. has been devastating for many small businesses, and ours is no exception. We arc not currently accepting new clients, and are working hard to resolve current clients' accounts. Thank you foe your patience. Sincerely, Law7cnce I I. IIeim". John Seeley l0.
On February 28, 2011, I spoke with Michael U. Uhlig, an attoi-~~ey representing
John Seeley. On March 1, 2011, Mr. Uhlig sent me a two-page letter via email with details regarding Seeley's business dealings with LAWRENCE HL,IM. Also attac]ied tc~ the email ~~ere copies of Seeley's documentation of his transactions with USGSI. Uhlig provided the follo~~~ing information t~~ me: Seeley lives in Port Orchard, Washington. Seeley began investing with USGSI in approximately 1998. Seeley has dealt exclusively with HEI'V1 when c~~nducting transactions with USGSI. Seeley has purchased approximately $1 million in ~c~lc1 coins and appr~ximatrly $500,000 in silver from USGSI. As part of their agreement, HEIM was to hold the gold dins and silver for Seeley and pay him an amount of interest for holding it. 11.
Al the instruction of Seeley, over the last 18 months Seeley's daughter, Janet
Ward, leas heen attempting to close Seeley's accounts at USGSI and collect his gild and sil~~er ii~om HEIM. HEIM has obstructed and delayed this process nn several occasic~iis. In early
AFFIDAVIT -Page 4
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 6 of 39
Page ID#: G
February 201 1, Ward spoke with I-IEIM, and he assured her that he was in the process of closing Seeley's accounts. Ward has not been able to contact HELM since then, and she has i~ot received the balance of gold coins and silver HE1M was supposed to provide. USGSI is currently holding 200 Gold Eagle coins and 61 bags of40°io silver that belongs to Seeley. 12.
A review of the docurnentalion provided by Uhlig reveals that beginning no later
than April 2001, USGSI would send Invoices of transactions t~ Seeley at Port Orchard, Washington. These Invoices were received by Seeley via the U.S. Postal Service. Danny McElmoyl 13.
I have spoken to Danny N1cElmoyl, who advised that on our about August 6,
2010, he purchased 100 one ounce Gold Eagle coins at a price of $1,2 8.00 each for a total of
S 125.800 from LARRY HEIM of USGSI. On or about August 6, 2010, McF.lmoyl sent to I[cim, check number 66017 drawn on his business account in the name of McElmoyl Refrigeration, made payable to t1SC'TSI in the amount of ~125,80U.U0. "The check was sent from Tulare, California to HEIM in Oregon. McF,lrnoyl believes that the check was sent to P.O. Box 19435, Portland, Oregon 97280, as that was the only address he had for IJSGSI. McElmoyl then received a USCiSl Invoice number A7734 ~~ia the U.S. Postal Service. The envelope from C 1SG51 had an August 6, 201 U, date and was mailed from zip code 97280. l4.
On ~~r about September 14, 2010, Mc~lmoyf purchased 1,500 one ounce Sil~~er
Fades at $22.36 each for a total ~f $33,540.00 from USGSI. Un September 14, 2010, McElmoyl received a fax of an Invoice'~lumbered A7738 for the purchase of the Silver eagles from USGSI, fax number(503)603-9990. On or about September 15, 2010, McF,lmoyi sent check number 4151 drawn on his personal bank account, made payable to US Gold &Silver Invest~T~ents in the
AFFIDAVIT - Pagc 5
Case 3:11-mo-09065
Document 1
Filed 03/08/11
Page 7 of 39
Page ID#:
amount of $33,540.00. McElmoyl sent the check to IJSGSI through the U.S. Postal Service. 15.
McElmoyl provided me with copies of the two canceled checks that he had sent to
HEIM. A review ~f McElmoyl Refrigeration check number 66017 in the amount of $125,800.00 revealed that it was deposited on August 10, 201 U, at Wells Fargo Bank in Tigard, Oregon, into account number XXX6896280 in the name of i1SGSI. A review of Danny McElmoyl check number 4151 in the amount of $33,540.00 revealed that it vas deposited on September 21, 2010, at Wells Fargo Bank in Tigard, Oregon, into the above-mentioned account in the name of USGSI. As of the date of this affidavit, McElmoyl has neither received the Gold oc Silver eagles that he paid for, nor has he received a refund from USUS1. Tamara Wagner and William Medlock 16.
I have spoken to Tamara Wagner on one occasion and another Special Agent in
my office has spoken to her on another occasion. Wainer advised that c,n or about August 6, 2010, she and her husband, William Medlock, purchased 100 ounces of gold coins from HF.IM. They wrote a check from their Bank of America account payable to USGSI in the amount of $126,000 and mailed it from California t~ HEIM'S P.n. Box in Portland, Oregon. HEIM cashed their check in August 2010, but did not send them the fold coins. After cashing their check, HEIM would call them approximately every two weeks and tell them he was having problems with the mint that made the coins, and that he was trying to work it out. On February 12, 201 1, V~'agner and Niedlock received a call from [IEIM, and he advised them the dispute could nut be resolved. HEIM told them he would fully refund their money plus interest from Aubust 2010. IIe told them he would call on February 18, 201 1, to c~lake arrangements for the refund. HEI~~ did not call Wagner and Medlock on February 18, 2011, and their subsequent attempts to contact
AFFIDAVIT -Pale 6
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 8 of 39
Page ID#: 8
HF,IM have been unsuccessful. As of the date of this affidavit, Wagner and Medlock have not received the gold coins they ordered, or a refund from HE1M. Tlnnalri Fa~~in
17.
