Search Warrant - August 2013

CLERK'S OFFICE U.s. Djsx courAO 106 (Rev. 04/10) Application for a Search Warrant

FILED

U NITED STATES D ISTRICT COURT Akg 2 ! 20for the x u ou uux cuu

W estena District of Virginia BY;tl-rY CLERK

ln the Matter of the Search of(Briefly describe the property to be searchedor ident# the person by name and address)

1057 Bill Tuck Highway, Building B,Suite 239 and Suite 217

South Boston, Virginia 24592

.134 T z/Case No. .

APPLICATION FOR A SEARCH W ARM NT

1, a federal law enforcement oftice!- or an attorney for the government, request a search warrant and state underpenalty of perjury that l have reason to belleve that on the following person or property (identh the person or describe theproperty to be searched and give its locationl:

See Attachment A

located in the Western District of Virginia , there is now concealed (identh theperson or describe the property to be seizedll

See Attachment B

The basis for the search under Fed. R. Crim. P. 41(c) is (checkone or morel'.V evidence of a crime',Vcontraband, fruits of crime, or other items illegally possessed;Yproperty designed for use, intended for use, or used in committing a crime;O a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section18 U.S.C. j 2342 (b)18 U.S.C. j 195726 U.S.C. j 5762(a)(3)The application is based on these facts:

see attached affidavit, Attachment A

# Continued on the attached sheet.

Offense DescriptionContraband Cigarette Trafficking ActMoney LaunderingTax Evasion

O Delayed notice of days (give exact ending date if more than 30 days: ) is requestedunder l 8 U.S.C. j 3 l 03a, the basis of which is set forth on the attached sheet.

/

Applicant 's signature

' eq G IGTGAJS spigctwt- h%c+arPrinted name and title

Sworn to before me and signed in my presence.

Date: 7 /v I-'Q /2F

City and state: Roanoke, Virginia

Judge 's nknature

Robert S. Ballou, United States Magistrate JudgePrinted name and title

Case 7:13-mj-00101-RSB Document 1 Filed 08/21/13 Page 1 of 15 Pageid#: 1

CLERKS OFFICE U,S. DISX COUGAT ROANOKE, VA

FILED

ALC 2 1 2913JUL DU LEY CLERK

BY;PUTY CLERK

IN THE UNITED STATES DISTRICT COURT

FOR THE W ESTERN DISTRICT OF VIRGINIA

IN TllE M ATTER OF THE SEARCH OF;

The Premises at

1057 Bill Tuck Highway, Building B, Suites 239 and 217

South Boston, Virginia 24592

) V:13$ Tlôl

AFFIDAVIT IN SUPPORT OF SEARCH W ARRANT

1, Special Agent Robert E. M artens, being duly sworn herby depose and say:

INTRODUCTION

I have been employed as a Special Agent (SA) with the lnternal Revtnue Service (IRS),Crim inal lnvestigation Division for 9 years. For the last approximately 2.5 years, l have

been detailed to the Alcohol Tobacco Tax and Trade Bureau (TTB). As a Special Agentwith lRS my duties include, but are not lim ited to, conducting criminal investigationsconcerning violations of the Internal Revenue Code, money laundering, the bank secrecyact, and m ore recently violations regarding tobacco diversion including the ContrabandCigarette TrafGcking Act.

2. As a result of m y personal participation in the investigation of matters referred to in thisaffidavit, l am fam iliar with the facts and circumstances of this investigation. On thebasis of personal observation, as well as familiarity, I have determined the following:

For the past 12 months your affiant has been involved in an investigation of Kathryn C.Farley, CB Holdings LLC, Firebird M anufacturing LLC, a cigarette m anufacturing in theW estern District of Virginia, and Cherokee Tobacco Company LLC, for a conspiracy tofail to pay the Federal excise tax on cigarettes that Firebird M anufacturing LLCmanufactures. Based on my investigation, there is probable cause to believe that KathrynC. Farley, President of both Firebird M anufacturing LLC and Cherokee Tobacco

Company LLC, owned by CB Holdings LLC is involved in a conspiracy to commit wirefraud, conspiracy to com mit money laundering, and conspiracy to violate the Contraband

tld. / >.J'


Cigarette Trafficking Act. Your affiant bases this affidavit upon personal knowledge,information obtained from the review of official records, public records, and information

filed with TTB.

4. This affidavit is submitted in support of an application for a search warrant for FirebirdM anufacturing LLC and Cherokee Tobacco Company LLC, 1057 Bill Tuck Highway,Building B, South Boston, Virginia 24592; and 1057 Bill Tuck Highway Suite 239,South Boston, Virginia 24592, which is further described in Attachment A.

BACK GROUND

The Alcohol Tobacco Tax and Trade Bureau (TTB) administers and enforces laws andTTB regulations pertaining to producing tobacco products and for collecting excise taxeson tobacco.

