Search Warrant - August 2013

CLERK'S OFFICE U
.s. Djsx cour AO 106 (Rev

.04/10) Application for a Search Warrant
FILED
U NITED STATES D ISTRICT COURT Akg 2 ! 20
for the x u ou uux cuu
W estena District of Virginia BY;
tl-rY CLERK
ln the Matter of the Search of
(Briefly describe the property to be searched
or ident# the person by name and address)
1057 Bill Tuck Highway, Building B,
Suite 239 and Suite 217
South Boston, Virginia 24592
.
134 T z/ C
ase No. .
APPLICATION FOR A SEARCH W ARM NT
1, a federal law enforcement oftice!- or an attorney for the government, request a search warrant and state under
penalty of perjury that l have reason to belleve that on the following person or property (identh the person or describe the
property to be searched and give its locationl:
See Attachment A
located in the Western District of Virginia , there is now concealed (identh the
person or describe the property to be seizedll
See Attachment B
The basis for the search under Fed. R. Crim. P. 41(c) is (checkone or morel'.
V evidence of a crime',
Vcontraband, fruits of crime, or other items illegally possessed;
Yproperty designed for use, intended for use, or used in committing a crime;
O a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section
18 U.S.C. j 2342 (b)
18 U.S.C. j 1957
26 U.S.C. j 5762(a)(3)
The application is based on these facts:
see attached affidavit, Attachment A
# Continued on the attached sheet.
Offense Description
Contraband Cigarette Trafficking Act
Money Laundering
Tax Evasion
O Delayed notice of days (give exact ending date if more than 30 days: ) is requested
under l 8 U.S.C. j 3 l 03a, the basis of which is set forth on the attached sheet.
/
Applicant 's signature
' eq G IGTGAJS spigctwt- h%c+ar
Printed name and title
Sworn to before me and signed in my presence.
Date: 7 /
v I-'Q /2
F
City and state: Roanoke, Virginia
Judge 's nknature
Robert S. Ballou, United States Magistrate Judge
Printed name and title
Case 7:13-mj-00101-RSB Document 1 Filed 08/21/13 Page 1 of 15 Pageid#: 1
CLERKS OFFICE U,S. DISX COUG
AT ROANOKE, VA
FILED
ALC 2 1 2913
JUL DU LEY CLERK
BY;
PUTY CLERK
IN THE UNITED STATES DISTRICT COURT
FOR THE W ESTERN DISTRICT OF VIRGINIA
IN TllE M ATTER OF THE SEARCH OF;
The Premises at
1057 Bill Tuck Highway, Building B, Suites 239 and 217
South Boston, Virginia 24592
) V:13$ Tll
AFFIDAVIT IN SUPPORT OF SEARCH W ARRANT
1, Special Agent Robert E. M artens, being duly sworn herby depose and say:
INTRODUCTION
I have been employed as a Special Agent (SA) with the lnternal Revtnue Service (IRS),
Crim inal lnvestigation Division for 9 years. For the last approximately 2.5 years, l have
been detailed to the Alcohol Tobacco Tax and Trade Bureau (TTB). As a Special Agent
with lRS my duties include, but are not lim ited to, conducting criminal investigations
concerning violations of the Internal Revenue Code, money laundering, the bank secrecy
act, and m ore recently violations regarding tobacco diversion including the Contraband
Cigarette TrafGcking Act.
2. As a result of m y personal participation in the investigation of matters referred to in this
affidavit, l am fam iliar with the facts and circumstances of this investigation. On the
basis of personal observation, as well as familiarity, I have determined the following:
For the past 12 months your affiant has been involved in an investigation of Kathryn C.
Farley, CB Holdings LLC, Firebird M anufacturing LLC, a cigarette m anufacturing in the
W estern District of Virginia, and Cherokee Tobacco Company LLC, for a conspiracy to
fail to pay the Federal excise tax on cigarettes that Firebird M anufacturing LLC
manufactures. Based on my investigation, there is probable cause to believe that Kathryn
C. Farley, President of both Firebird M anufacturing LLC and Cherokee Tobacco
Company LLC, owned by CB Holdings LLC is involved in a conspiracy to commit wire
fraud, conspiracy to com mit money laundering, and conspiracy to violate the Contraband
tl d
.
/ > .J'
Cigarette Trafficking Act. Your affiant bases this affidavit upon personal knowledge,
information obtained from the review of official records, public records, and information
filed with TTB.
4. This affidavit is submitted in support of an application for a search warrant for Firebird
M anufacturing LLC and Cherokee Tobacco Company LLC, 1057 Bill Tuck Highway,
Building B, South Boston, Virginia 24592; and 1057 Bill Tuck Highway Suite 239,
South Boston, Virginia 24592, which is further described in Attachment A.
BACK GROUND
The Alcohol Tobacco Tax and Trade Bureau (TTB) administers and enforces laws and
TTB regulations pertaining to producing tobacco products and for collecting excise taxes
on tobacco.