1 have spoken to llonald Fazzio on several occasions, and he advised me that in
October 2010, he purchased 140 one ounce Gold eagle coins at a price of $1,427.00 each for a total of $199,780.00 from HEIM at USGSI. On or about October l 9, 201 ~, Fa~~i~ sent to HEIM, check number 4103 drawn on his personal bank account payable to U.S. Gold &Silver in the amount oI'$199,780.00. The coins were to be delivered to Fazzio no later January 18, ?010. ~~azzio mailed the check from Vancouver, Washington to USGSI at P.U. Box 19435, Portland, Oregon 97280. II~CM then mailed USGSI Invoice number A7745 to Fazzio at his residence in Vancouver, Washington. Included with the Invoice was a brochure fur American Eagle Gold Bullion Coins with an address label of U.S. Gold &Silver, P.O. Box 19435, Portland, Oregon 97?80, telephone numbers (800)631-829? and (503) 228-9553 and website address ~~~v~v.noirs.com/invest. 18.
r'azzio provided a copy of canceled check number 4103. According to the
canceled check, on or about October 21, 2010, the check was deposited at Wells Fargo Bank in Tigard, Oregon, into the above-mentioned account in the name of USGSI. Fazzio did not receive the coins from USGSI, and telephonically contacted HEIM on several occasions. HEIM verbally agreed to provide Fazzio with a full refund of $19~,7~0.00. As of the date of this affidavit, Fazzio has not yet received the coins that he purchased or a refund from I IEIM. ether victims 19.
I have also spoken to other individuals or attorneys representing individuals who
nFFIUAVIT -Page 7
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 9 of 39
Page ID#: 9
have purchased gold and/or silver from HIM through USGSI. They have sent their payments to HEIM in Portland, Oregon, and their checks have been cashed by HEIM. They have not received their coins or any refund from HEIM. At this point in the investigation, it is estimated that since August 2010, HEIM has received approximately $2 million in gold and silver coin orders that he has not fulfilled. Patricia Heim
20.
I have spoken to HEIM'S wife, Patricia Heim, who told me that she was the
bookkeeper and secretary for USGSI in the 1980s. HEIM is the sole owner of USGSI, and when the business struggled and he couldn't afford to rent an office any longer, he moved the business into their house in Tigard, Oregon. She moved out of the house in 2002, and has lived on her own since then. Patricia Heim doubts that HEIM wotilcl keep any fold or silver in the house, because it would not be very safe. She believes that he would keep gold or silver in the bank, which is what he has done previously. Wells Fargo Bank 21.
I have reviewed records from Wells Fargo Rank for the account of L?S Gild &
Silver Investments, Inc.(USGSI), account number XXX6896280. According to the records, USGST has two safe deposit boxes. numbered 1585 and 1X86. According to Wells Fargo Bank representatives, these two boxes are both rented in the name of US Vold, they are both very good-sized boxes, they are both located at the Tigard branch of Wells I'argo Bank. I I~IM last entered the safe de~~osit bores on ~lovemher 12, 2008. HEIM'S residence 22.
According to the Oregon Department of Vlotor Vehicle records and public
Af~F1UAV1~1' - Yage 8
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 10 of 39
Page ID#: 10
databases, I3EIM's address is 15825 SW 80th Avenue, Tigard, Oregon 97223. On February 22, 201 1, i went to 1 ~82~ SVV 80th Avemie,'Tigard, Oregon 97224, and knocked nn the door. HELM answered the door, but would not let me enter the residence. Heim would not answer any of my questions and provided me with his attorney's telephone number. 23.
The address HEI\~I used for USGSI on Invoices acid letters v~~as P.O. Box 1943>,
Portland, Oregon 97280. According to the U.S. Postal Inspection Service, that box is physically located at 7805 S W 40th Avenue, Portland, Oregon 17219. According to the a}~plication, Patricia A. Heim applied for the box in the names of U.S. Uold &Silver and Heim lirvestment Services on August 1, 1986. Z'he address listed by Patricia Heim was 720 SW Washington
Street, ~i308, Portland, Oregon 97205. Un February 28, 2011, I went to 720 SW Washington Street, Portland, Oregon and spoke to the building manager. She advised that the company she works for has owned the building since 2008, and HE1M has not had an office in the building during the time they've owned it. She was nit familiar with HEIM or USGSI, bul advised they have received several calls from individuals looking for him there in the last week or two. 24.
On Mardi 7, 2011, I spoke to Robert McCurtain, who has known HEIM for thirty
years, and used to work with him in Portland. McCurtain knows that HF,IM had a~i office in cio~~town Portland many years ago, but believes he has been working out ~f his home. Also, when I sp~~ke to Michael Uhlig regarding John Seeley's transactions with HEIM, he advised me that Seeley's daughter, Janet Ward, would meet HEI'VI at different locations in the Portland area when she picked up the gold and silver from him. "they never met at a single location such as ~~n office for F~EIM. 25.
Based upon my training and eaperience, I know that individuals involved in a
AFFIDAVIT - Pagc 9
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 11 of 39
Page ID#: 11
business or income-producing activity such as the purchase and sale of gold and silver coins, w~i11 keep in their possession and at their residences, some or all of the following types of records: cash, gold and silver coins, account Icdgers, logs of income and expenses, sales invoices, expense invoices, purchase invoices, receipts of business transactions, bank account statements, cancelled checks, bank deposit slips, bank withdrawal slips, check registers, safe deposit box keys and records, asset purchase records, loan and liability records, balance sheets, diaries of business activities, calendars, correspondence, notes and memorandums, emails, phone records, payroll and employment records and ledgers, and journals summarizing business income and expenses. I know that persons engaged in ~~~~~~~~~~~~that operate using cash keep records of their cash transactions. I also know that individuals normally maintain records of their personal financial acti~~ity, such as receipts for expenditures by cash or by check, bank records, and other financial documents. These records often identify co-conspirators, the location oCbank accounts associated with the fraudulent activit}~, and the identifcation of assets which were purchased with fraudulently obtained fl~nds. 26.
1 know that individuals enga~ecl in criminal financial activities, such as mail and
wire fraud schemes, often maintain such records for long periods of time, particularly when they are involved in ongoing criminal conduct over a long period of time. There are many reasons why criminal ofCenclers maintain evidence for long periods of time. The evidence may be innocuous at first glance (i.e. financial, credit card, and barilcing documents, travel documents, receipts, documents reflecting purchases ~~f assets, personal calendars, telephone and address directories, check books, videotapes and photographs, utility records, ownership records, letters and notes, tai returns, and financial records, escrow files, teleph~~ne and eager bills, keys to safe AFFIDAVIT -Page 10
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 12 of 39
Page ID#: 12
deposit boxes, packaging mxteri~tls, computer hardware and software), but have significance and relevance when considered in light of other evidence. The criminal offender may no loner realize he/she possesses the evidence or may believe law enforcement could not obtain a search warrant to scizc the cvidcncc. 27.
