case 3:11-mc-09065 document 1 filed 03/08/11 page …media.oregonlive.com/business_impact/other/heim...

Case 3:11-mc-09065 Document 1 Filed 03/08/11 of 39 Page ID#: 1

AO 106 (Rev. 7/87) Affidavit for Search Warrant ~

United States District CourtDISTRICT OF OREGON

In the Matter of the Search ofINama, address o~ Criof dosc~ipti0n o~ person. prope~y or ?ramisns to ba saarGhed)

The property located at 15825 SW 80th Avenue,Tigard, Oregon 97224; described as a two-storyresidence, beige with teal trim, a brown front doorthat faces east and the numbers "15825" on the garage

APPLICATION ANb-AFFIDAVITFOR SEARCH WARRA'YT

CASE NUMBER:

'11 -MC- 9 0 6 ~I, Special ALent Joseph R. LaMonica ,being duly sworn depose and say:

am a(n) Special Aqent - Federal Bureau of Investicaation and have reason to believeOfficial 'ille

that ~ on the person of or ~ on the property or premises known as came das~-~~~~~~ ~~.n~~~ ~~~ano~~

"I~he property located at 15825 SW Roth Avenue, l~igard, Oregon 97224; described as a two-stor}~ residence, beige~~~ith teal trim, a brown front door that faces east and the numbers "15825" on the garage.

in the District of OrePonthere is Hour concealed a certain person or property, Ida R~Iely (describe tha person or properly tO be seized)

See ~~~~~~~~~~~~B

W rllCh I$ (state one cr more bases for search anA sai~ure sal lorth under Rule 41(6) of the Fetleral Kules cf Criminal Procedure)

evidence, contraband, fruits, and instrumentalities ofcrimes against the United States,

concerning a violation of Title 18 United States code, Sections) 1341 & 1343The facts to support a finding of Probable Cause are as follows:

See Attached Affidavit of Special Joseph R LaMonica, hereby incorporated by reference as if fully restated herein.

Continued on the attached sheet and made a part hereof. ~ Yes ~ No

/ ~, ~ /

Si tur of Affiant

Sworn to before me, and subscribed in my presence

March 8, 2011 at Portland, OregonDate amity and State _

Janice M. StewartUnited States Magistrate JudgeName and Title of Judicial Officer Signature of Judicial Officer


State c~f~nregon )SS

C~~u~Ity of Multnomah)

I, Joseph R. LaMonica, being first duly sworn, depose and say:

I am a Special Agent of the I'edcral Bureau of Investigation (FBI), t;nited States

Department of Justice, and have been employed in this capacity for 19 years. I am currently

assigned to the Pr~i-tland, Oregon, office of the FBI. I am currently assigned to the White Collar

Crime Squad, where my duties include the investigation of fraud, including Mail Fraud, Fraud

by Wire, Bank Fraud and other federal violations.

2. This afftdavit is submitted in support of an Application for Search Warrant for

evidence, contraband, fruits, and instc~umentalities of violations of Title 18, United Slates Code,

Section 1341, Mail Fraud, and "I_itle 18, United States Code, Section 1343, Fraud by Wire. As

set forth below, t have probable cause to believe that such items, as set forth in Attachment B,

which is attached hereto and incorporated herein by this reference, are currentl}~ on the premises

located at 15825 SW 80th Avenue, Tigard. Ore~un 97224. The premises located at 15825 SW

80th Avenue, ~figard, Oregon 97224 is rnc~re fully described in Attachment A, which is attached

hereto and incorporated herein by this reference.

3. The facts set forth in this affidavit are based on the following: my own personal

knowledge; kn~~wledge obtained from other individuals during my participation in this

investigation, including other law enforcement officers: interviews of witnesses; my review of

records related to this investigation; communications with others who have knowledge of the

events and circumstances described herein; and information gained through my training and

experience. Because this affidavit is submitted for the limited purpose of establishing probable

AFFIDAVIT -Page 1


cause in support of the application for a search warrant, it does not set forth each and ever}' fact

that I or others have learned during the course of this investigation.

Title 18, United States Code, Section 1341, Mail Fraud, states, in part, that:

VJh~e~~er, having devised or intending to devise any scheme or artifice to defraud, or for

obtaining money or property by means of false or fraudulent pretenses, representations, or

promises...for the purpose ot~executing such a scheme or artifice or attempting to do so, places in

any past office or authorized depository for mail matter, any matter or thing whatever to be sent

or delivered by the Postai Service, or deposits or causes to be deposited any matter or thing

whatever to he sent or delivered by any private ar commercial interstate carrier, or takes or

receives therefrom, any such matter or thing, or knowingly causes to be delivered by mail or such

carrier according to the direction thereon, or at the place at which it is directed to be delivered by

the person to whom it is addressed, any such matter or thing, shall be tined under tI~is title or

imprisoned not more than 20 years, or both.

Title 18, United States Code, Section 1343, Fraud by ~~Jire, states that: Whoever,

having devised or intending to devise any scheme or artifice to defraud, or for r>btaining money

or property by means of false or fraudulent pretenses, representations, or promises, transmits or

causes to be transmitted by means of wire, radio, or television communication in interstate or

foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose cif executing

such a scheme ur artifice, shall be fined or imprisoned not more than 20 years, ~r both.