6. The Contraband Cigarette Trafticking Act (CCTA) requires that any person who sells,
ships, transfers or otherwise disposes of more than 10,000 cigarettes in a single
transaction maintain records of the transaction that state the full name of the purchaser,
the street address (including city and sute) to which the cigarettes were destined, and the
quantity of the cigarettes in question. The CCTA makes it illegal for any person
knowingly to make any false statement or representation with respect to the information
required to be kept in the records of any person who ships, sells, or distributes any
quantity of cigarettes in excess of l 0,000 in a single transaction.
7. Proper and truthful record keeping and documentation as mandated by federal law and
regulations are essential to enable TTB to perform its function with regard to record
keeping of operations and transactions by cigarette manufacturers. False record keeping
impedes perform ance of TTB'S function and unduly hinders the effective administration
ofjustice.
8. It is unlawful under Federal law to conspire to impede a federal agency's perform ance of
its function or unduly hinder the administration of justice, falsify records or make false
statements concerning a matter under thejurisdiction of a federal agency, including IRS
and TTB, evade Federal Cigarette Excise Taxes or to use the mails or wires in
furtherance of a scheme to defraud.
9. Firebird M anufacturing, LLC, is a corporation organized and existing under the laws of
Virginia, and has manufactured Cherokee brand cigarettes since purchasing the
manufacturing facility from Virginia Brands, LLC, in early 2010. Firebird
M anufacturing, LLC, has also manufactured Sem inole and Palmetto brand cigarettes
2 /
yu /
(
/ $J?
during that time frame. Firebird is located at 1057 Bill Tuck Highway, Building B, South
Boston, Virginia 24592, within the W estern District of Virginia. Cherokee Tobacco LLC
is a wholesaler of tobacco products and is located at 1057 Bill Tuck Highway, Suite 239,
South Boston, Virginia 24592, within the W estern District of Virginia.
10. Firebird Manufacturing is a TTB permitted Manufacturer of Tobacco Products (MTP),
permit number TP-VA-15004.
l 1. Title 26, United States Code, j 5701(b) imposes a tax on tobacco products manufactured
in the United States. On cigarettes weighing not more than 3 pounds per thousand, the
tax is $50.33 per thousand, or $10.066 per carton.
12. In 1998, forty-six states and six territories entered into a M aster Settlement Agreement
(MSA) with several major cigarette manufacturers. The parties intended the settlement to
end further litigation between state governm ents and cigarette manufacturers. As part of
the settlement, the states released the manufacturers from past and future liability in
exchange for the m anufacturers' agreement to abide by advertising and promotional
restrictions and to m ake annual moneury payments to the states based on annual cigarette
sales. Under the settlement, the manufacturers' payments to the States were subject to
reduction based on lost market share, but the paym ent was not reduced if the State
enacted and enforced a Iaw that required cigarette manufacturers that were not parties to
the Master Settlement Agreement (Non-participating Manufacturers) to make specifed
annual deposits into an escrow fund based on the number of the m anufacturer's cigarettes
sold in the state, as measured by state excise taxes applied to such cigarette sales. The
states' Iaws also required that such manufacturers file annual certifications truthfully
stating that the required escrow deposits were made.
l3. Firebird Manufacturing LLC, is a Non-participating Manufacturer (NPM) of the
Cherokee cigarette brand for a related company, Cherokee Tobacco Company, and
several private label brands of cigarettes, cigars and pipe tobacco. In order to be
profitable, Cherokee cigarettes sold to wholesalers in M SA states must include escrow
payments in the sale price to wholesalers who will stamp and sell Cherokee cigarettes.
14. Title 26, United States Code, j 5703(a)(1) provides that the manufacturer or importer of
tobacco products and cigarette papers and tubes shall be liable for the taxes imposed
thereon by Section 5701 .
15. Title 26, United States Code, j 5703(b)(1) provides that the taxes imposed by Section
5701 shall be determ ined at the tim e of removal of the tobacco products and cigarette
papers and tubes, that such taxes shall be paid on the basis of a return, that the Secretary
3
o/
?
('% ylM
shall, by regulations prescribe the period or the event for which such return shall be made
and the information to be furnished on such return.
16. Title 26, United States Code, j 57624a) states that whoever, with the intent to defraud the
United States:
(2)...Fai1s to keep or make any record, return, reporq or inventory, or keeps or makes
any false or fraudulent record, return, report, or inventory required by this chapter or
regulations thereunder; or
(3)...Refuses to pay any tax imposed by this chapter, or attempts in any manner to
evade or defeat the tax or the paym ent thereof; or
(4)...Removes, contrary to this chapter or regulations thereunder, any tobacco
products or cigarette papers or tubes subject to tax under this chapter:
Shall, for each such offense, be fined not more than $10,000, or imprisoned not more
than 5 years or both.
17. Title 26, United States Code, j 5741 , provides that every manufacturer of tobacco
products or cigarette papers and tubes, every importer, and every export warehouse
proprietor shall keep such records in such a manner as the Secretary shall by regulation
prescribe. The records required under this section shall be available for inspection by any
internal revenue officer during business hours.