6. The Contraband Cigarette Trafticking Act (CCTA) requires that any person who sells,ships, transfers or otherwise disposes of more than 10,000 cigarettes in a singletransaction maintain records of the transaction that state the full name of the purchaser,

the street address (including city and sute) to which the cigarettes were destined, and thequantity of the cigarettes in question. The CCTA makes it illegal for any personknowingly to make any false statement or representation with respect to the informationrequired to be kept in the records of any person who ships, sells, or distributes anyquantity of cigarettes in excess of l 0,000 in a single transaction.

7. Proper and truthful record keeping and documentation as mandated by federal law andregulations are essential to enable TTB to perform its function with regard to recordkeeping of operations and transactions by cigarette manufacturers. False record keepingimpedes perform ance of TTB'S function and unduly hinders the effective administration

ofjustice.

8. It is unlawful under Federal law to conspire to impede a federal agency's perform ance of

its function or unduly hinder the administration of justice, falsify records or make falsestatements concerning a matter under thejurisdiction of a federal agency, including IRSand TTB, evade Federal Cigarette Excise Taxes or to use the mails or wires infurtherance of a scheme to defraud.

9. Firebird M anufacturing, LLC, is a corporation organized and existing under the laws ofVirginia, and has manufactured Cherokee brand cigarettes since purchasing themanufacturing facility from Virginia Brands, LLC, in early 2010. FirebirdM anufacturing, LLC, has also manufactured Sem inole and Palmetto brand cigarettes

2 /yu /

(/$J?


during that time frame. Firebird is located at 1057 Bill Tuck Highway, Building B, SouthBoston, Virginia 24592, within the W estern District of Virginia. Cherokee Tobacco LLCis a wholesaler of tobacco products and is located at 1057 Bill Tuck Highway, Suite 239,South Boston, Virginia 24592, within the W estern District of Virginia.

10. Firebird Manufacturing is a TTB permitted Manufacturer of Tobacco Products (MTP),permit number TP-VA-15004.

l 1. Title 26, United States Code, j 5701(b) imposes a tax on tobacco products manufacturedin the United States. On cigarettes weighing not more than 3 pounds per thousand, thetax is $50.33 per thousand, or $10.066 per carton.

12. In 1998, forty-six states and six territories entered into a M aster Settlement Agreement

(MSA) with several major cigarette manufacturers. The parties intended the settlement toend further litigation between state governm ents and cigarette manufacturers. As part ofthe settlement, the states released the manufacturers from past and future liability inexchange for the m anufacturers' agreement to abide by advertising and promotionalrestrictions and to m ake annual moneury payments to the states based on annual cigarette

sales. Under the settlement, the manufacturers' payments to the States were subject toreduction based on lost market share, but the paym ent was not reduced if the Stateenacted and enforced a Iaw that required cigarette manufacturers that were not parties to

the Master Settlement Agreement (Non-participating Manufacturers) to make specifedannual deposits into an escrow fund based on the number of the m anufacturer's cigarettessold in the state, as measured by state excise taxes applied to such cigarette sales. Thestates' Iaws also required that such manufacturers file annual certifications truthfullystating that the required escrow deposits were made.

l3. Firebird Manufacturing LLC, is a Non-participating Manufacturer (NPM) of theCherokee cigarette brand for a related company, Cherokee Tobacco Company, andseveral private label brands of cigarettes, cigars and pipe tobacco. In order to beprofitable, Cherokee cigarettes sold to wholesalers in M SA states must include escrowpayments in the sale price to wholesalers who will stamp and sell Cherokee cigarettes.

14. Title 26, United States Code, j 5703(a)(1) provides that the manufacturer or importer oftobacco products and cigarette papers and tubes shall be liable for the taxes imposedthereon by Section 5701 .

15. Title 26, United States Code, j 5703(b)(1) provides that the taxes imposed by Section5701 shall be determ ined at the tim e of removal of the tobacco products and cigarettepapers and tubes, that such taxes shall be paid on the basis of a return, that the Secretary

3

o/é? ('%ylM


shall, by regulations prescribe the period or the event for which such return shall be made

and the information to be furnished on such return.

16. Title 26, United States Code, j 57624a) states that whoever, with the intent to defraud theUnited States:

(2)...Fai1s to keep or make any record, return, reporq or inventory, or keeps or makesany false or fraudulent record, return, report, or inventory required by this chapter orregulations thereunder; or

(3)...Refuses to pay any tax imposed by this chapter, or attempts in any manner toevade or defeat the tax or the paym ent thereof; or

(4)...Removes, contrary to this chapter or regulations thereunder, any tobaccoproducts or cigarette papers or tubes subject to tax under this chapter:

Shall, for each such offense, be fined not more than $10,000, or imprisoned not morethan 5 years or both.