6. Based upon the facts set forth in this affidavit, I believe that there is probable

cause that LAWRF,NCE ~I~NRY HEIM devised and executed a scheme to defraud individuals

by illegally mailing invoices to the individual and causing then to mail payments to llim for the

nFFIDAVIT -Page 2


purchase of gold and silver coins that he did not deliver to them, in violation of Title 18, United

States Code, Section 1341, Mail Fraud, and Title 18, United States Code, Section 1343, Fraud by

Wire.

SCHEME TO DEFRAUD

7. The FBI is conducting an investigation of the activities of LAWRENCE HENRY

IIEIM, also known as (a.k.a.) LARRY HEIM. HEIM owned and operated a company known as

LJ.S. GOLD &SILVER INVEST:~~ENTS, INC. (USGSI) in Portland, Oregon. The scheme

involved HEIM promising to sell gold and silver coins to customers across the country through

USGSI. HELM would enter into transactions with customers who would then send checks to

HEIM in Portland, Oregon, typically via the U.S. Postal Service. HEIM would typically send

Invoices with details of the transaction to his customers via the li.S. Postal Service or- via fax.

HL-;IM would deposit the customers' checks into a Wells 1~'argo Bank account under the name

USGSI in the llistrict of Oregon. HEIM would not provide the customers with the gold and

silver coins that they had purchased. HI~1M we #sometimes promised his customers that he~.~~~

would send them a refund of their payment, but he c#i~d failed to send refunds to them.

1NVES"I'IGA"1'IV~; (~VE12VlEW

8. LAWRENCE HENRY HEIM owned and operatcd U.S. GOLD &SILVER

I'~1VF,STMENTS, II~C. (USGSI). As part of his business, HEIM has an Internet wcbsitc (or

USGSI at ~vww.tioirs.com/invest. Un the wcbsite, HELM identified himself as the President of~

USGSI, and provided his "calculation" of the future value of gold. HEI'~I promoted a radio

program that he hosted, and periodically posted his comments on the status of gold and silver

prices. As recently as February 14, 201 1, the wcbsitc instructed readers to "Buy gold and silver

AFFIDAVI"C - Pagc 3


NOVA': "l~he sell-off may be over. Remember, my calculations say that gold is going to $11,500

per ounce. That is about 8 times where it is right now. Call 800-631-8292 or 503-228-9553 and

buy now from U.S (sic) Gold &Silver. It is as easy as a phone call."

J. The ~vww.noirs.com/in~~est. website has recently been shut down, and there is a

notice on it that states "U.S. Gold &Silver Investments. Inc. has been a trusted business partner

since 1972. The current economic situation in the U.S. has been devastating for many small

businesses, and ours is no exception. We arc not currently accepting new clients, and are

working hard to resolve current clients' accounts. Thank you foe your patience. Sincerely,

Law7cnce I I. IIeim".

John Seeley

l0. On February 28, 2011, I spoke with Michael U. Uhlig, an attoi-~~ey representing

John Seeley. On March 1, 2011, Mr. Uhlig sent me a two-page letter via email with details

regarding Seeley's business dealings with LAWRENCE HL,IM. Also attac]ied tc~ the email ~~ere

copies of Seeley's documentation of his transactions with USGSI. Uhlig provided the follo~~~ing

information t~~ me: Seeley lives in Port Orchard, Washington. Seeley began investing with

USGSI in approximately 1998. Seeley has dealt exclusively with HEI'V1 when c~~nducting

transactions with USGSI. Seeley has purchased approximately $1 million in ~c~lc1 coins and

appr~ximatrly $500,000 in silver from USGSI. As part of their agreement, HEIM was to hold

the gold dins and silver for Seeley and pay him an amount of interest for holding it.

11. Al the instruction of Seeley, over the last 18 months Seeley's daughter, Janet

Ward, leas heen attempting to close Seeley's accounts at USGSI and collect his gild and sil~~er

ii~om HEIM. HEIM has obstructed and delayed this process nn several occasic~iis. In early

AFFIDAVIT -Page 4

Case 3:11-mc-09065 Document 1 Filed 03/08/11 of 39 Page ID#: G

February 201 1, Ward spoke with I-IEIM, and he assured her that he was in the process of closing

Seeley's accounts. Ward has not been able to contact HELM since then, and she has i~ot received

the balance of gold coins and silver HE1M was supposed to provide. USGSI is currently holding

200 Gold Eagle coins and 61 bags of 40°io silver that belongs to Seeley.

12. A review of the docurnentalion provided by Uhlig reveals that beginning no later

than April 2001, USGSI would send Invoices of transactions t~ Seeley at Port Orchard,

Washington. These Invoices were received by Seeley via the U.S. Postal Service.