18. Title 26, United States Code, j 5705, provides that Credit or refund of any tax imposed
by this chapter or section 7652 shall be allowed or made (without interest) to the
manufacturer, importer, or export warehouse proprietor, on proof satisfactory to the
Secretary that the claimant manufacturer, importer, or export warehouse proprietor has
paid the tax on tobacco products and cigarette papers and tubes withdrawn by him from
the market; or on such articles lost (otherwise than by theft) or destroyed, by fire,
casualty, or act of God, while in the possession of ownership of the claimant.
19. Title 18, United States Code, j 1957 states: Whoever... knowingly engages or attempts
to engage in a monetary transaction in criminally derived property of a value greater than
$10,000 and is derived from specified unlawful activity.
20. 27 CFR 40.181, provides that every manufacturer of tobacco products m ust keep records
of his operations and transactions which shall reflect, for each day, the information
specified in 40.182 and 40.183. For this purpose day shall m ean calendar day. ..
27 CFR 40.185, Retention of records, provides that al1 records required to be kept under
this part, including copies of authorizations, claims, inventories, notices, reports, returns
4
f-/
$
) P sj t
and schedules, shall be retained by the manufacturer for three years following the close
of the calendar year in which filed or made, or in the case of an authorization, for three
years following the close of the calendar year in which the operation under such
authorization is concluded. Such records shall be kept in the factory or a place
convenient thereto, and shall be made available for inspection by any TTB offker upon
his request.
STATEM ENT OF FACTS
22. Firebird Manufacturing LLC, (Firebird) is a manufacturer of tobacco products located in
South Boston, Virginia that at least from M arch 2010 to July 2013, manufacmred
Cherokee brand cigarettes as well as other cigarettes and filtered cigars. Cherokee
Tobacco Company LLC, is a wholesaler of tobacco products that primarily sells the
cigarettes manufactured by Firebird. During this tim e, Kathryn Farley started as Vice
President and in June 2012 was promoted to President of both Firebird and Cherokee
Tobacco Company LLC. Firebird's manufacturing plant is located at 1057 Bill Tuck
Highway, Building B and Suite 239, South Boston, Virginia, located in the W estern
District of Virginia.
23. Cooperating Witness //1 (CW#1) contacted TTB in June of 2012 and has been and
continues to be a highly reliable source of information. Information provided by CW #1
has been corroborated by records filed with TTB and other cooperating witnesses.
24. On September 14, 201 1 TTB authorized Firebird to destroy 3,792,800 sticks of cigarettes.
After the product was destroyed, Firebird filed a claim of $190,891.62 for the Federal
Excise Tax (FET) on these products.
25. Firebird claimed the cigarettes were returned for a variety of reasons m ostly due to
quality issues on cigarettes m anufactured since Firebird started business in M arch 2010.
26. A TTB Auditor witnessed the destruction on October 7, 201 l . The number of sticks was
reduced to 3,750,760 and the tax amount adjusted to $188,775.75. The claim for a
Federal Excise Tax refund was denied as an audit team did not feel the documentation
supplied was sufficient.
27. After the destruction CW #1 contacted TTB. CW #1 claimed Firebird had planned to
destroy oId product they had not manufactured or paid taxes on, but when TTB wanted to
witness the destruction they changed the product and altered records given to TTB.
28. CW #1 stated that Firebird planned to destroy imported product and old product from the
manufacturer they had purchased. CW #1 stated that once notified TTB would observe
5
43 J' *1
s
/
the destruction the product was switched out for new product and the destruction team
ordered to go slow. Firebird would not have been eligible for a tax refund associated
with the destruction of product manufactured or imported by the previous manufacturer,
to be eligible for a tax refund, Firebird would need to destroy product that they had
manufactured since the purchase of the manufacturing facility in M arch 2010.
29. CW #1 stated that Firebird pulled new product to destroy in order to conceal the old
product they planned to destroy, but the new product they destroyed did not match
invoices from M arch 2010 when they began manufacturing. Firebird destroyed Cherokee
M enthol Gold Kings but the invoices they were planning on using for support had
M enthol Green and M enthol Gold 100s and M enthol Green Kings. CW #l produced
original invoices and altered invoices to show changes that had been made.
30. Firebird's QuickBooks files were obtained during a civil audit conducted by TTB in
November 201 1. The records were kept at the place to be searched. A review of the
QuickBooks's Audit Trail file showed that the invoices provided by CW#1 showed that
the invoices provided by CW #l had been altered on October l2, 20l l , after the TTB
auditor asked for supporting documents.
31 . Starting in November 201 1, the amount of tax reported on and paid per Firebird's tax
returns was less than the amount of tax due based on a calculation of the removals on the
monthly reports.
32. The TTB Monthly Reports, Form 5210.5, are filed and signed, under penalty of perjul.y
by Kathy Farley, and report manufacture and removal information for the manufacturer.
33. CW #1 stated that office personnel prepare the TTB M onthly Reports, Form 5210.5,
based upon the manufacture and removal information provided to CW #1, and provides
the report for filing to Farley.