Based on my training and experience, I know that individuals who are involved in
criminal financial activities, such as mail and ti~ire fraud schemes, will often keep their fin~incial records at locations they feel are the most private and secure. Often, this location is their personal residence. I also lalow that individuals will go to great measures to hide the location of assets they have acquired as the result of their criminal acti~~ity, often placing assets in nominee names such as corporate entities and trusts, which serve nn pur~~ose but to disguise the true ownership of assets. 28.
Based on my training, experience, and review of the evidence gathered in the
investigation thus far, the items to be seized at the location set forth in Attachment ~1, incorporated herein by reference, for the period beginning January 1, 2000, through the date of~ this warrant, which constitute evidence, contraband, fruits and instrumentalities ~f violati~ils of Title 18, United States Code, Section 1341, Mail Fraud, and Title 18, United States Code, Section 1343, Wire Fraud, include the following: a. Bank/Investment Account Records -All bank account, credit card account, transfer agent and brokerage account records. Thcsc records to include signature cards, cancelled checks, deposit slips, deposit receipts, passbooks, bank statements, certificates of clep~~sit, stocks, bonds, wire transfer advises, wire transfer confirmations, photos of assets, related bank advises, safe deposit box,
AFFIDAVIT - Pagc I 1
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 13 of 39
Page ID#: 13
loan documents, loan applications, Iran payments recrn~ds, cashier's checks, official checks and money order purchases, correspondence, other bank related transaction documents, and any and all documents relating to personal, business, foreign accounts in any foreign or domestic financial institution; b. Cash and currency, including any packaging, bundling or notations, or other ne~utiable instruments as evidence of the mail and wire fraud scheme end the accumulation of proceeds of such scheme; c. Gold and silver coins, including any packaging, bundling or notations; d. Safe deposit box records and safe deposit box keys for airy box iii the names of
LAWP~ENCE HEI,v1, LARRY HIM,and/or USGSI; e. Client/Account Files -All files or folders containing transaction records, including contracts, account statements and transaction summaries, agreements, schedules, invoices, receipts, and statements or other documents evidencing purchases and sales of gold and silver coins;
f. Contractor/Employee Files -All files or folders containing transaction records including employee or independent contractor contracts to perform work ur provide services, account statements and transaction summaries, agreements, schedules, and statements or other documents evidencing salaries or expenses paid and services provided; g. Stock Purchase Agreements -Any contracts or agreements for the purchase, sale or transfer ~f stocks; h. Corporation,~Trust Documents -Any corporation or trust infoi-~ilation, instnictions, AFFIllAVI"I~ - Yagc 12
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 14 of 39
Page ID#: 14
bylaws, corporate resolutions, trust agreements, templates, or literature including documents showing assets, trustees, employees, or independent contractors; i.
Records ~f Receipt of~ Money -Any records of the receipt of funds by check, cash, credit card, money order, cashier's check, wire transfer or securities;
j. Records of Disbursements -Any records of disbursements or invoices to include payments by check, cash, credit card, cashier's check, money order, wire transfer, or securities or the purchase of assets shown by invoices, bills, faxes, or other documents establishing the purpose or recipient of the expenditure, including records of mailing ~r shipping such disbursements; k. Iteeords, information or elocurnents that reflect the receipt and disposition of funds or property, cars, boats, any vehicle,jewelry, artwork, any and all other assets owned and sold; I.
Applic~ti~ns for credit, financial statements, credit files acid all records relating to credit applications, credit accounts, credit cards, loan applications, cash and loans;
m. Records of purchase or dispositions of cashiers checks, money orders, wire transfers and other negotiable instruments; n. Sales journals, general ledgers, general journals, purchase journals, summaries, reconciliations, work papers relating to revenues, ex~~enses, accounts receivable, accounts payable, assets, liabilities, owners equity, purchase ~f goods for resale, depreciation of assets, a~llortization of intangible assets, invent~~ries of goods, materials, supplies and products, payroll information, employees with}wldings, monthly reports and other business bookkeeping and accounting records; o. Invoices, statements, receipts, documents, records or other items that reflect
Ar'FID~VIT -Page 13
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 15 of 39
Page ID#: 15
receipt of income or funds, payment of cxpcnscs or liabilities, accuniulatic~n or disposal of assets and any other item produced reflecting business or income producing transactions; p. Photos, passports, photo identification and other identification for aliases or nominees use by LAWRENCE IIEIM, LARRY HF,iM, and/or USGSI; q. Records of storage lockers and storage locker keys or access codes maintained by LAVVRENC~, HEIM,LARRY II~IM, and/or i;SCTSi; r. Financial statements, including income statements, balance sheets, and statements of retained earnings, and cash flow statements; s. Documents relating to corporate or business history of any assumed business name or entity, including the corporate minute hook, incorporation documents, stock transfer register, and corporate dissolution documents; t. Records, documents, books, files, correspondence, other articles or information relevant to the computation of the federal income tax liability of LAWRENCE HELM, LARRY I I~IM, and/or USCiST; u. Correspondcncc to and from i,AWRF.NCE HEIM, LARRY HEIM, and/or ~~~~~~~~including letters, cards, other written correspondence, facsimiles, e-mails, printed c-mails, taped messages such as answering machine messages, and videos; v. Western Union receipts, i.S. Postal Money Order receipts, and receipts of other money exchanging businesses; ~v. "l~elephone records, cell phone records, including itemized billing and individual toll records, address books, telephone hooks, cell phone telephone and address books, personal digital assistants, and rolc~clex;
AFFIDAVIT -Page 14
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 16 of 39
Page ID#: 16