Danny McElmoyl

13. I have spoken to Danny N1cElmoyl, who advised that on our about August 6,

2010, he purchased 100 one ounce Gold Eagle coins at a price of $1,2 8.00 each for a total of

S 125.800 from LARRY HEIM of USGSI. On or about August 6, 2010, McF.lmoyl sent to I [cim,

check number 66017 drawn on his business account in the name of McElmoyl Refrigeration,

made payable to t1SC'TSI in the amount of ~125,80U.U0. "The check was sent from Tulare,

California to HEIM in Oregon. McF,lrnoyl believes that the check was sent to P.O. Box 19435,

Portland, Oregon 97280, as that was the only address he had for IJSGSI. McElmoyl then

received a USCiSl Invoice number A7734 ~~ia the U.S. Postal Service. The envelope from

C 1SG51 had an August 6, 201 U, date and was mailed from zip code 97280.

l4. On ~~r about September 14, 2010, Mc~lmoyf purchased 1,500 one ounce Sil~~er

Fades at $22.36 each for a total ~f $33,540.00 from USGSI. Un September 14, 2010, McElmoyl

received a fax of an Invoice'~lumbered A7738 for the purchase of the Silver eagles from USGSI,

fax number (503) 603-9990. On or about September 15, 2010, McF,lmoyi sent check number

4151 drawn on his personal bank account, made payable to US Gold &Silver Invest~T~ents in the

AFFIDAVIT - Pagc 5

Case 3:11-mo-09065 Document 1 Filed 03/08/11 of 39 Page ID#:

amount of $33,540.00. McElmoyl sent the check to IJSGSI through the U.S. Postal Service.

15. McElmoyl provided me with copies of the two canceled checks that he had sent to

HEIM. A review ~f McElmoyl Refrigeration check number 66017 in the amount of $125,800.00

revealed that it was deposited on August 10, 201 U, at Wells Fargo Bank in Tigard, Oregon, into

account number XXX6896280 in the name of i1SGSI. A review of Danny McElmoyl check

number 4151 in the amount of $33,540.00 revealed that it vas deposited on September 21, 2010,

at Wells Fargo Bank in Tigard, Oregon, into the above-mentioned account in the name of

USGSI. As of the date of this affidavit, McElmoyl has neither received the Gold oc Silver eagles

that he paid for, nor has he received a refund from USUS1.

Tamara Wagner and William Medlock

16. I have spoken to Tamara Wagner on one occasion and another Special Agent in

my office has spoken to her on another occasion. Wainer advised that c,n or about August 6,

2010, she and her husband, William Medlock, purchased 100 ounces of gold coins from HF.IM.

They wrote a check from their Bank of America account payable to USGSI in the amount of

$126,000 and mailed it from California t~ HEIM'S P.n. Box in Portland, Oregon. HEIM cashed

their check in August 2010, but did not send them the fold coins. After cashing their check,

HEIM would call them approximately every two weeks and tell them he was having problems

with the mint that made the coins, and that he was trying to work it out. On February 12, 201 1,

V~'agner and Niedlock received a call from [IEIM, and he advised them the dispute could nut be

resolved. HEIM told them he would fully refund their money plus interest from Aubust 2010.

IIe told them he would call on February 18, 201 1, to c~lake arrangements for the refund. HEI~~

did not call Wagner and Medlock on February 18, 2011, and their subsequent attempts to contact

AFFIDAVIT -Pale 6


HF,IM have been unsuccessful. As of the date of this affidavit, Wagner and Medlock have not

received the gold coins they ordered, or a refund from HE1M.

Tlnnalri Fa~~in

17. 1 have spoken to llonald Fazzio on several occasions, and he advised me that in

October 2010, he purchased 140 one ounce Gold eagle coins at a price of $1,427.00 each for a

total of $199,780.00 from HEIM at USGSI. On or about October l 9, 201 ~, Fa~~i~ sent to HEIM,

check number 4103 drawn on his personal bank account payable to U.S. Gold &Silver in the

amount oI'$199,780.00. The coins were to be delivered to Fazzio no later January 18, ?010.

~~azzio mailed the check from Vancouver, Washington to USGSI at P.U. Box 19435, Portland,

Oregon 97280. II~CM then mailed USGSI Invoice number A7745 to Fazzio at his residence in

Vancouver, Washington. Included with the Invoice was a brochure fur American Eagle Gold

Bullion Coins with an address label of U.S. Gold &Silver, P.O. Box 19435, Portland, Oregon