34. The federal excise tax returns, filed twice a month, and three times in September, are
filed electronically through a user account established by Farley.
35. Using the monthly report of removals filed with TTB the tax due for the month was
recalculated using the Removed Subject to Tax line of the monthly report. This figure
was then reconciled to the tax returns filed by Firebird for the corresponding period. The
figure should match, however since November 201 1 the tax payment has been far less
than the tax Iiability calculated from the m onthly reports.
6
6 #/
i
/ t!#
36. The tax liability associated with the underpaym ent from November 201 1 through July
2013 is approximately 10.8 million dollars.
37. CW #1 also stated that office personnel complete a tax calculation and prepare draft TTB
Excise Tax Returns, which are provided to Farley. CW #1 was able to provide the draft
returns provided to Farley by office personnel for January 2013. The tax liability on the
draft tax returns reconciles with the tax liability of the TTB M onthly report for the period.
CW #1 stated that oftke personnel provide Farley with the draft tax returns based upon
the monthly report.
38. 1 approached CW #2 in approximately October 2012.
information in the past to multiple federal agencies.
business.
CW #2 has provided reliable
CW #2 operates a tobacco wholesale
39. CW #2 has been providing documentary evidence as well as conducting consensually
monitored phone calls on our behalf. Additionally CW #2 has met face to face with
Farley in a monitored situation.
40. CW #2 operates in states that participate in the M SA. The M SA fee is approximately
$5.80 a carton. The Federal Excise Tax is approximately $10.06 per carton. Thus if
Federal Taxes and the M SA are paid, the regulatory costs and taxes on a carton of
cigarettes is at least $15.86 a carton.
41. ln August of 2012 Kathy Farley offered to sell cartons of Cherokee cigarettes to CW #2
for $16 a carton. After three sales totaling 8,220 cartons, the price was reduced to $15 a
carton.
42. For a1I the sales to CW#2 at $15 and $16 a carton, Farley created false documents to hide
the true price. Farley invoiced CW#2 at a higher price, for example $19.95 a carton, then
issued a credit memo to the company to reduce the price to approximately $1 8.25. Farley
then drafts CW#2's account for a cost of approximately $1 8.25 a carton. Farley later
wires funds back to CW #2 to reduce the effective price to $15 a carton.
43. Between August 1, 2012 and June 6, 2013 Farley sold cigarettes to CW #2 using the false
invoicing schem e to sell cigarettes below the regulatory cost creating at least 32 false
invoices, for a total of 2 10,600 cartons of cigarettes and drafted CW #2's account for a
total of $4,201,470 and wired CW #2 return wires totaling $1,033,842.
44. Farley wired CW #2 funds to reduce and conceal his actual price on at least 15 occasions,
where all but one occasion exceeded $10,000.
13
,
( 2 #l.
4/
45. As part of an undercover operation on M ay 22, 2013 and M ay 23 2013, CW #2 toured the
manufacturing facility, the Firebird and Cherokee Tobacco offices, and met directly with
Farley. W hile at the manufacturing facility, CW #2 noticed that Firebird appeared to have
a large volume of raw materials. The evening of M ay 22, 2013, while at a party hosted by
Cherokee Tobacco, Farley confirmed that CW#2 would continue to receive the $l5 a
carton pricing.
46. Your affiant is also aware that in addition to documentary evidence records and other
evidence of crimes are kept in digital format on computers and other electronic media. lt
is the affiant's further experience that both physical and electronic evidence relating to
transactions for tobacco manufacturing and wholesaling businesses are kept for lengthy
periods of time, in order to respond to audits and for other business reasons. By law,
tobacco manufacturers and wholesalers are required to maintain records for a period of
three years.
47. Your affiant has examined land records, utility records, and business records for the
locations to be searched, and has conducted surveillance of the locations to be searched.
M y exam ination has determined that, as to each of the locations to be searched, it is a
business location for the individuals described in paragraph three of this afGdavit.
48. The offenses described in this afsdavit are associated with persons and businesses that
routinely keep records in paper, digital, and electronic forms. Individuals involved in
fraud schemes, money laundering and CCTA violations maintain documents, letters and
records relating to their illegal activities for long periods of time. This documentary
evidence is usually secreted within their residences and the surrounding outbuildings;
their vehicles; the residences of fam ily members, friends and associates; the places in
which they conduct their business; or in storage areas. Regulations require that
manufacturers of cigarettes maintain the required records for a term of three years.
According to TTB and persons/entities in the industry the normal business practice for
retention of records in the industry is even longer - a period of seven years. Based on the
facts set forth in this affidavit it is believed that probable cause exist that records, fruits,
instrumentalities, and evidence of a crime pertaining to the alleged offenses are
maintained at the locations owned or occupied by the conspirators detailed in attachment
A, which is incorporated and made a part of this Affdavit.
DIGITAL EVIDENCE
49. As described above and in Attachment B, this application seeks permission to search for
records that might be found on the PREM ISES, in whatever form they are found. One
form in which the records m ight be found is data stored on a computer's hard drive or
other storage m edia. Thus, the warrant applied for would authorize the seizure of
electronic storage media or, potentially, the copying of electronically stored information,
all under Rule 41(e)(2)(B).