x. Printout of facsimile transmissions both sent and received concerning LAWRENCE HEIM,LARRY HEIM, and/or USGSI; y. Traveler's checks, copies of traveler's checks receipts, currency (U.S. or foreign); z. Names or other identifiers of persons associated with LAWRENCE HEIM, LARRY HEIM, and/or USGSI, including owners, employees and customers; any independent or employee payment records, employment a}?plicati~ns, personnel service contracts, photographs of employees, all business phones and other electronic phone equipment, including pagers and portable phones, and their contents; any items of identification, receipts from A"l NI purchases; aa. IRS Records/Correspondence -Any tax returns or correspondence with the IRS including notices and letters from the IRS, iiicludiil~ copies of federal and state income tax returns for trusts, corporations, and limited liability companies and related tax preparation documents such as forms 1099, W-2 forms, Forms 11205, Forms K-1, Forms 1040, Forms 1065, ~~orms 990, ~~orms 941, and documentation or correspondence evidencing dealings with an accountant or tax preparers hb. Records of any bankruptcy filings on behalf of LAWRENCE HEIM,LARRY HEIM, and/or USGSI; Digital Evidence cc. nll computers, including any electronic or digital device capable of storing and/or processing data in digital form, including central processing units; laptop or notebook computers; personal digital assistants; wireless conununication devices such as telephone pa~in~ devices, beepers, and cellular telephones; peripheral input/output devices such as keyboards, printers, scanners, plotters, monitors, and
AFFIDAVIT -Page 15
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 17 of 39
Page ID#: 1 7
drives intended for removable media; related communication devices such as modems, routers, cables, and connections; storage media; and security devices; dd. Any equipment used to facilitate the transmission, creation, display, encoding, or storage of~ digital data; ee. Any magnetic, electronic, or optical storage device capable of storing data, such as floppy disks, hard disks, tapes, CD ROMs,CD-Rs, CD-RWs, DVDs, optical disks, printer or memory buffers, smart cards, PC cards, memory calculators, electronic dialers, and electronic notebooks; ff~. Any documentation, operating logs, and refercncc manuals regarding the operation ofi the digital device or software used in the digital device; fig. An}' applications, utility programs, compilers, interpreters, and other software used to facilitate direct or indirect communication with the digital device; hh. nn}~ physical keys, encryption devices, dongles, and similar physical items that arc necessary to gain access to the digital device or data stored on the digital device; ii. Any passwords, password files, test keys, encryption codes, or other information
necessary to access the digital device or data stored on the digital device; jj. Al] records, documents, programs, applications or materials created, modified, or stored in any form, including in digital form, on any computer or digital device, that show the actual users) of the computers or digital devices during the period between .lanuary 1, 2000, and present, including the web browser's history; temporary Internet ftles; cookies, bookmarked or favorite web pages; email
addresses used from the computer; MAC IDs and/or Internet Protocol addresses
~1FFIDAVI"1, - Yage 16
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 18 of 39
Page ID#: 18
used by the computer; email, instant messages, and other electronic commu~iications; address books; contact lists; records of social networking and online service usage; and software that would allow others to control the digital device such as viruses, Trojan horses, and other fornls of malicious software. Search and Seizure of Digital Data 29. This application seeks permission to search for and seize evidence of the crimes described above, including evidence of how computers, digital devices, and digital storage media were used, the purpose of their usc, and who used them. 30.
Based upon my training and experience, and information related to me by agents
and others involved in the forensic examination of computers and digital devices, I know that data in digital form can be stored on a variety of systems and storage devices, including hard disk drives, floppy disks, compact disks, magnetic tapes, flash drives, and memory chips. SoiY~e of these devices can be smaller than a thumbnail and can take several forms, including thumb drives, secure digital media used in phones and cameras, personal music devices, and similar items. Removal of Data Storage Devices 31.
I know that a forensic image is an exact physical copy of the data storage media.
A forensic image captures all data on the subject media without viewing or changing the data in any way. Absent unusual circumstances, it is essential that a forensic image be obtained prior to conducting any search of data fir itif~rmation subject to seizure pursuant to the warrant. I also know that during the search of the prei~~ises it is not always possible to create a forensic image of or search digital devices or media fur data fur a number of reasons, including the following:
AFFIDAVIT -Page 17
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 19 of 39
Page ID#: 19
a. Searching digital devices can he a highly technical ~~rocess that requires specific expertise and specialized e9uipment. Because there are so many different types of digital devices and software in use today. it is difficult to anticipate all of the ncccssary technical ma~luals, specialized cquipmcnt, and specific cxpertise necessary to conduct a thorough search of the media to ensure that the data will be preserved and evaluated in a useful manner. b. Searching digital devices can require the use of precise, scientific procedures designed to maintain the integrity of the evidence and to recover latent data not readily apparent to the casual user. The recovery oi~such data may require the use of special software and procedures, such as those used in a law enforcement laboratory. c. The volume of data stored on many digital devices is typically so large that it will be highly impractical to search for data during the execution of the physical search of~the premises. Storage devices capable of~ storing 500 gigabytes of data are nov~~ commo»place in desktop computers. It can take several hours, or eve~l days, to image a single hard drive. The larder the drive, the longer it takes. Depending upon the number and size of the devices, the length of time that agents must remain onsite to image and examine digital devices can become impractical. Laboratory Settine Mav Be Essential For Complete And Accurate Analysis Uf Data 32.
Since digital data may be vulnerable to inadvertent modification or destruction, a
controlled envirolunent, such as a law enforcement lab~rat~ry, may he essential to conduct a complete and accurate analysis of the digital devices from which the data will be extracted. Soft~~~are used in a laboratory setting can often reveal the true nature of
~1FF1D~IVIT -Page 18
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 20 of 39
Page ID#: 20
data. Therefore, a computer forensic reviewer needs a substantial amount of time to extract and sort through data that is concealed or encrypted to determine whether it is evidence, contraband, or an instrumentality of a crime. 33.
Analyzing the contents of a computer or other electronic storage device,
even without significant technical difficulties, can be very challenging, and a variety of search and analytical methoels imist be used. For example, searching by keywords, which is a limited text-based search, often yields thousands of hits, each of which must be reviewed in its context by the examiner to determine whether the data is within the scope of the warrant. Merel}~ finding a relevant hit does nit encl the review process. The computer may have stored information about the data at issue which may not be searchable text, such as: who created it; when and ho~v it was created, downloaded, or co~~ied; when it was last accessed; when it was last modified; when it was last printed; and when it was deleted. The relevance of this kind of data is often contextual.