97?80, telephone numbers (800) 631-829? and (503) 228-9553 and website address

~~~v~v.noirs.com/invest.

18. r'azzio provided a copy of canceled check number 4103. According to the

canceled check, on or about October 21, 2010, the check was deposited at Wells Fargo Bank in

Tigard, Oregon, into the above-mentioned account in the name of USGSI. Fazzio did not receive

the coins from USGSI, and telephonically contacted HEIM on several occasions. HEIM verbally

agreed to provide Fazzio with a full refund of $19~,7~0.00. As of the date of this affidavit,

Fazzio has not yet received the coins that he purchased or a refund from I IEIM.

ether victims

19. I have also spoken to other individuals or attorneys representing individuals who

nFFIUAVIT -Page 7


have purchased gold and/or silver from HIM through USGSI. They have sent their payments to

HEIM in Portland, Oregon, and their checks have been cashed by HEIM. They have not received

their coins or any refund from HEIM. At this point in the investigation, it is estimated that since

August 2010, HEIM has received approximately $2 million in gold and silver coin orders that he

has not fulfilled.

Patricia Heim

20. I have spoken to HEIM'S wife, Patricia Heim, who told me that she was the

bookkeeper and secretary for USGSI in the 1980s. HEIM is the sole owner of USGSI, and when

the business struggled and he couldn't afford to rent an office any longer, he moved the business

into their house in Tigard, Oregon. She moved out of the house in 2002, and has lived on her

own since then. Patricia Heim doubts that HEIM wotilcl keep any fold or silver in the house,

because it would not be very safe. She believes that he would keep gold or silver in the bank,

which is what he has done previously.

Wells Fargo Bank

21. I have reviewed records from Wells Fargo Rank for the account of L?S Gild &

Silver Investments, Inc. (USGSI), account number XXX6896280. According to the records,

USGST has two safe deposit boxes. numbered 1585 and 1X86. According to Wells Fargo Bank

representatives, these two boxes are both rented in the name of US Vold, they are both very

good-sized boxes, they are both located at the Tigard branch of Wells I'argo Bank. I I~IM last

entered the safe de~~osit bores on ~lovemher 12, 2008.

HEIM'S residence

22. According to the Oregon Department of Vlotor Vehicle records and public

Af~F1UAV1~1' - Yage 8


databases, I3EIM's address is 15825 SW 80th Avenue, Tigard, Oregon 97223. On February 22,

201 1, i went to 1 ~82~ SVV 80th Avemie, 'Tigard, Oregon 97224, and knocked nn the door. HELM

answered the door, but would not let me enter the residence. Heim would not answer any of my

questions and provided me with his attorney's telephone number.

23. The address HEI\~I used for USGSI on Invoices acid letters v~~as P.O. Box 1943>,

Portland, Oregon 97280. According to the U.S. Postal Inspection Service, that box is physically

located at 7805 S W 40th Avenue, Portland, Oregon 17219. According to the a}~plication,

Patricia A. Heim applied for the box in the names of U.S. Uold &Silver and Heim lirvestment

Services on August 1, 1986. Z'he address listed by Patricia Heim was 720 SW Washington

Street, ~i308, Portland, Oregon 97205. Un February 28, 2011, I went to 720 SW Washington

Street, Portland, Oregon and spoke to the building manager. She advised that the company she

works for has owned the building since 2008, and HE1M has not had an office in the building

during the time they've owned it. She was nit familiar with HEIM or USGSI, bul advised they

have received several calls from individuals looking for him there in the last week or two.

24. On Mardi 7, 2011, I spoke to Robert McCurtain, who has known HEIM for thirty

years, and used to work with him in Portland. McCurtain knows that HF,IM had a~i office in

cio~~town Portland many years ago, but believes he has been working out ~f his home. Also,

when I sp~~ke to Michael Uhlig regarding John Seeley's transactions with HEIM, he advised me

that Seeley's daughter, Janet Ward, would meet HEI'VI at different locations in the Portland area

when she picked up the gold and silver from him. "they never met at a single location such as ~~n

office for F~EIM.

25. Based upon my training and eaperience, I know that individuals involved in a

AFFIDAVIT - Pagc 9


business or income-producing activity such as the purchase and sale of gold and silver coins, w~i11

keep in their possession and at their residences, some or all of the following types of records:

cash, gold and silver coins, account Icdgers, logs of income and expenses, sales invoices, expense

invoices, purchase invoices, receipts of business transactions, bank account statements, cancelled

checks, bank deposit slips, bank withdrawal slips, check registers, safe deposit box keys and

records, asset purchase records, loan and liability records, balance sheets, diaries of business

activities, calendars, correspondence, notes and memorandums, emails, phone records, payroll

and employment records and ledgers, and journals summarizing business income and expenses. I

know that persons engaged in ~~~~~~~~~~~~that operate using cash keep records of their cash

transactions. I also know that individuals normally maintain records of their personal financial

acti~~ity, such as receipts for expenditures by cash or by check, bank records, and other financial

documents. These records often identify co-conspirators, the location oCbank accounts

associated with the fraudulent activit}~, and the identif cation of assets which were purchased

with fraudulently obtained fl~nds.

26. 1 know that individuals enga~ecl in criminal financial activities, such as mail and

wire fraud schemes, often maintain such records for long periods of time, particularly when they

are involved in ongoing criminal conduct over a long period of time. There are many reasons

why criminal ofCenclers maintain evidence for long periods of time. The evidence may be

innocuous at first glance (i.e. financial, credit card, and barilcing documents, travel documents,

receipts, documents reflecting purchases ~~f assets, personal calendars, telephone and address

directories, check books, videotapes and photographs, utility records, ownership records, letters

and notes, tai returns, and financial records, escrow files, teleph~~ne and eager bills, keys to safe

AFFIDAVIT -Page 10


deposit boxes, packaging mxteri~tls, computer hardware and software), but have significance and

relevance when considered in light of other evidence. The criminal offender may no loner

realize he/she possesses the evidence or may believe law enforcement could not obtain a search

warrant to scizc the cvidcncc.

27. Based on my training and experience, I know that individuals who are involved in

criminal financial activities, such as mail and ti~ire fraud schemes, will often keep their fin~incial

records at locations they feel are the most private and secure. Often, this location is their

personal residence. I also lalow that individuals will go to great measures to hide the location of

assets they have acquired as the result of their criminal acti~~ity, often placing assets in nominee

names such as corporate entities and trusts, which serve nn pur~~ose but to disguise the true

ownership of assets.

28. Based on my training, experience, and review of the evidence gathered in the

investigation thus far, the items to be seized at the location set forth in Attachment ~1,

incorporated herein by reference, for the period beginning January 1, 2000, through the date of~

this warrant, which constitute evidence, contraband, fruits and instrumentalities ~f violati~ils of

Title 18, United States Code, Section 1341, Mail Fraud, and Title 18, United States Code,

Section 1343, Wire Fraud, include the following:

a. Bank/Investment Account Records -All bank account, credit card account,

transfer agent and brokerage account records. Thcsc records to include signature

cards, cancelled checks, deposit slips, deposit receipts, passbooks, bank

statements, certificates of clep~~sit, stocks, bonds, wire transfer advises, wire

transfer confirmations, photos of assets, related bank advises, safe deposit box,

AFFIDAVIT - Pagc I 1


loan documents, loan applications, Iran payments recrn~ds, cashier's checks,

official checks and money order purchases, correspondence, other bank related

transaction documents, and any and all documents relating to personal, business,

foreign accounts in any foreign or domestic financial institution;

b. Cash and currency, including any packaging, bundling or notations, or other

ne~utiable instruments as evidence of the mail and wire fraud scheme end the

accumulation of proceeds of such scheme;

c. Gold and silver coins, including any packaging, bundling or notations;

d. Safe deposit box records and safe deposit box keys for airy box iii the names of

LAWP~ENCE HEI,v1, LARRY HIM, and/or USGSI;

e. Client/Account Files -All files or folders containing transaction records,

including contracts, account statements and transaction summaries, agreements,

schedules, invoices, receipts, and statements or other documents evidencing

purchases and sales of gold and silver coins;

f. Contractor/Employee Files -All files or folders containing transaction records

including employee or independent contractor contracts to perform work ur

provide services, account statements and transaction summaries, agreements,

schedules, and statements or other documents evidencing salaries or expenses

paid and services provided;

g. Stock Purchase Agreements -Any contracts or agreements for the purchase, sale

or transfer ~f stocks;

h. Corporation,~Trust Documents -Any corporation or trust infoi-~ilation, instnictions,

AFFIllAVI"I~ - Yagc 12


bylaws, corporate resolutions, trust agreements, templates, or literature including

documents showing assets, trustees, employees, or independent contractors;

i. Records ~f Receipt of~ Money -Any records of the receipt of funds by check, cash,

credit card, money order, cashier's check, wire transfer or securities;

j. Records of Disbursements -Any records of disbursements or invoices to include

payments by check, cash, credit card, cashier's check, money order, wire transfer,

or securities or the purchase of assets shown by invoices, bills, faxes, or other

documents establishing the purpose or recipient of the expenditure, including

records of mailing ~r shipping such disbursements;

k. Iteeords, information or elocurnents that reflect the receipt and disposition of

funds or property, cars, boats, any vehicle, jewelry, artwork, any and all other

assets owned and sold;

I. Applic~ti~ns for credit, financial statements, credit files acid all records relating to

credit applications, credit accounts, credit cards, loan applications, cash and loans;

m. Records of purchase or dispositions of cashiers checks, money orders, wire

transfers and other negotiable instruments;

n. Sales journals, general ledgers, general journals, purchase journals, summaries,

reconciliations, work papers relating to revenues, ex~~enses, accounts receivable,

accounts payable, assets, liabilities, owners equity, purchase ~f goods for resale,

depreciation of assets, a~llortization of intangible assets, invent~~ries of goods,

materials, supplies and products, payroll information, employees with}wldings,

monthly reports and other business bookkeeping and accounting records;

o. Invoices, statements, receipts, documents, records or other items that reflect

Ar'FID~VIT -Page 13


receipt of income or funds, payment of cxpcnscs or liabilities, accuniulatic~n or

disposal of assets and any other item produced reflecting business or income

producing transactions;

p. Photos, passports, photo identification and other identification for aliases or

nominees use by LAWRENCE IIEIM, LARRY HF,iM, and/or USGSI;

q. Records of storage lockers and storage locker keys or access codes maintained by

LAVVRENC~, HEIM, LARRY II~IM, and/or i;SCTSi;

r. Financial statements, including income statements, balance sheets, and statements

of retained earnings, and cash flow statements;

s. Documents relating to corporate or business history of any assumed business

name or entity, including the corporate minute hook, incorporation documents,

stock transfer register, and corporate dissolution documents;

t. Records, documents, books, files, correspondence, other articles or information

relevant to the computation of the federal income tax liability of LAWRENCE

HELM, LARRY I I~IM, and/or USCiST;

u. Correspondcncc to and from i,AWRF.NCE HEIM, LARRY HEIM, and/or