8
l bl
y l ) #
50. Your affiant knows that Firebird and Cherokee Tobacco LLC are required by Federal law
to keep records that relate to the business of cigarette manufacturing and that Firebird and
Cherokee Tobacco keep records in both written and computer maintained dal. Your
affant knows that Firebird m aintains its financial records in a computerized format since
TTB was provided with computerized format during an audit in 20l 1 .
51 . lRS Special Agent-cls Robbie O'Brien is a Computer lnvestigative Specialist with the
IRS and has specialized training and experience in investigations involving computer and
other digital evidence. ClS O'Brien informed me that computer hardware, sohware,
documentation, passwords, and data security devices may be important to a criminal
investigation in 4 respects, they may: (l) contain contraband, (2) be an instrumentality of
an offense, (3) be fruits of a crime, or (4) contain evidence of crime (items that are
evidence or may have been used to collect and-store information about crimes) created,
stored or maintained as electronic or digital data/information. Rule 41 of the Federal
Rules of Criminal Procedure permits the government to search for and seize computer
hardware, software, documentation, passwords, and data security devices which are (1)
contraband, (2) instrumentality's, (3) fruits, or (4) evidence of crime. The computer and
related media can be one or more of the aforementioned classifk ations.
52. Probable cause. l subm it that if a computer or storage medium is found on the
PREM ISES, there is probable cause to believe those records will be stored on that
computer or storage medium, for at least the following reasons:
Based on m y knowledge, training, and experience, l know that computer files or
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost.
Even when files have been deleted, they can be recovered months or years later using
forensic tools. This is so because when a person ''deletes'' a file on a computer, the
data contained in the file does not actually disappear; rather, that data remains on the
storage medium until it is overwritten by new data.
Therefore, deleted files, or remnants of deleted files, may reside in free space or slack
space-that is, in space on the storage medium that is not currently being used by an
active file-for Iong periods of time before they are overwritten. ln addition, a
computer's operating system may also keep a record of deleted data in a ''swap'' or
''recovery'' file.
W holly apart from user-generated files, computer storage media-in particular,
computers' internal hard drives-contain electronic evidence of how a computer has
9
,'
)
t Iz
been used, what it has been used for, and who has used it. To give a few examples,
this forensic evidence can take the form of operating system configurations, artifacts
from operating system or application operation, file system data structures, and
virtual memory ''swap'' or paging files. Computer users typically do not erase or
delete this evidence, because special software is typically required for that task.
However, it is technically possible to delete this information.
Similarly, fles that have been viewed via the lnternet are sometim es autom atically
downloaded into a temporary Internet directory or ''cache.''
53. Forensic evidence. As further described in Attachment B, this application seeks
permission to locate not only computer Gles that might serve as direct evidence of the
crimes described on the warrant, but also for forensic electronic evidence that establishes
how computers were used, the purpose of their use, who used them, and when. There is
probable cause to believe that this forensic electronic evidence will be on any computer
in the PREM ISES because:
Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a file
(such as a paragraph that has been deleted from a word processing filel. Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active. W eb browsers, e-mail programs,
and chat programs store configuration information on the storage medium that can
reveal information such as online nicknames and passwords. Operating systems can
record additional information, such as the attachment of peripherals, the attachment
of USB tlash storage devices or other external storage media, and the times the
computer was in use. Computer file systems can record information about the dates
files were created and the sequence in which they were created.
Forensic evidence on a computer or storage medium can also indicate who has used
or controlled the computer or storage medium . This ''user attribution'' evidence is
analogous to the search for ''indicia of occupancy'' while executing a search warrant
at a residence. For example, registry information, configuration files, user profiles, e-
mail, e-mail address books, ''chat,'' instant messaging logs, photographs, the presence
or absence of malware, and correspondence (and the data associated with the
foregoing, such as file creation and last-accessed dates) may be evidence of who used
or controlled the computer or storage medium at a relevant tim e.
A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how
computers were used, the purpose of their use, who used them, and when.
10
) W
'
) (l
The process of identifying the exact files, blocks, registry entries, logs, or other forms
of forensic evidence on a storage medium that are necessary to draw an accurate
conclusion is a dynamic process. W hile it is possible to specify in advance the
records to be sought, computer evidence is not always data that can be merely
reviewed by a review team and passed along to investigators. W hether data stored on
a computer is evidence may depend on other inform ation stored on the computer and
the application of knowledge about how a computer behaves. Therefore, contextual
information necessary to understand other evidence also falls within the scope of the
warrant.
Further, in finding evidence of how a computer was used, the purpose of its use, who
used it, and when, sometimes it is necessary to establish that a particular thing is not
present on a storage medium . For example, the presence or absence of counter-
forensic programs or anti-virus programs (and associated data) may be relevant to
establishing the user's intent.