17. Title 26, United States Code, j 5741 , provides that every manufacturer of tobaccoproducts or cigarette papers and tubes, every importer, and every export warehouseproprietor shall keep such records in such a manner as the Secretary shall by regulationprescribe. The records required under this section shall be available for inspection by anyinternal revenue officer during business hours.

18. Title 26, United States Code, j 5705, provides that Credit or refund of any tax imposedby this chapter or section 7652 shall be allowed or made (without interest) to themanufacturer, importer, or export warehouse proprietor, on proof satisfactory to theSecretary that the claimant manufacturer, importer, or export warehouse proprietor haspaid the tax on tobacco products and cigarette papers and tubes withdrawn by him from

the market; or on such articles lost (otherwise than by theft) or destroyed, by fire,casualty, or act of God, while in the possession of ownership of the claimant.

19. Title 18, United States Code, j 1957 states: Whoever... knowingly engages or attemptsto engage in a monetary transaction in criminally derived property of a value greater than$10,000 and is derived from specified unlawful activity.

20. 27 CFR 40.181, provides that every manufacturer of tobacco products m ust keep recordsof his operations and transactions which shall reflect, for each day, the informationspecified in 40.182 and 40.183. For this purpose day shall m ean calendar day. ..

27 CFR 40.185, Retention of records, provides that al1 records required to be kept underthis part, including copies of authorizations, claims, inventories, notices, reports, returns

4

f-/$ ) Psj t


and schedules, shall be retained by the manufacturer for three years following the closeof the calendar year in which filed or made, or in the case of an authorization, for threeyears following the close of the calendar year in which the operation under suchauthorization is concluded. Such records shall be kept in the factory or a placeconvenient thereto, and shall be made available for inspection by any TTB offker uponhis request.

STATEM ENT OF FACTS

22. Firebird Manufacturing LLC, (Firebird) is a manufacturer of tobacco products located inSouth Boston, Virginia that at least from M arch 2010 to July 2013, manufacmredCherokee brand cigarettes as well as other cigarettes and filtered cigars. CherokeeTobacco Company LLC, is a wholesaler of tobacco products that primarily sells thecigarettes manufactured by Firebird. During this tim e, Kathryn Farley started as VicePresident and in June 2012 was promoted to President of both Firebird and CherokeeTobacco Company LLC. Firebird's manufacturing plant is located at 1057 Bill TuckHighway, Building B and Suite 239, South Boston, Virginia, located in the W esternDistrict of Virginia.

23. Cooperating Witness //1 (CW#1) contacted TTB in June of 2012 and has been andcontinues to be a highly reliable source of information. Information provided by CW #1has been corroborated by records filed with TTB and other cooperating witnesses.

24. On September 14, 201 1 TTB authorized Firebird to destroy 3,792,800 sticks of cigarettes.After the product was destroyed, Firebird filed a claim of $190,891.62 for the FederalExcise Tax (FET) on these products.

25. Firebird claimed the cigarettes were returned for a variety of reasons m ostly due toquality issues on cigarettes m anufactured since Firebird started business in M arch 2010.

26. A TTB Auditor witnessed the destruction on October 7, 201 l . The number of sticks was

reduced to 3,750,760 and the tax amount adjusted to $188,775.75. The claim for aFederal Excise Tax refund was denied as an audit team did not feel the documentationsupplied was sufficient.

27. After the destruction CW #1 contacted TTB. CW #1 claimed Firebird had planned todestroy oId product they had not manufactured or paid taxes on, but when TTB wanted towitness the destruction they changed the product and altered records given to TTB.

28. CW #1 stated that Firebird planned to destroy imported product and old product from themanufacturer they had purchased. CW #1 stated that once notified TTB would observe

5

43J'*1s/


the destruction the product was switched out for new product and the destruction teamordered to go slow. Firebird would not have been eligible for a tax refund associatedwith the destruction of product manufactured or imported by the previous manufacturer,to be eligible for a tax refund, Firebird would need to destroy product that they hadmanufactured since the purchase of the manufacturing facility in M arch 2010.

29. CW #1 stated that Firebird pulled new product to destroy in order to conceal the oldproduct they planned to destroy, but the new product they destroyed did not matchinvoices from M arch 2010 when they began manufacturing. Firebird destroyed CherokeeM enthol Gold Kings but the invoices they were planning on using for support hadM enthol Green and M enthol Gold 100s and M enthol Green Kings. CW #l producedoriginal invoices and altered invoices to show changes that had been made.

30. Firebird's QuickBooks files were obtained during a civil audit conducted by TTB inNovember 201 1. The records were kept at the place to be searched. A review of the

QuickBooks's Audit Trail file showed that the invoices provided by CW#1 showed thatthe invoices provided by CW #l had been altered on October l2, 20l l , after the TTBauditor asked for supporting documents.

31 . Starting in November 201 1, the amount of tax reported on and paid per Firebird's taxreturns was less than the amount of tax due based on a calculation of the removals on themonthly reports.