Furthermore, many common email, database, and spreadsheet applications do not store data as searchable text, thereby necessitating additional search procedures. To determine who created, tnuclitied, copied, downloaded, transferred, communicated about, deleted, or printed data requires a search of events that occurred on the computer in the time periods surrounding activity regarding the relevant data. Information about which users logged in, whether users shared passwords, whether a computer was connected to other computers or networks, and whether the users accessed or used other programs or services in the relevant time period, can help determine who was sitting at the keyboard. A.
Lutent Da[a: Searching digital devices can require the use of precise, scientific:
AFFIDAVIT -Pale 19
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 21 of 39
Page iD#: 21
procedures designed to maintain the integrity of the evidence and to recover latent data. 1'he recovery of such data may require the use of special software and procedures. Data that represents electronic files or remnants of such files can be recovered months or even years after it has been downloaded onto a hard drive, deleted, or viewed via the Internet. Even when such files have been deleted, they can be recovered months or years later using readily available forensic tools. Norn~ally, when a person deletes a file on a computer, the data contained in the file does not actually disappear; rather, that data remains on the hard drive until it is overwritten by new data. Therefore, deleted files, or rernnailts of deleted files, may reside in space on the hard drive or other storage media that is not allocated to an active file. In addition, a computer's operating system may keep a record of deleted data in a swap or recovery file or in a program specifically designed to restore the computer's settings in the event of a system failure. B.
Contextual Data:
1. In some instances, the computer "writes" to storage media without the specific knowledge or permission of the user. Generally, data or files that have been received via the Internet are automatically downloaded into a temporary Internet directory or cache. The browser typically maintains a fixed amount of hard drive space devoted to such data or files, and the files are only overwritten as they are replaced with chore recently viewed Internet pales. Thus, the ability to retrieve artifacts of electronic activity from a hard drive depends less on when the file was downloaded or viewed than on a particular user's operating system, storage capacity, and computer usage. Logs of access to wehsites, file managemenUtransfer programs, fire~vall permissions, and other data assist the
AFFIllf1VIT -Pale 20
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 22 of 39
Page ID#: 22
examiner and investigators in creating a "picture" of what the computer was cloin~ and how it was being used during the relevant time in question. Given the inlen-elationships of the data to various parts of the computer's operation, this information cannot be easily segregated. 2. Digital data on the hard drive that is not currently associated with any file may reveal evidence of a file that was once on the hard drive but has since been deleted or edited, or it could reveal a deleted portion of a file (such as a paragraph that has been deleted from a word processing file). Virtual memory paging systems can leave digital data on the hard drive that show what tasks and processes on the computer were recently used. Web browsers, email programs, and chat programs store configuration data nn the hard drive that can reveal information such as online nicknames and passwords. Operating systems can record additional data. such as the attachment of~periphcrals, the attachment of US~3 Clash storage
devices, and times the computer was in use. Computer file systems can record data about the dates files were created and the sequence in which they were created. This data can be evidence of a crime, indicate the identity of the user of the digital device, or point toward the existence of evidence in other locations. Such data may' also lead to exculpatory evidence. 3. Further, evidence of how a digital device has been used, what it has been used for. and who has used it, may he learned fi~oin the absence of particular data on a digital device. Specifically, the lack of computer securit~~ software, virus protection, malicious software, evidence of remote control by another computer system, or other programs or software may assist in identifying the user indirectly
AFFIDAVIT -Page 21
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 23 of 39
Page ID#: 23
and may provide evidence excluding other causes fc.~r the presence or absence of the items sought by this application. Additionally, since computer drives may store artifacts from the installation ~f software that is no loner active, evidence ot~ the historical presence of the kind of software and data described may have special. significance in establishing timelines of usage, confirming the identification ~f ~~~~~~~~~users, establishing a point of ~~~~~~~~~~~for usage and; in some cases, assisting in tl~e identification of certain users. This data can be evidence of a crime, can indicate the identity of the user of the digital device, or can ~~oint toward the existence of evidence in other locations. Such data may also lead to exculpatory evidence. Evidence of the absence of particular data on the drive is not generally capable of being segregated from t}~e rest of the data on the drive. Search Procedure 34. In searching for data capable of being read, stored, or interpreted by a computer or storage device, law enforcement personnel executing the search warrant will employ the following procedure: a. On-site search, ifproctic~ahle. Law enforcement officers trained in computer forensics (hereafter, "computer personnel"), if present, may be able t~ cletennine ii~ digital devices can be searched on-site in a reasonable amount of time and without je~pardi~ing the ability to preserve data on the devices. If such an on-site search can be conducted, the reviewing persoru~el will attempt to seize data falling within the list of items to be seized as set forth in the warrant and in Attachment ~3. b. Un-site ima~7ing, iTJ~rncticahle. If a digital device cannot be searched o~1-site as
AFFIDAVIT -Page 22
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 24 of 39
Page ID#: 24
described above, the computer personnel will determine whether the device can be imaged ~n-site in a reasonable amount of time without jeopardizing the ability to preserve the data. c. Seizure ofdigital devicesfnr oJf-site imaging and search. Tf no computer personnel are present at the execution of the search warrant, or if they determine that a digital device cannot be searchec3 or imaged on-site in a reasonable amount of time and without jeopardizing the ability to preserve data, the digital device will be seized and transported to an appropriate law enforcement laboratory for rcvtcw. cl. I,aw enforcement personnel will examine the digital device to extract and seize anv data that falls within the list of items to he seized as set forth in the warrant and in Attachment B. T'o the extent they discover data that falls outside the scope
of the warrant that they believe should be seized (e.g., contraband or evidence of other crimes), they will seek an additional warrant. e. I.aw enforcement personnel will use procedures designed to identify items to be seised under the warrant. "These procedures may include the use of a "hash value" library to exclude normal operating system files t}iat do not need to be seai•clled. In addition, law enforcement personnel may search for and attempt to recover deleted, hidden, or encrypted data to determine whether the data falls ~~~ithin the list of items to be seized under the warrant. f. If the digital device was seized or imaged, law enforcement personnel will perform an initial search the original digital device or image within a reasonable amount of time not to exceed 120 days from the elate of execution of the warrant.