54. Necessity ofseizing or copying entire computers or storage media. In most cases, a
thorough search of a premises for information that might be stored on storage media often
requires the seizure of the physical storage m edia and later off-site review consistent with
the warrant. In lieu of removing storage media from the premises, it is sometimes
possible to make an image copy of storage media. Generally speaking, imaging is the
taking of a complete electronic picture of the computer's data, including al1 hidden
sectors and deleted files. Either seizure or imaging is often necessary to ensure the
accuracy and completeness of data recorded on the storage m edia, and to prevent the loss
of the data either from accidental or intentional destruction. This is true because of the
following:
a. The tim e required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site. Analyzing
evidence of how a computer has been used, what it has been used for, and who
has used it requires considerable time, and taking that much time on premises
11
l
f 4) '
could be unreasonable. As explained above, because the warrant calls for forensic
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly
exam ine storage media to obtain evidence. Storage media can store a large
volume of information. Reviewing that information for things described in the
warrant can take weeks or months, depending on the volume of data stored, and
would be impractical and invasive to attempt on-site.
b. Technical reguirements. Computers can be configured in several different ways,
featuring a variety of different operating systems, application sohware, and
contigurations. Therefore, searching them sometimes requires tools or knowledge
that might not be present on the search site. The vast array of computer hardware
and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
However, taking the storage media off-site and reviewing it in a controlled
environment will allow its exam ination with the proper tools and knowledge.
Varietv of form s of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing
with specialized forensic tools.
55. Nature ofexamination. Based on the foregoing, and consistent with Rule 41(e)(2)(B),
when persons executing the warrant conclude that it would be impractical to review the
media on-site, the warrant l am applying for would permit seizing or imaging storage
media that reasonably appear to contain some or al1 of the evidence described in the
warrant, thus permitting its later examination consistent with the warrant. The
examination may require techniques, including but not lim ited to computer-assisted scans
of the entire m edium , that m ight expose many parts of a hard drive to human inspection
in order to detennine whether it is evidence described by the warrant.
12
/ ,?'% t
p,I 4
REQUEST FOR SEALING
Because this is a continuing investigation, your Affant requests that the search warrant, search
warrant application, sealing application and order, and this affidavit be sealed until such time as
the Court directs otherwise. Public disclosure of these documents at this time would seriously
jeopardize the ongoing investigation, provide an opportunity to destroy evidence, change
patterns of behavior, notify confederates, or allow confederates to flee or continue tlight from
prosecution. Furthermore, this investigation may result in applications for additional search
warrants to be executed at other locations in the near future.
CONCLUSION
Based on the information outlined above, your affiant believes that Firebird, Cherokee Tobacco
LLC, and President Kathryn Farley have violated Title l 8 U.S.C. j 2342 (b), by knowingly
making a false statement with respect to the information required by a licensee; Title 18 U.S.C. j
1957 for knowingly engaging in a m onetary transaction in criminally derived property of a value
greater than $ 10,000 and is derived from a specified unlawful activity; Title 26 U.S.C. j
5762($43) by refusing or failing to pay taxes imposed by Title 26 U.S.C. j 5703 and 5701.
Your affiant believes that there is probable cause to believe that there is evidence of these
violations of Federal law, specifkally identified in Attachment A, present at the business
location of Firebird M anufacturing LLC, and Cherokee Tobacco LLC, 1057 Bill Tuck Highway,
Suites 239 and 217, South Boston, VA 24592, and 1057 Bill Tuck Highway, Building B, South
Boston, VA 24592. Your affiant believes that this evidence is stored in handwritten, typewritten
and electronic format. Your affiant respectfully requests that a warrant be issued to authorize the
search of the premises described in Attachment A, at 1057 Bill Tuck Highway, Building B, Suite
239 and Suite 217, South Boston, Virginia 24592, and to seize the items described in Attachment
B.
OBER . M ARTENS, SPECIAL AGENT
1RS CRIM INAL INVESTIGATION
13
l.b
yl
1
1 Jt
4
z/-
swon AND suBscmBEo BEFORE ME ox THIs IL DAY OF AUGUST, 2013.
ROBERT S. BALLOU
UNITED STATES M AGISTRATE JUDGE
W ESTERN DISTRICT OF VIRGINIA
ATTACHM ENTS
ATTACHM ENT A - DESCY PTION OF LOCATION S TO BE SEARCHED
ATTACHM ENT B - ITEM S TO BE SEIZED
IN THEUNITEDSTATESDISTRICT COURT
FORTHEWESTERNDISTRICTOFVIRGINIA
INTHEMATTEROFTHESEARCHOF:
)
)
ThePremisesat )
1057BillTuckHighway,BuildingB, Suites239and217 )
SouthBoston, Virginia24592 )
ATTACHMENTA
DESCRIPTIONOFLOCATIONSTOBE SEARCHED- WDVA
Youraffiantsubmitsthatthere is probablecauseto believethatarticlesconstitutingcontraband,
evidence,fruits, and instrumentalitiesoftheaforementionedcriminalviolationswill befound on
thepersonsoforat thetarget locationslisted below:
1. 1057BillTuckHwy, BuildingB, South Boston, Virginia24592. Thepremises, is
identifiedasthe currentwarehouseand manufacturingfacility forFirebird
ManufacturingLLC,and CherokeeTobaccoCompanyLLCand is describedasan
industrial warehouseand manufacturingfacility. Thebuildingis located behind
1057,BuildingA, which is an unrelated business. CherokeeTobaccoand Firebird
Manufacturingsignsarevisibleonthefrontofthe building.Thebuilding is tan and
metal. Thefrontand sideofthe buildingappearto havewarehousedoors.