32. The TTB Monthly Reports, Form 5210.5, are filed and signed, under penalty of perjul.yby Kathy Farley, and report manufacture and removal information for the manufacturer.

33. CW #1 stated that office personnel prepare the TTB M onthly Reports, Form 5210.5,based upon the manufacture and removal information provided to CW #1, and providesthe report for filing to Farley.

34. The federal excise tax returns, filed twice a month, and three times in September, arefiled electronically through a user account established by Farley.

35. Using the monthly report of removals filed with TTB the tax due for the month was

recalculated using the Removed Subject to Tax line of the monthly report. This figurewas then reconciled to the tax returns filed by Firebird for the corresponding period. Thefigure should match, however since November 201 1 the tax payment has been far lessthan the tax Iiability calculated from the m onthly reports.

6

6#/i/t!#


36. The tax liability associated with the underpaym ent from November 201 1 through July

2013 is approximately 10.8 million dollars.

37. CW #1 also stated that office personnel complete a tax calculation and prepare draft TTBExcise Tax Returns, which are provided to Farley. CW #1 was able to provide the draftreturns provided to Farley by office personnel for January 2013. The tax liability on thedraft tax returns reconciles with the tax liability of the TTB M onthly report for the period.CW #1 stated that oftke personnel provide Farley with the draft tax returns based uponthe monthly report.

38. 1 approached CW #2 in approximately October 2012.information in the past to multiple federal agencies.business.

CW #2 has provided reliableCW #2 operates a tobacco wholesale

39. CW #2 has been providing documentary evidence as well as conducting consensuallymonitored phone calls on our behalf. Additionally CW #2 has met face to face withFarley in a monitored situation.

40. CW #2 operates in states that participate in the M SA. The M SA fee is approximately$5.80 a carton. The Federal Excise Tax is approximately $10.06 per carton. Thus ifFederal Taxes and the M SA are paid, the regulatory costs and taxes on a carton ofcigarettes is at least $15.86 a carton.

41. ln August of 2012 Kathy Farley offered to sell cartons of Cherokee cigarettes to CW #2for $16 a carton. After three sales totaling 8,220 cartons, the price was reduced to $15 acarton.

42. For a1I the sales to CW#2 at $15 and $16 a carton, Farley created false documents to hidethe true price. Farley invoiced CW#2 at a higher price, for example $19.95 a carton, thenissued a credit memo to the company to reduce the price to approximately $1 8.25. Farleythen drafts CW#2's account for a cost of approximately $1 8.25 a carton. Farley laterwires funds back to CW #2 to reduce the effective price to $15 a carton.

43. Between August 1, 2012 and June 6, 2013 Farley sold cigarettes to CW #2 using the falseinvoicing schem e to sell cigarettes below the regulatory cost creating at least 32 falseinvoices, for a total of 2 10,600 cartons of cigarettes and drafted CW #2's account for atotal of $4,201,470 and wired CW #2 return wires totaling $1,033,842.

44. Farley wired CW #2 funds to reduce and conceal his actual price on at least 15 occasions,

where all but one occasion exceeded $10,000.

13, ( 2#l.4/


45. As part of an undercover operation on M ay 22, 2013 and M ay 23 2013, CW #2 toured themanufacturing facility, the Firebird and Cherokee Tobacco offices, and met directly withFarley. W hile at the manufacturing facility, CW #2 noticed that Firebird appeared to havea large volume of raw materials. The evening of M ay 22, 2013, while at a party hosted byCherokee Tobacco, Farley confirmed that CW#2 would continue to receive the $l5 acarton pricing.

46. Your affiant is also aware that in addition to documentary evidence records and otherevidence of crimes are kept in digital format on computers and other electronic media. ltis the affiant's further experience that both physical and electronic evidence relating totransactions for tobacco manufacturing and wholesaling businesses are kept for lengthyperiods of time, in order to respond to audits and for other business reasons. By law,tobacco manufacturers and wholesalers are required to maintain records for a period ofthree years.

47. Your affiant has examined land records, utility records, and business records for thelocations to be searched, and has conducted surveillance of the locations to be searched.M y exam ination has determined that, as to each of the locations to be searched, it is abusiness location for the individuals described in paragraph three of this afGdavit.

48. The offenses described in this afsdavit are associated with persons and businesses thatroutinely keep records in paper, digital, and electronic forms. Individuals involved infraud schemes, money laundering and CCTA violations maintain documents, letters andrecords relating to their illegal activities for long periods of time. This documentaryevidence is usually secreted within their residences and the surrounding outbuildings;their vehicles; the residences of fam ily members, friends and associates; the places inwhich they conduct their business; or in storage areas. Regulations require thatmanufacturers of cigarettes maintain the required records for a term of three years.According to TTB and persons/entities in the industry the normal business practice forretention of records in the industry is even longer - a period of seven years. Based on thefacts set forth in this affidavit it is believed that probable cause exist that records, fruits,instrumentalities, and evidence of a crime pertaining to the alleged offenses aremaintained at the locations owned or occupied by the conspirators detailed in attachmentA, which is incorporated and made a part of this Affdavit.