~~~~~~~~including letters, cards, other written correspondence, facsimiles, e-mails,

printed c-mails, taped messages such as answering machine messages, and videos;

v. Western Union receipts, i.S. Postal Money Order receipts, and receipts of other

money exchanging businesses;

~v. "l~elephone records, cell phone records, including itemized billing and individual

toll records, address books, telephone hooks, cell phone telephone and address

books, personal digital assistants, and rolc~clex;

AFFIDAVIT -Page 14


x. Printout of facsimile transmissions both sent and received concerning

LAWRENCE HEIM, LARRY HEIM, and/or USGSI;

y. Traveler's checks, copies of traveler's checks receipts, currency (U.S. or foreign);

z. Names or other identifiers of persons associated with LAWRENCE HEIM,

LARRY HEIM, and/or USGSI, including owners, employees and customers; any

independent or employee payment records, employment a}?plicati~ns, personnel

service contracts, photographs of employees, all business phones and other

electronic phone equipment, including pagers and portable phones, and their

contents; any items of identification, receipts from A"l NI purchases;

aa. IRS Records/Correspondence -Any tax returns or correspondence with the IRS

including notices and letters from the IRS, iiicludiil~ copies of federal and state

income tax returns for trusts, corporations, and limited liability companies and

related tax preparation documents such as forms 1099, W-2 forms, Forms 11205,

Forms K-1, Forms 1040, Forms 1065, ~~orms 990, ~~orms 941, and documentation

or correspondence evidencing dealings with an accountant or tax preparers

hb. Records of any bankruptcy filings on behalf of LAWRENCE HEIM, LARRY

HEIM, and/or USGSI;