Case 7:13-mj-00101-RSB Document 1-1 Filed 08/21/13 Page 1 of 5 Pageid#: 16
---
2. 1057Bill TuckHwy, Suite239,South Boston,VA24592, is located in a multi-office
officebuildingthathouses theofficesfor Firebird ManufacturingLLC and Cherokee
Tobacco LLC. Sourceshaveprovided thatthe mainCherokeeTobaccoLLCand
Firebird ManufacturingLLCofficesarehoused insuite239. Thebuildingis tan
concrete buildingwithfrontand rearentrances. Thefrontentrancehasexterior
concretestairsand largetwo level glasswindowssurroundingtheglassentrydoors.
Thereare no similarbuildings in thearea.
3. 1057 Bill TuckHwy,Suite217,South Boston,VA 24592, is located in a multi-office
officebuildingthat housestheofficesfor FirebirdManufacturingLLC and Cherokee
TobaccoLLC. Sourceshaveindicatedthatat leastone FirebirdManufacturingLLC
employeeworksatthis location. Thebuildingis tanconcretebuildingwithfrontand
rearentrances. Thefrontentrance hasexteriorconcretestairsand largetwo level
glasswindowssurroundingtheglassentrydoors. Thereare no similarbuildingsin
thearea.
2. 1057Bill TuckHwy, Suite239, South Boston,VA24592, is located in a multi-office
officebuildingthathousestheofficesfor FirebirdManufacturingLLCand Cherokee
TobaccoLLC. SourceshaveprovidedthatthemainCherokeeTobaccoLLCand
Firebird ManufacturingLLCofficesare housed in suite239. Thebuilding is tan
concretebuildingwith frontand rearentrances. Thefrontentrancehas exterior
concretestairsand largetwo level glass windowssurroundingtheglassentrydoors.
Therearenosimilarbuildings in thearea.
3. 1057Bill TuckHwy, Suite217,SouthBoston, VA24592, is locatedin a multi-office
officebuildingthathousestheofficesfor Firebird ManufacturingLLCandCherokee
TobaccoLLC. SourceshaveindicatedthatatleastoneFirebirdManufacturingLLC
employeeworksatthis location. The buildingis tanconcretebuildingwithfrontand
rearentrances. Thefrontentrancehasexteriorconcretestairsand largetwo level
glasswindowssurroundingtheglassentrydoors. Thereareno similarbuildingsin
thearea.
INTHEUNITEDSTATESDISTRICTCOURT
FORTHEWESTERNDISTRICTOFVIRGINIA
INTHEMATTEROF THESEARCHOF: )
)
ThePremisesat )
1057BillTuckHighway, BuildingB, Suites239and217 )
SouthBoston, Virginia24592 )
ATTACHMENT B
DESCRIPTIONOFITEMSTOBESEIZED- WESTERN DISTRICTOFVIRGINIA
I) Blackberry, J-Phone, Droid orsimilarstyled device/cellulartelephone,PDA,I-Pad or
similardevicecapableofperformingsimilarfunctions regardlessofthemakeor
brand nameofthedevice, belongingtoorunderthedominionorcontrol of Kathryn
Farley,Firebird ManufacturingLLC,orCherokeeTobaccoLLC,oranyperson
involved in thesaleofdistributionofproductfrom Firebird ManufacturingLLCor
CherokeeTobaccoLLC.
2) Businessand/orpersonal recordsofcigaretteortobacco producttransactionsand
financial recordsandotherrecordsordocumentsreflectingdiversionactivityorthe
disposition ofproceedsofanyspecified unlawful activity including, but not limited
to, thefollowing:
a) retained copiesoffederal, state,and local excise,corporate,partnership,
business,and personal incometax returns; FormsW-2; Forms 1099; tax
records; anysupportingdocumentationand attachments; and any
correspondenceto/from taxingagencies;
b) notesoffinancial transactionsand/or cigaretteortobaccoproducts
transactions;
c) correspondence, including electronic mail transmissions. letters. {axes. and
notes. relatingto financial transactionsand/or cigaretteoftobaccoproducts
transactions, includingthe identificationofcustomers,suppliers, associates,
partnersandco-conspirators;
d) bank records, includingdepositslips,cancelledchecks,withdrawal slips,and
accountstatements, investmentrecords, including brokeragestatements,and
creditand debitcard records;
e) currency, bankchecks,cashier'schecks, negotiablefinancial instruments,
wiretransferdocumentation, moneyorders, stocks, bonds, preciousmetals,
and real estate records; and/orwork sheets, tallysheetsorledgersheets
reflectingoraccountingfor money received, disbursed orexchanged.