AFFiI~AVIT -Page 23
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 25 of 39
Page ID#: 25
If, after conducting the initial search, law enforcement personnel detern~ine that an original digital device contains any data falling ~vit}iin the list of items to be seized pursuant to this warrant, the government will retain the original cligital device to, among other things, litigate the admissibility/authenticity of the seized items at trial, ensure the integrity of the copies, ensure the adequacy of chain of custody, and resolve any issues regarding contamination of the evidence. If the government needs additional time to determine whether an rn-iginal digital device ur ~~~~~~~contains any data falling within the list of items to be seized pursuant to this warrant, it may seek an extension of the time period from the Court within the original 120-day period from the date of execution of the warrant. The government shall complete the search of the digital device or image within 180 days of the date of the execution of the warrant. 1f the ~~vernment needs aciclitional time to complete the search, it may seek an extension of the time period from the Court within the original 180-day period from the date of the execution of the warrant. g. If, at the conclusion of the search, law enforcement personnel determine that particular tiles or file folders on an original digital device or irTlage do not contain any data falling within the list of items to be seized pursuant to the warrant, they will not search ur examine those files or folders further without authorization from the Court. Law enforcement personnel may continue to examine files or data falling within the list of items to be seii.ed pursuant to tkzc warrant, as well as data within the operating system, file system, or softwa~~e application relating or pertaining to files or data falling within the list of itetms to be seized pursuant to
AFFIDAVIT -Page 24
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 26 of 39
Page ID#: 2G
the warrant (such as log files, registry data, and the like), through the conclusion of the case. h. If an original digital device does not contain any data falling within the list of items to be seized pursuant to this warrant, the government will return that original data device to its o~mer within a reasonable period of time following the search of that original data device and will seal any image of the device, absent further authorization from the Court. Data to be Seized 35. In order to search for data that is capable of being read or interpreted by a computer, law enforcement personnel will need to seize, image, copy, and/or search the following items, subject to the procedures set forth herein: a. Any computer equipment or digital devices that are capable of being used to commit or further the crimes outlined above, or to create, access, or store the types of evidence, contraband, fruits, or instrumentalities of such crimes, as set forth in Attachment B; b. Any computer equipment or digital devices used to facilitate the transmission, creation, display, encoding, or storage of data, including word processing equipment, modems, docking stations, monitors, printers, plotters, encryption devices, and optical scanners that are capable of being used to commit or further the crimes outlined above, or to create, access, process, or store the types of evidence, contraband, fruits, or instrumentalities of such crimes, as set forth in Attachment B; c. Any magnetic, electronic, or optical storage device capable of storing data, such as
AFFIDAVIT -Page 25
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 27 of 39
Page ID#: 27
Iloppy disks, hard disks, tapes, CD-ROVIs, CD-Rs, CD-RWs, DVDs, optical disks, printer or memory buffers, smart cards, PC cards, memory calculators, electronic dialers, electronic notebooks, personal digital assistants, and cell phones capable of being used to commit or further the crimes outlined above, or to create, access, or store the types of evidence, contraband, fruits, or instrumentalities of such crimes, as set forth in Attachment B; d. Any documentation, operating logs, and reference manuals regarding the operation of the computer equipment, storage devices, or software; e. Any applications, utility programs, compilers, interpreters, and other software used to facilitate direct or indirect communication with the computer hardware, storage devices, or data to be searched; f. Any physical keys, encryption devices, dongles, or similar physical items that are necessary to gain access to the computer equipment, storage devices, or data: and ~. Any passwords, password files, test keys, encryption codes, or other information necessary to access the computer equipment, storage devices, or data. h. All records, documents, programs, applications or materials created, modified, or stored in any form, including in digital form, on any computer or digital device, that show the actual users) of the computers or digital devices during the time period between January 1, 2000, and present, including the web browser's history; temporary Internet files; cookies, bookmarked or favorite web pages; email addresses used from the computer; MAC IDs and/or Internet Protocol addresses used by the computer; email, instant messages, and other electronic communications; address books; contact lists; records of social networking and
AFFIDAVIT -Page 26
Case 3:11-mc-09065
Filed 03/08/11
Document 1
Page 28 of 39
Page ID#: 28
online service usage; and software that would allow others to control the digital device such as viruses, "l~rojan horses, and other fornis of malicious software. 36. The goverrunent has made the following prig efforts in other judicial fora to obtain the evidence sought in the warrant: knowledge obtained from other law enforcement officers; issuance of grand jury subpoenas; my review of financial records related to the investigation; and information gained through my training and experience. Retention of Image 37. The government will retain a forensic image of each electronic storage device subjected to analysis for a number of reasons, including pr~~ving the authenticity of evidence to be used at trial; responding to questions regarding the corruption of data; establishing the chain of custody of data; refuting claims oC fabricating, tampering, or destroying data; and addressing potential exculpatory evidence claims where, for example, a defendant claims that the government avoided its obligations by destroying data or returning it to a third party. Inventory and Return 38.
Vb'ith respect to the seizure of electronic storage media or the seizure or imaging
of electronically stored information, the search warrant return to the Court will describe the physical storage media that were seized or imaged. Conclusion 39.
Rased on the foregoing, 1 have probable cause to believe that T,AWRENC~ II.
HF,ivi, also known as LARRY H~;1M, devised and intended to devise a material scheme to defraud the above listed individuals, and others, in violation of Title 18, United States C~~cie, Section ]341, Mail Fraud and Title 18, United States Code, Section 1343, Fraud
AFFIDAVIT -Page 27
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 29 of 39
Page ID#: 29
by Wire, and that F,vidence, Contraband, Fruits and Instn~mentalities of those offenses, as more fully described in Attachment B hereto, are presently located at 15825 SW 80'° Avenue,"l~igard, Oregon 97224, more fully described in Attachment A. 1 therefore request that the court issue a warrant authorizing a starch of the premises for the items listed in Attachment B, and the seizure and examination of any such items found. This affidavit, the accompanying application, and the requested search warrant were all reviewed by Assistant United States Attorney(AUSA) Claire M. Fay prior to being submitted to the court. AUSA Fay informed me that in her opinion, the afrdavit and application are legally and factually sufficient t~ establish probable cause to support the issuance ~f the requested warrant.