Digital Evidence

cc. nll computers, including any electronic or digital device capable of storing and/or

processing data in digital form, including central processing units; laptop or

notebook computers; personal digital assistants; wireless conununication devices

such as telephone pa~in~ devices, beepers, and cellular telephones; peripheral

input/output devices such as keyboards, printers, scanners, plotters, monitors, and

AFFIDAVIT -Page 15

Case 3:11-mc-09065 Document 1 Filed 03/08/11 of 39 Page ID#: 1 7

drives intended for removable media; related communication devices such as

modems, routers, cables, and connections; storage media; and security devices;

dd. Any equipment used to facilitate the transmission, creation, display, encoding, or

storage of~ digital data;

ee. Any magnetic, electronic, or optical storage device capable of storing data, such as

floppy disks, hard disks, tapes, CD ROMs, CD-Rs, CD-RWs, DVDs, optical

disks, printer or memory buffers, smart cards, PC cards, memory calculators,

electronic dialers, and electronic notebooks;

ff~. Any documentation, operating logs, and refercncc manuals regarding the

operation ofi the digital device or software used in the digital device;

fig. An}' applications, utility programs, compilers, interpreters, and other software

used to facilitate direct or indirect communication with the digital device;

hh. nn}~ physical keys, encryption devices, dongles, and similar physical items that

arc necessary to gain access to the digital device or data stored on the digital

device;

ii. Any passwords, password files, test keys, encryption codes, or other information

necessary to access the digital device or data stored on the digital device;

jj. Al] records, documents, programs, applications or materials created, modified, or

stored in any form, including in digital form, on any computer or digital device,

that show the actual users) of the computers or digital devices during the period

between .lanuary 1, 2000, and present, including the web browser's history;

temporary Internet ftles; cookies, bookmarked or favorite web pages; email

addresses used from the computer; MAC IDs and/or Internet Protocol addresses

~1FFIDAVI"1, - Yage 16


used by the computer; email, instant messages, and other electronic

commu~iications; address books; contact lists; records of social networking and

online service usage; and software that would allow others to control the digital

device such as viruses, Trojan horses, and other fornls of malicious software.

Search and Seizure of Digital Data

29. This application seeks permission to search for and seize evidence of the crimes

described above, including evidence of how computers, digital devices, and digital

storage media were used, the purpose of their usc, and who used them.

30. Based upon my training and experience, and information related to me by agents

and others involved in the forensic examination of computers and digital devices, I

know that data in digital form can be stored on a variety of systems and storage devices,

including hard disk drives, floppy disks, compact disks, magnetic tapes, flash drives,

and memory chips. SoiY~e of these devices can be smaller than a thumbnail and can take

several forms, including thumb drives, secure digital media used in phones and

cameras, personal music devices, and similar items.

Removal of Data Storage Devices

31. I know that a forensic image is an exact physical copy of the data storage media.

A forensic image captures all data on the subject media without viewing or changing

the data in any way. Absent unusual circumstances, it is essential that a forensic image

be obtained prior to conducting any search of data fir itif~rmation subject to seizure

pursuant to the warrant. I also know that during the search of the prei~~ises it is not

always possible to create a forensic image of or search digital devices or media fur data

fur a number of reasons, including the following:

AFFIDAVIT -Page 17


a. Searching digital devices can he a highly technical ~~rocess that requires

specific expertise and specialized e9uipment. Because there are so many different

types of digital devices and software in use today. it is difficult to anticipate all of

the ncccssary technical ma~luals, specialized cquipmcnt, and specific cxpertise

necessary to conduct a thorough search of the media to ensure that the data will be

preserved and evaluated in a useful manner.

b. Searching digital devices can require the use of precise, scientific procedures

designed to maintain the integrity of the evidence and to recover latent data not

readily apparent to the casual user. The recovery oi~such data may require the use

of special software and procedures, such as those used in a law enforcement

laboratory.

c. The volume of data stored on many digital devices is typically so large that it

will be highly impractical to search for data during the execution of the physical

search of~the premises. Storage devices capable of~ storing 500 gigabytes of data

are nov~~ commo»place in desktop computers. It can take several hours, or eve~l

days, to image a single hard drive. The larder the drive, the longer it takes.

Depending upon the number and size of the devices, the length of time that agents

must remain onsite to image and examine digital devices can become impractical.

Laboratory Settine Mav Be Essential For Complete And Accurate Analysis Uf Data

32. Since digital data may be vulnerable to inadvertent modification or destruction, a

controlled envirolunent, such as a law enforcement lab~rat~ry, may he essential to

conduct a complete and accurate analysis of the digital devices from which the data will

be extracted. Soft~~~are used in a laboratory setting can often reveal the true nature of

~1FF1D~IVIT -Page 18


data. Therefore, a computer forensic reviewer needs a substantial amount of time to

extract and sort through data that is concealed or encrypted to determine whether it is

evidence, contraband, or an instrumentality of a crime.