f) financial statements, incomestatements, balancesheets,cashreceipts,cash
disbursements, payroll, inventory, manufacturingrecords andjournalsand
records; and any supportingwork papers, schedules, attachmentsor
documents;
g) bills and invoices, including sales. purchases and expenses;
h) recordsoffinancial paymentspaid and received;
i) mortgageor loan recordspayableorreceivableand insurance records;
j) Deeds, titlesorotherproofofownershipofproperty;
k) recordsand keys ofstoragefacilitiesowned or rented;
I) recordsofbusinessfilings or licensesand minutesofmeetings;
m) recordsofpersonal and businessexpenses;
n) safe depositrecords and keys;
0) postoffice box and private mail box records;
p) equipmentrental records and otherleaseand rental agreements;
q) transportation records, including butnot limited to, accounts, bills, receipts
and invoices, billsoflading, airway bills, freight bills, aircargo bills, dispatch
records, logs, manifests,shippingdocuments, and invoices;
r) creditapplications,creditcard statementsand receipts;
s) papertickets, notes, schedules, receipts, and otheritems relatingto travel;
t) cellularphones belongingto orunderthedominionorcontrol ofKathryn
Farley, Firebird ManufacturingLLC,orCherokeeTobaccoLLC, orany
person involved in the saleofdistribution ofproductfrom Firebird
Manufacturing LLC or Cherokee Tobacco LLC, and cellular and landline
telephone statements and records relating thereto;
u) any packages and related shipping materials related to importations or
interstate shipments of cigarettes, including, but not limited to Federal Express
Mail receipts along with all Western Union receipts for sending or receiving
money.
3) Safes and their contents, iffound, or indications that a safe was previously installed or
located in the business
4) Records that identify customers, suppliers, associates partners, and/or co-conspirators,
including, but not limited to: contracts, address books, telephone books, rolodexes,
telephones, pagers, or personal digital assistants with stored telephone information,
notes reflecting telephone and pager numbers, photographs (to include still photos,
negatives, movies, slides, video tapes), and recordings of conversations, including
those made over telephone answering machines.
5) Identification documents, to include driver's license, passports, visas or similar
documents and representative exemplars or original handwriting samples.
6) Papers, tickets, notes, receipts, and other documents or items relating to domestic and
international travel.
7) Indicia of occupancy, residency, and/or ownership of the premises, property and/or
vehicles, including keys, photographs, or documents.
8) Documents showing custody and control of the residence or room where evidence is
seized, including, but not limited to, utility and other bills, driver's licenses,
passports, visas and other handwritten notes or other correspondence addressed to or
from the occupants of the residence or room.
9) For purposes of this attachment, the following definitions and inclusions apply:
a) Records and Information
The terms "records" and "information" include all of the foregoing items of
evidence in whatever form and by whatever means they may have been created or
stored, including any electrical, electronic, or magnetic form (such as any
information on an electronic or magnetic storage device, including floppy
diskettes, hard disks, ZIP disks, CD-ROMs, optical discs, backup tapes, printer
buffers, smart cards, memory calculators, pagers, personal digital assistants such
as Palm Pilot computers, as well as printouts or readouts from any magnetic
storage device); any handmade form (such as writing, drawing, painting); any
mechanical form (such as printing or typing); and any photographic form (such as
microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures,
photocopies).
b) Computer Hardware
Computer hardware consists of all equipment which can collect, analyze, create,
display, convert, store, conceal, or transmit electronic, magnetic, optical, or
similar computer impulses or data. This includes any data-processing devices
(such as central processing units, memory typewriters, and self-contained
"laptop" or "notebook" computers); internal and peripheral storage devices (such
as fixed disks, external hard disks, floppy disk drives and diskettes, tape drives
and tapes, optical storage devices, transistor-like binary devices, and other
memory storage devices); peripheral input/output devices (such as keyboards,
printers, scanners, plotters, video display monitors, and optical readers); related
communications devices (such as modems, cables and connections, recording
equipment, RAM or ROM units, acoustic couplers, automatic dialers, speed
dialers, programmable telephone dialing or signaling devices, and electronic tone-
generating devices); as well as any devices, mechanisms, or parts that can be used
to restrict access to computer hardware (such as physical keys and locks).
c) Computer Software
Computer software is digital information which can be interpreted by a computer
and any of its related components to direct the way it works. Software is stored in
electronic, magnetic, optical, or other digital form. It commonly includes
programs to run operating systems, applications (like word-processing, graphics,
or spreadsheet programs, utilities, compilers, interpreters, and communications
programs).
d) Computer-related Documentation
Any documentation, operating logs and reference manuals regarding the operation
of the computer equipment, storage devices or software.
Any passwords, password files, test keys, encryption codes or other information
necessary to access the computer equipment, storage devices or data.

Search Warrant - August 2013

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Search Warrant - August 2013

Uploaded by

Copyright:

Available Formats

CLERK'S OFFICE U

.s. Djsx cour AO 106 (Rev

You might also like