DIGITAL EVIDENCE

49. As described above and in Attachment B, this application seeks permission to search forrecords that might be found on the PREM ISES, in whatever form they are found. Oneform in which the records m ight be found is data stored on a computer's hard drive orother storage m edia. Thus, the warrant applied for would authorize the seizure ofelectronic storage media or, potentially, the copying of electronically stored information,

all under Rule 41(e)(2)(B).

8lbl

yèl) #


50. Your affiant knows that Firebird and Cherokee Tobacco LLC are required by Federal lawto keep records that relate to the business of cigarette manufacturing and that Firebird andCherokee Tobacco keep records in both written and computer maintained dal. Youraffant knows that Firebird m aintains its financial records in a computerized format sinceTTB was provided with computerized format during an audit in 20l 1 .

51 . lRS Special Agent-cls Robbie O'Brien is a Computer lnvestigative Specialist with theIRS and has specialized training and experience in investigations involving computer andother digital evidence. ClS O'Brien informed me that computer hardware, sohware,documentation, passwords, and data security devices may be important to a criminal

investigation in 4 respects, they may: (l) contain contraband, (2) be an instrumentality ofan offense, (3) be fruits of a crime, or (4) contain evidence of crime (items that areevidence or may have been used to collect and-store information about crimes) created,stored or maintained as electronic or digital data/information. Rule 41 of the FederalRules of Criminal Procedure permits the government to search for and seize computer

hardware, software, documentation, passwords, and data security devices which are (1)contraband, (2) instrumentality's, (3) fruits, or (4) evidence of crime. The computer andrelated media can be one or more of the aforementioned classifk ations.

52. Probable cause. l subm it that if a computer or storage medium is found on thePREM ISES, there is probable cause to believe those records will be stored on thatcomputer or storage medium, for at least the following reasons:

Based on m y knowledge, training, and experience, l know that computer files orremnants of such files can be recovered months or even years after they have beendownloaded onto a storage medium, deleted, or viewed via the Internet. Electronicfiles downloaded to a storage medium can be stored for years at little or no cost.Even when files have been deleted, they can be recovered months or years later usingforensic tools. This is so because when a person ''deletes'' a file on a computer, thedata contained in the file does not actually disappear; rather, that data remains on thestorage medium until it is overwritten by new data.

Therefore, deleted files, or remnants of deleted files, may reside in free space or slackspace-that is, in space on the storage medium that is not currently being used by anactive file-for Iong periods of time before they are overwritten. ln addition, acomputer's operating system may also keep a record of deleted data in a ''swap'' or''recovery'' file.

W holly apart from user-generated files, computer storage media-in particular,computers' internal hard drives-contain electronic evidence of how a computer has

9

,')

t Iz


been used, what it has been used for, and who has used it. To give a few examples,this forensic evidence can take the form of operating system configurations, artifactsfrom operating system or application operation, file system data structures, andvirtual memory ''swap'' or paging files. Computer users typically do not erase ordelete this evidence, because special software is typically required for that task.However, it is technically possible to delete this information.

Similarly, fles that have been viewed via the lnternet are sometim es autom aticallydownloaded into a temporary Internet directory or ''cache.''

53. Forensic evidence. As further described in Attachment B, this application seekspermission to locate not only computer Gles that might serve as direct evidence of thecrimes described on the warrant, but also for forensic electronic evidence that establisheshow computers were used, the purpose of their use, who used them, and when. There isprobable cause to believe that this forensic electronic evidence will be on any computerin the PREM ISES because:

Data on the storage medium can provide evidence of a file that was once on thestorage medium but has since been deleted or edited, or of a deleted portion of a file

(such as a paragraph that has been deleted from a word processing filel. Virtualmemory paging systems can leave traces of information on the storage medium thatshow what tasks and processes were recently active. W eb browsers, e-mail programs,and chat programs store configuration information on the storage medium that canreveal information such as online nicknames and passwords. Operating systems canrecord additional information, such as the attachment of peripherals, the attachmentof USB tlash storage devices or other external storage media, and the times thecomputer was in use. Computer file systems can record information about the datesfiles were created and the sequence in which they were created.

Forensic evidence on a computer or storage medium can also indicate who has usedor controlled the computer or storage medium . This ''user attribution'' evidence isanalogous to the search for ''indicia of occupancy'' while executing a search warrantat a residence. For example, registry information, configuration files, user profiles, e-mail, e-mail address books, ''chat,'' instant messaging logs, photographs, the presence

or absence of malware, and correspondence (and the data associated with theforegoing, such as file creation and last-accessed dates) may be evidence of who usedor controlled the computer or storage medium at a relevant tim e.