33. Analyzing the contents of a computer or other electronic storage device,

even without significant technical difficulties, can be very challenging, and a variety of

search and analytical methoels imist be used. For example, searching by keywords,

which is a limited text-based search, often yields thousands of hits, each of which must

be reviewed in its context by the examiner to determine whether the data is within the

scope of the warrant. Merel}~ finding a relevant hit does nit encl the review process.

The computer may have stored information about the data at issue which may not be

searchable text, such as: who created it; when and ho~v it was created, downloaded, or

co~~ied; when it was last accessed; when it was last modified; when it was last printed;

and when it was deleted. The relevance of this kind of data is often contextual.

Furthermore, many common email, database, and spreadsheet applications do not store

data as searchable text, thereby necessitating additional search procedures. To

determine who created, tnuclitied, copied, downloaded, transferred, communicated

about, deleted, or printed data requires a search of events that occurred on the computer

in the time periods surrounding activity regarding the relevant data. Information about

which users logged in, whether users shared passwords, whether a computer was

connected to other computers or networks, and whether the users accessed or used other

programs or services in the relevant time period, can help determine who was sitting at

the keyboard.

A. Lutent Da[a: Searching digital devices can require the use of precise, scientific:

AFFIDAVIT -Pale 19

Case 3:11-mc-09065 Document 1 Filed 03/08/11 of 39 Page iD#: 21

procedures designed to maintain the integrity of the evidence and to recover latent data.

1'he recovery of such data may require the use of special software and procedures. Data

that represents electronic files or remnants of such files can be recovered months or

even years after it has been downloaded onto a hard drive, deleted, or viewed via the

Internet. Even when such files have been deleted, they can be recovered months or

years later using readily available forensic tools. Norn~ally, when a person deletes a file

on a computer, the data contained in the file does not actually disappear; rather, that

data remains on the hard drive until it is overwritten by new data. Therefore, deleted

files, or rernnailts of deleted files, may reside in space on the hard drive or other storage

media that is not allocated to an active file. In addition, a computer's operating system

may keep a record of deleted data in a swap or recovery file or in a program specifically

designed to restore the computer's settings in the event of a system failure.

B. Contextual Data:

1. In some instances, the computer "writes" to storage media without the specific

knowledge or permission of the user. Generally, data or files that have been

received via the Internet are automatically downloaded into a temporary Internet

directory or cache. The browser typically maintains a fixed amount of hard drive

space devoted to such data or files, and the files are only overwritten as they are

replaced with chore recently viewed Internet pales. Thus, the ability to retrieve

artifacts of electronic activity from a hard drive depends less on when the file was

downloaded or viewed than on a particular user's operating system, storage

capacity, and computer usage. Logs of access to wehsites, file

managemenUtransfer programs, fire~vall permissions, and other data assist the

AFFIllf1VIT -Pale 20


examiner and investigators in creating a "picture" of what the computer was cloin~

and how it was being used during the relevant time in question. Given the

inlen-elationships of the data to various parts of the computer's operation, this

information cannot be easily segregated.

2. Digital data on the hard drive that is not currently associated with any file may

reveal evidence of a file that was once on the hard drive but has since been deleted

or edited, or it could reveal a deleted portion of a file (such as a paragraph that has

been deleted from a word processing file). Virtual memory paging systems can

leave digital data on the hard drive that show what tasks and processes on the

computer were recently used. Web browsers, email programs, and chat programs

store configuration data nn the hard drive that can reveal information such as

online nicknames and passwords. Operating systems can record additional data.

such as the attachment of~periphcrals, the attachment of US~3 Clash storage

devices, and times the computer was in use. Computer file systems can record

data about the dates files were created and the sequence in which they were

created. This data can be evidence of a crime, indicate the identity of the user of

the digital device, or point toward the existence of evidence in other locations.

Such data may' also lead to exculpatory evidence.

3. Further, evidence of how a digital device has been used, what it has been used for.

and who has used it, may he learned fi~oin the absence of particular data on a

digital device. Specifically, the lack of computer securit~~ software, virus

protection, malicious software, evidence of remote control by another computer

system, or other programs or software may assist in identifying the user indirectly

AFFIDAVIT -Page 21


and may provide evidence excluding other causes fc.~r the presence or absence of

the items sought by this application. Additionally, since computer drives may

store artifacts from the installation ~f software that is no loner active, evidence ot~

the historical presence of the kind of software and data described may have

special. significance in establishing timelines of usage, confirming the

identification ~f ~~~~~~~~~users, establishing a point of ~~~~~~~~~~~for usage and; in

some cases, assisting in tl~e identification of certain users. This data can be

evidence of a crime, can indicate the identity of the user of the digital device, or

can ~~oint toward the existence of evidence in other locations. Such data may also

lead to exculpatory evidence. Evidence of the absence of particular data on the

drive is not generally capable of being segregated from t}~e rest of the data on the

drive.