R. LAMONICA U 'E ~cial Agent -FBI Subscribed and sworn to before me on this ~dav of March, 2011.
Z~' C The onorable anice M. Stewart U. .Magistrate Judge Portland, Oregon
AFFTI~AVIT -Page 28
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 30 of 39
Page ID#: 30
Al"1'ACH'VIENT A Location to be Searched Based on the information contained in this affidavit, I am requesting a warrant to search the following location: "rhe property located at 15825 SW 80th A~~enue, "Tigard, Oregon 97224; described as a two-story residence, beige with teal trim, a brown front door that faces east and the numbers "1 ~ 825" on the garage.
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 31 of 39
Page ID#: 31
ATTACHMENT 13 Items to be Searched For, Seized, and F,xamined The items to be seined are the following books and records, documents, con~espondence, equipment, tiles and other information pertaining to LAWRENCE HF.,[M, aka LARRY HEIM, and USUSI and found in the location set forth in Attachment A, incorporated herein by reference, for the period beginning January 1, 2000, through the date of this wan-ant, which constitute evidence, contraband, fruits, aricl/or instrumentalities of violations of Title 1 R, united States Code, Section 1341, Wire Traud; and Title 18, United States Code, Section 1343, Wire Fraud: a.
f3ank/Investment Account Records -All bank account, credit card account,
transfer agent and brokerage account records. These records to include signature carcjs, cancelled checks, deposit slips, deposit receipt~, passbooks, bank statements, certificates of deposit, stocks, bonds, wire transfer advices, wire transfer confirmations, photos of assets, related hank advices, safe deposit box, loan documents, loan applications, loan payments records, cashier's checks, official checks and money order purchases, correspondence, other bank related transaction documents, and any and all documents relating to personal, business, foreign accounts in any foreign or domestic financial institution; b.
Cash and currency, including any packaging, bundling or notations, or other
negotiable instruments as evidence of the mail and wire fraud scheme and the accumulation cif proceeds of such scheme; c.
Gold and silver coins, including any packaging, bundling or notations;
d.
Safe deposit box records and safe deposit box keys for any box in the names ~f
LAWRENCE HEIM, LARRY HEIM, and/or i1SGSI; e.
Client/Account Files -All files or folders containing transaction records,
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 32 of 39
Page ID#: 32
including contracts, account statements and transaction summaries, agreements, schedules, invoices, receipts, and statements or other documents evidencing purchases and sales of gold and silver coins; Contractor/Employee Files -All files or folders containing transaction records
f.
including employee or independent contractor contracts to perform work or provide services, account statements and transaction summaries, agreements, schedules, and statements or other documents evidencing salaries ~r expenses paid and services provided; Stock Purchase Agreements -Any contracts or agreements for the purchase, sale.
g.
or transfer of stocks; h.
Corporation/Trust Documents -Any corporation or trust information, instructions,
bylaws, corporate resolutions, trust agreements, templates, or literature including documents slowing assets, trustees, employees, ~r independent contractors; Records of Receipt of Money -Any records of the c-eceipt of funds by check, cash, credit card, money order, cashier's check, wire transfer or securities; j.
Records of Disbursements -Any records of disbursei~lents or invoices to include
payments by check, cash, credit card, cashier's check, money order, wire transfer, or securities or the purchase of assets shown by invoices, bills; faxes, or other documents establishing the purpose or recipient of the expenditure, including records of mailing or shipping such disbursements; k.
Records, information or documents that reflect the receipt and disposition of
binds or prope~y, cars, boats, any vehicle,jewelry, artwork, any and all other assets owned and sold; Applications for credit, financial statements, credit files and all records relating to
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 33 of 39
Page ID#: 33
credit applications, credit accounts, credit cards, loan applications, cash and loans; m.
Records of purchase or dispositions of cashiers checks, money orders, wire
transfers and other negotiable instruments; n.
Sales journals, general ledgers, general journals, purchase jotimals, summaries,
reconciliations, work papers relating to revenues, expenses, accounts receivable, accounts payable, assets, liabilities, owners equity, purchase of goods for resale, depreciation of assets, amortization of intangible assets, inventories of goods, materials, supplies and products, payroll information, ernployees withholdings, monthly reports and other business bookkeeping and accounting records; Invoices, statements, receipts, documents, records or other items that reflect receipt of income or funds, payment of expenses or liabilities, accumulation or disposal of assets and any other item produced reflecting business or income producing transactions; p.
Photos, passports, photo identification and other identification for aliases or
nominees rise by LAWRENCE HEIl~1, LARRY HEIM, and/or USGSI; Records of storage lockers and storage locker keys or access codes maintained by LAWRENCE HEIM, LARRY HEIM, and/or USGSI; Financial statements, including income statements, balance sheets, and statements of retained earnings, and cash flow statements; s.
Documents relating to corporate or business history of any assumed business
name or entity, including the corporate minute book, incorporation documents, stock transfer register, and corporate dissolution documents; Records, documents, books, files, correspondence, other articles or information relevant to the computation of the federal income tax liability of LAWRENCE HEM,LARRY
H~1M, and/or USGSI;
Case 3:11-mc-09065
u.
Document 1
Fred 03/08/11
Page 34 of 39
Page ID#: 34
Correspondence to and from LAWRENCE HEIM, LARRY HELM, and/or
USGSI, including letters, cards, other written correspondence, facsimiles, e-mails, printed e-mails, taped messages such as answcrin~ machine messages, and videos; v.
Western Union receipts, U.S. Postal Money Order receipts, and receipts of other
money exchanging busi~iesses; w.
Telephone records, cell phone records, including itemized billing and individual
toll records, address books, telephone books, cell phone telephone and address books, personal digital assistants, and rolodex; x.
Printout of facsimile transmissions both sent and received concerning
LAWkENCE HEIM,LARRY HELM,and/or USUSI; y.
Traveler's checks, copies of traveler's checks receipts, currency (U.S. ar foreignl;
z.
Names or other identifiers of persons associated with LAWKENCL HEIM,
LARRY HEIM, and/or USGSI, including owners, employees and customers; any independent or employee payment records, employment applications, personnel service contracts, photographs of employees, all business phones and other electronic phone equipment, including pagers and portable phones, and their contents; any items of identification, receipts from A1~M purchases; aa.