A person with appropriate familiarity with how a computer works can, afterexamining this forensic evidence in its proper context, draw conclusions about howcomputers were used, the purpose of their use, who used them, and when.

10

)W' )ï(l


The process of identifying the exact files, blocks, registry entries, logs, or other formsof forensic evidence on a storage medium that are necessary to draw an accurateconclusion is a dynamic process. W hile it is possible to specify in advance therecords to be sought, computer evidence is not always data that can be merelyreviewed by a review team and passed along to investigators. W hether data stored ona computer is evidence may depend on other inform ation stored on the computer andthe application of knowledge about how a computer behaves. Therefore, contextualinformation necessary to understand other evidence also falls within the scope of thewarrant.

Further, in finding evidence of how a computer was used, the purpose of its use, whoused it, and when, sometimes it is necessary to establish that a particular thing is notpresent on a storage medium . For example, the presence or absence of counter-

forensic programs or anti-virus programs (and associated data) may be relevant toestablishing the user's intent.

54. Necessity ofseizing or copying entire computers or storage media. In most cases, a

thorough search of a premises for information that might be stored on storage media often

requires the seizure of the physical storage m edia and later off-site review consistent with

the warrant. In lieu of removing storage media from the premises, it is sometimes

possible to make an image copy of storage media. Generally speaking, imaging is the

taking of a complete electronic picture of the computer's data, including al1 hidden

sectors and deleted files. Either seizure or imaging is often necessary to ensure the

accuracy and completeness of data recorded on the storage m edia, and to prevent the loss

of the data either from accidental or intentional destruction. This is true because of the

following:

a. The tim e required for an examination. As noted above, not all evidence takes the

form of documents and files that can be easily viewed on site. Analyzing

evidence of how a computer has been used, what it has been used for, and who

has used it requires considerable time, and taking that much time on premises

11

lf4) '


could be unreasonable. As explained above, because the warrant calls for forensic

electronic evidence, it is exceedingly likely that it will be necessary to thoroughly

exam ine storage media to obtain evidence. Storage media can store a large

volume of information. Reviewing that information for things described in the

warrant can take weeks or months, depending on the volume of data stored, and

would be impractical and invasive to attempt on-site.

b. Technical reguirements. Computers can be configured in several different ways,

featuring a variety of different operating systems, application sohware, and

contigurations. Therefore, searching them sometimes requires tools or knowledge

that might not be present on the search site. The vast array of computer hardware

and software available makes it difficult to know before a search what tools or

knowledge will be required to analyze the system and its data on the Premises.

However, taking the storage media off-site and reviewing it in a controlled

environment will allow its exam ination with the proper tools and knowledge.

Varietv of form s of electronic media. Records sought under this warrant could be

stored in a variety of storage media formats that may require off-site reviewing

with specialized forensic tools.

55. Nature ofexamination. Based on the foregoing, and consistent with Rule 41(e)(2)(B),when persons executing the warrant conclude that it would be impractical to review themedia on-site, the warrant l am applying for would permit seizing or imaging storagemedia that reasonably appear to contain some or al1 of the evidence described in thewarrant, thus permitting its later examination consistent with the warrant. Theexamination may require techniques, including but not lim ited to computer-assisted scansof the entire m edium , that m ight expose many parts of a hard drive to human inspectionin order to detennine whether it is evidence described by the warrant.

12

/ ,?'%tô p,I4


REQUEST FOR SEALING

Because this is a continuing investigation, your Affant requests that the search warrant, searchwarrant application, sealing application and order, and this affidavit be sealed until such time asthe Court directs otherwise. Public disclosure of these documents at this time would seriously

jeopardize the ongoing investigation, provide an opportunity to destroy evidence, changepatterns of behavior, notify confederates, or allow confederates to flee or continue tlight fromprosecution. Furthermore, this investigation may result in applications for additional searchwarrants to be executed at other locations in the near future.

CONCLUSION

Based on the information outlined above, your affiant believes that Firebird, Cherokee Tobacco

LLC, and President Kathryn Farley have violated Title l 8 U.S.C. j 2342 (b), by knowinglymaking a false statement with respect to the information required by a licensee; Title 18 U.S.C. j1957 for knowingly engaging in a m onetary transaction in criminally derived property of a value

greater than $ 10,000 and is derived from a specified unlawful activity; Title 26 U.S.C. j5762($43) by refusing or failing to pay taxes imposed by Title 26 U.S.C. j 5703 and 5701.

Your affiant believes that there is probable cause to believe that there is evidence of theseviolations of Federal law, specifkally identified in Attachment A, present at the businesslocation of Firebird M anufacturing LLC, and Cherokee Tobacco LLC, 1057 Bill Tuck Highway,Suites 239 and 217, South Boston, VA 24592, and 1057 Bill Tuck Highway, Building B, SouthBoston, VA 24592. Your affiant believes that this evidence is stored in handwritten, typewrittenand electronic format. Your affiant respectfully requests that a warrant be issued to authorize thesearch of the premises described in Attachment A, at 1057 Bill Tuck Highway, Building B, Suite239 and Suite 217, South Boston, Virginia 24592, and to seize the items described in AttachmentB.

OBER . M ARTENS, SPECIAL AGENT

1RS CRIM INAL INVESTIGATION

13

l.byl11Jt

4


z/-swon AND suBscmBEo BEFORE ME ox THIs IL DAY OF AUGUST, 2013.

ROBERT S. BALLOU

UNITED STATES M AGISTRATE JUDGE

W ESTERN DISTRICT OF VIRGINIA

ATTACHM ENTS

ATTACHM ENT A - DESCY PTION OF LOCATION S TO BE SEARCHED

ATTACHM ENT B - ITEM S TO BE SEIZED



FOR THE WESTERN DISTRICT OF VIRGINIA

IN THE MATTER OF THE SEARCH OF: )

)

The Premises at )

1057 Bill Tuck Highway, Building B, Suites 239 and 217 )

South Boston, Virginia 24592 )

ATTACHMENT A

DESCRIPTION OF LOCATIONS TO BE SEARCHED - WDV A

Your affiant submits that there is probable cause to believe that articles constituting contraband,

evidence, fruits, and instrumentalities of the aforementioned criminal violations will be found on

the persons of or at the target locations listed below:

1. 1057 Bill Tuck Hwy, Building B, South Boston, Virginia 24592. The premises, is

identified as the current warehouse and manufacturing facility for Firebird

Manufacturing LLC, and Cherokee Tobacco Company LLC and is described as an

industrial warehouse and manufacturing facility. The building is located behind

1057, Building A, which is an unrelated business. Cherokee Tobacco and Firebird

Manufacturing signs are visible on the front of the building. The building is tan and

metal. The front and side of the building appear to have warehouse doors.

Case 7:13-mj-00101-RSB Document 1-1 Filed 08/21/13 Page 1 of 5 Pageid#: 16

--

2. 1057 Bill Tuck Hwy, Suite 239, South Boston, VA 24592, is located in a multi-office

office building that houses the offices for Firebird Manufacturing LLC and Cherokee

Tobacco LLC. Sources have provided that the main Cherokee Tobacco LLC and

Firebird Manufacturing LLC offices are housed in suite 239. The building is tan

concrete building with front and rear entrances. The front entrance has exterior

concrete stairs and large two level glass windows surrounding the glass entry doors.

There are no similar buildings in the area.




Tobacco LLC. Sources have indicated that at least one Firebird Manufacturing LLC

employee works at this location. The building is tan concrete building with front and

rear entrances. The front entrance has exterior concrete stairs and large two level

glass windows surrounding the glass entry doors. There are no similar buildings in

the area.




Tobacco LLC. Sources have provided that the main Cherokee Tobacco LLC and

Firebird Manufacturing LLC offices are housed in suite 239. The building is tan

concrete building with front and rear entrances. The front entrance has exterior

concrete stairs and large two level glass windows surrounding the glass entry doors.

There are no similar buildings in the area.




Tobacco LLC. Sources have indicated that at least one Firebird Manufacturing LLC

employee works at this location. The building is tan concrete building with front and

rear entrances. The front entrance has exterior concrete stairs and large two level

glass windows surrounding the glass entry doors. There are no similar buildings in

the area.



FOR THE WESTERN DISTRICT OF VIRGINIA

IN THE MATTER OF THE SEARCH OF: )

)

The Premises at )

1057 Bill Tuck Highway, Building B, Suites 239 and 217 )

South Boston, Virginia 24592 )

ATTACHMENT B

DESCRIPTION OF ITEMS TO BE SEIZED - WESTERN DISTRICT OF VIRGINIA

I) Blackberry, J-Phone, Droid or similar styled device/cellular telephone, PDA, I-Pad or similar device capable of performing similar functions regardless of the make or brand name of the device, belonging to or under the dominion or control of Kathryn Farley, Firebird Manufacturing LLC, or Cherokee Tobacco LLC, or any person involved in the sale of distribution of product from Firebird Manufacturing LLC or Cherokee Tobacco LLC.