IRS Records/Correspondence -Any tax returns or correspondence with the IRS
including notices and letters from the IRS, including copies of federal and state income tax returns for trusts, corporations, and limited liability companies and related tax preparation documents such as farms 1099, W-2 foetus, Forms ] 120S, Forms K-1, corms 1040, Forn~s 106.5, Forms 990, Forms 941, and documentation or correspondence evidencing dealings with an accountant or tax preparers bb.
Records of any bankruptcy filings on behalf ofI.AWRENCF, HEIM, LARRY
H~IVI, and/or USGSI;
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 35 of 39
Page ID#: 35
Digital Evidence cc. All computers, including any clectronic or digital device capable of storing and/or processing data in digital form, including central processing units; laptop or notebook computers; personal digital assistalits; wireless communication devices such as telephone paging devices, beepers, and cellular telephones; peripheral input/output devices such as keyboards, printers, scanners, plotters, monitors, and drives intended for removable media; related communication devices such as modems, routers, cables, and connections; storage media; and security devices; dd. Any equipment used to facilitate the transmission, creation, display, encoding, or storage of digital data; ee. Any magnetic, electronic, or optical storage device capable of storing data, such as floppy disks, hard disks, tapes, CD ROMs, CD-Rs, CD-RWs, DVDs,opticzl disks, printer or memory buffers, smart cards, PL cards, memory calculators, electronic dialers, and electronic notebooks; ff. Any documentation, operating logs, and reference manuals regarding the operation cif the digital device or software used in the digital device; gg. Any applications, utility programs, compilers, interpreters, anc3 other software used to facilitate direct or indirect communication with the digital device; hh. Any physical keys, encryption devices, donglcs, and similar physical items that are necessary to gain access to the digital device or data stored on the digital device; ii. Any passwords, password files, test keys, encryption codes, or other infornlation necessary to access the digital device or data stored on the digital device; jj. All records, documents, programs, applications or materials created, modified, or
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 36 of 39
Page ID#: 36
stored in any form, including in digital form, on any computer or digital device, that show the actual users) of the computers or digital devices during the period between January 1, 2000, and present, including the wcb browser's history; temporary Internet files; cookies, bookmarked or favorite web pages; email addresses used from the computer; MAC Ills and/or Internet Protocol addresses used by the computer; email, instant messages, and other electronic communications; address books; contact lists; records of social networking and online service usage; and software that would allow others to control the digital device such as viruses, Trojan horses, and other forms of malicious sofrware. Search Procedure kk. In searching for data capable of being read, stored, or interpreted by a computer or storage device, law enforcement personnel executing the search warrant will employ the following proced~il-e: On-site search, ifpracticable. Law enforcement officers trained in computer forensics (hereafter,'`computer personnel"), if present, may be able to determine if digital devices can be searched on-site in a reasonable amount of time and without jeopardizing the ability to preserve data on the devices. Any device searched on-site will be seized only if it contains data falling within tl~e list of items to be seized as set forth in the warrant and in Attachment B. 2.
Un-site imaging, ifpracticable. If a digital device cannot be
searched on-site as described above, the computer personnel, if present, ~~~ill determine whether the device can be imaged nn-site in a reasonable amount of~ time without jeopardizing the ability to preserve the data. 3.
Seizure oJdigital devicesfor off-site imaging and search. If no
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 37 of 39
Page ID#: 37
computer personnel are present at the execution of the search warrant, or if they determine that a digital device cannot be searched or imaged on-site in a reasonable amount cif time and without jeopardizing the ability to preserve data, the digital device will be seized and transported t~ aii appropriate law enforcement laboratory for review. 4.
Law enforcement personnel will examine the digital device to
extract and seize any data that falls within the list of items to be seized as set i'orth in the warrant and in Attachment B.
To the extent they disco~~er data that falls
outside the scope of the warrant that they believe should be seized (e.g., contraband or evidence of other crimes), they will seek an additional warrant. 5.
I,aw enforcement personnel will use procedures designed to
identify items to be seized under the warrant. These procedures may include the use of a "hash value" library to exclude normal operating system files that do not need to be searched. In addition, law enforcement personnel may search for and attempt to recover deleted, hidden, or encrypted data to determine whether the data falls within the list of items to be seined under the warrant. 6.
If the digital device was seized or imaged, law enforcement
personnel will perform an initial search of the original digital device or image within a reasonable amount of time not to exceed 120 days from the date of execution of the warrant. If after conducting the initial search, law enforcement personnel determine that an original digital device contains any data falling within the list of items to be seized pursuant to this w~-rant, the government will retain the original digital device to, among other things, litigate the admissibility/authenticity of the seized items at trial, ensure the integrity of the
Case 3:11-mc-09065
Document 1
Filed 03/08/11
Page 38 of 39
Page ID#: 38
copies, ensure the adequacy of chain of custody, and resolve any issues regarding contamination of the evidence. If the govercunent needs additional time to determine whether an original digital device or image contains any data falling within the list of items to be seined pursuant to this warrant, it may seek an extension of the time period from the Court within the original 120-day period from the date of execution of the warrant. The government shall complete the search of the digital device or image within 180 days of the date of execution of the warrant. If the government needs additional time to complete the search, it may seek an extension of the time period from the Court within the original 180day period from the date of execution of the warrant. 7.
If, at the conclusion of the search, law enforcement personnel
determine that particular files or file folders on an original digital device or image do not contain any data falling within the list of items to be seized pursuant to the warrant, they will not search or examine those files or folders further without authorisation from the Court. Law enforcement personnel may continue to examine files or data falling within the list of items to be seined pursuant to the warrant, as well as data within the ~~~~~~~~~~~system, file system, or software application relating or pertaining tc~ files or data falling within the list of items to be seized pursuant to the warrant(such as Iog file, registry data, and the like), through the conclusion of the case. 8.
If an original digital device does not contain any data falling within
the list of items to be seized pursuant to this warrant, the government will return that original data device to its owner within a reasonable period of time followinb the search of that original data device and will seal any image of the device,
Case 3:11-mc-09065
Document 1
Filed 03/08/11
absent further authorization from the Court.
Page 39 of 39
Page ID#: 39