2) Business and/or personal records of cigarette or tobacco product transactions and financial records and other records or documents reflecting diversion activity or the disposition of proceeds of any specified unlawful activity including, but not limited to, the following:

a) retained copies of federal, state, and local excise, corporate, partnership, business, and personal income tax returns; Forms W-2; Forms 1099; tax records; any supporting documentation and attachments; and any correspondence to/from taxing agencies;

b) notes of financial transactions and/or cigarette or tobacco products transactions;

c) correspondence, including electronic mail transmissions. letters. {axes. and notes. relating to financial transactions and/or cigarette of tobacco products transactions, including the identification of customers, suppliers, associates, partners and co-conspirators;


d) bank records, including deposit slips, cancelled checks, withdrawal slips, and account statements, investment records, including brokerage statements, and credit and debit card records;

e) currency, bank checks, cashier's checks, negotiable financial instruments, wire transfer documentation, money orders, stocks, bonds, precious metals, and real estate records; and/or work sheets, tally sheets or ledger sheets reflecting or accounting for money received, disbursed or exchanged.

f) financial statements, income statements, balance sheets, cash receipts, cash disbursements, payroll, inventory, manufacturing records and journals and records; and any supporting work papers, schedules, attachments or documents;

g) bills and invoices, including sales. purchases and expenses;

h) records of financial payments paid and received;

i) mortgage or loan records payable or receivable and insurance records;

j) Deeds, titles or other proof of ownership of property;

k) records and keys of storage facilities owned or rented;

I) records of business filings or licenses and minutes of meetings;

m) records of personal and business expenses;

n) safe deposit records and keys;

0) post office box and private mail box records;

p) equipment rental records and other lease and rental agreements;

q) transportation records, including but not limited to, accounts, bills, receipts and invoices, bills of lading, airway bills, freight bills, air cargo bills, dispatch records, logs, manifests, shipping documents, and invoices;

r) credit applications, credit card statements and receipts;

s) paper tickets, notes, schedules, receipts, and other items relating to travel;

t) cellular phones belonging to or under the dominion or control of Kathryn Farley, Firebird Manufacturing LLC, or Cherokee Tobacco LLC, or any person involved in the sale of distribution of product from Firebird


Manufacturing LLC or Cherokee Tobacco LLC, and cellular and landline telephone statements and records relating thereto;

u) any packages and related shipping materials related to importations or interstate shipments of cigarettes, including, but not limited to Federal Express Mail receipts along with all Western Union receipts for sending or receiving money.

3) Safes and their contents, iffound, or indications that a safe was previously installed or located in the business

4) Records that identify customers, suppliers, associates partners, and/or co-conspirators, including, but not limited to: contracts, address books, telephone books, rolodexes, telephones, pagers, or personal digital assistants with stored telephone information, notes reflecting telephone and pager numbers, photographs (to include still photos, negatives, movies, slides, video tapes), and recordings of conversations, including those made over telephone answering machines.

5) Identification documents, to include driver's license, passports, visas or similar documents and representative exemplars or original handwriting samples.

6) Papers, tickets, notes, receipts, and other documents or items relating to domestic and international travel.

7) Indicia of occupancy, residency, and/or ownership of the premises, property and/or vehicles, including keys, photographs, or documents.

8) Documents showing custody and control of the residence or room where evidence is seized, including, but not limited to, utility and other bills, driver's licenses, passports, visas and other handwritten notes or other correspondence addressed to or from the occupants of the residence or room.

9) For purposes of this attachment, the following definitions and inclusions apply:

a) Records and Information

The terms "records" and "information" include all of the foregoing items of evidence in whatever form and by whatever means they may have been created or stored, including any electrical, electronic, or magnetic form (such as any information on an electronic or magnetic storage device, including floppy diskettes, hard disks, ZIP disks, CD-ROMs, optical discs, backup tapes, printer buffers, smart cards, memory calculators, pagers, personal digital assistants such as Palm Pilot computers, as well as printouts or readouts from any magnetic storage device); any handmade form (such as writing, drawing, painting); any mechanical form (such as printing or typing); and any photographic form (such as


microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures, photocopies).

b) Computer Hardware

Computer hardware consists of all equipment which can collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, optical, or similar computer impulses or data. This includes any data-processing devices (such as central processing units, memory typewriters, and self-contained "laptop" or "notebook" computers); internal and peripheral storage devices (such as fixed disks, external hard disks, floppy disk drives and diskettes, tape drives and tapes, optical storage devices, transistor-like binary devices, and other memory storage devices); peripheral input/output devices (such as keyboards, printers, scanners, plotters, video display monitors, and optical readers); related communications devices (such as modems, cables and connections, recording equipment, RAM or ROM units, acoustic couplers, automatic dialers, speed dialers, programmable telephone dialing or signaling devices, and electronic tonegenerating devices); as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (such as physical keys and locks).

c) Computer Software

Computer software is digital information which can be interpreted by a computer and any of its related components to direct the way it works. Software is stored in electronic, magnetic, optical, or other digital form. It commonly includes programs to run operating systems, applications (like word-processing, graphics, or spreadsheet programs, utilities, compilers, interpreters, and communications programs).

d) Computer-related Documentation

Any documentation, operating logs and reference manuals regarding the operation of the computer equipment, storage devices or software.

Any passwords, password files, test keys, encryption codes or other information necessary to access the computer equipment, storage devices or data.