Search Procedure

34. In searching for data capable of being read, stored, or interpreted by a computer or

storage device, law enforcement personnel executing the search warrant will employ the

following procedure:

a. On-site search, ifproctic~ahle. Law enforcement officers trained in computer

forensics (hereafter, "computer personnel"), if present, may be able t~ cletennine ii~

digital devices can be searched on-site in a reasonable amount of time and without

je~pardi~ing the ability to preserve data on the devices. If such an on-site search

can be conducted, the reviewing persoru~el will attempt to seize data falling within

the list of items to be seized as set forth in the warrant and in Attachment ~3.

b. Un-site ima~7ing, iTJ~rncticahle. If a digital device cannot be searched o~1-site as

AFFIDAVIT -Page 22


described above, the computer personnel will determine whether the device can be

imaged ~n-site in a reasonable amount of time without jeopardizing the ability to

preserve the data.

c. Seizure of digital devices fnr oJf-site imaging and search. Tf no computer

personnel are present at the execution of the search warrant, or if they determine

that a digital device cannot be searchec3 or imaged on-site in a reasonable amount

of time and without jeopardizing the ability to preserve data, the digital device

will be seized and transported to an appropriate law enforcement laboratory for

rcvtcw.

cl. I,aw enforcement personnel will examine the digital device to extract and seize

anv data that falls within the list of items to he seized as set forth in the warrant

and in Attachment B. T'o the extent they discover data that falls outside the scope

of the warrant that they believe should be seized (e.g., contraband or evidence of

other crimes), they will seek an additional warrant.

e. I.aw enforcement personnel will use procedures designed to identify items to be

seised under the warrant. "These procedures may include the use of a "hash value"

library to exclude normal operating system files t}iat do not need to be seai•clled.

In addition, law enforcement personnel may search for and attempt to recover

deleted, hidden, or encrypted data to determine whether the data falls ~~~ithin the

list of items to be seized under the warrant.

f. If the digital device was seized or imaged, law enforcement personnel will

perform an initial search the original digital device or image within a reasonable

amount of time not to exceed 120 days from the elate of execution of the warrant.

AFFiI~AVIT -Page 23


If, after conducting the initial search, law enforcement personnel detern~ine that an

original digital device contains any data falling ~vit}iin the list of items to be seized

pursuant to this warrant, the government will retain the original cligital device to,

among other things, litigate the admissibility/authenticity of the seized items at

trial, ensure the integrity of the copies, ensure the adequacy of chain of custody,

and resolve any issues regarding contamination of the evidence. If the

government needs additional time to determine whether an rn-iginal digital device

ur ~~~~~~~contains any data falling within the list of items to be seized pursuant to

this warrant, it may seek an extension of the time period from the Court within the

original 120-day period from the date of execution of the warrant. The

government shall complete the search of the digital device or image within 180

days of the date of the execution of the warrant. 1f the ~~vernment needs

aciclitional time to complete the search, it may seek an extension of the time period

from the Court within the original 180-day period from the date of the execution

of the warrant.

g. If, at the conclusion of the search, law enforcement personnel determine that

particular tiles or file folders on an original digital device or irTlage do not contain

any data falling within the list of items to be seized pursuant to the warrant, they

will not search ur examine those files or folders further without authorization

from the Court. Law enforcement personnel may continue to examine files or

data falling within the list of items to be seii.ed pursuant to tkzc warrant, as well as

data within the operating system, file system, or softwa~~e application relating or

pertaining to files or data falling within the list of itetms to be seized pursuant to

AFFIDAVIT -Page 24

Case 3:11-mc-09065 Document 1 Filed 03/08/11 of 39 Page ID#: 2G

the warrant (such as log files, registry data, and the like), through the conclusion

of the case.

h. If an original digital device does not contain any data falling within the list of

items to be seized pursuant to this warrant, the government will return that

original data device to its o~mer within a reasonable period of time following the

search of that original data device and will seal any image of the device, absent

further authorization from the Court.

Data to be Seized

35. In order to search for data that is capable of being read or interpreted by a

computer, law enforcement personnel will need to seize, image, copy, and/or search the

following items, subject to the procedures set forth herein:

a. Any computer equipment or digital devices that are capable of being used to

commit or further the crimes outlined above, or to create, access, or store the types

of evidence, contraband, fruits, or instrumentalities of such crimes, as set forth in

Attachment B;

b. Any computer equipment or digital devices used to facilitate the transmission,

creation, display, encoding, or storage of data, including word processing

equipment, modems, docking stations, monitors, printers, plotters, encryption

devices, and optical scanners that are capable of being used to commit or further

the crimes outlined above, or to create, access, process, or store the types of

evidence, contraband, fruits, or instrumentalities of such crimes, as set forth in

Attachment B;

c. Any magnetic, electronic, or optical storage device capable of storing data, such as

AFFIDAVIT -Page 25


Iloppy disks, hard disks, tapes, CD-ROVIs, CD-Rs, CD-RWs, DVDs, optical

disks, printer or memory buffers, smart cards, PC cards, memory calculators,

electronic dialers, electronic notebooks, personal digital assistants, and cell

phones capable of being used to commit or further the crimes outlined above, or

to create, access, or store the types of evidence, contraband, fruits, or

instrumentalities of such crimes, as set forth in Attachment B;

d. Any documentation, operating logs, and reference manuals regarding the

operation of the computer equipment, storage devices, or software;

e. Any applications, utility programs, compilers, interpreters, and other software

used to facilitate direct or indirect communication with the computer hardware,

storage devices, or data to be searched;

f. Any physical keys, encryption devices, dongles, or similar physical items that are

necessary to gain access to the computer equipment, storage devices, or data: and

~. Any passwords, password files, test keys, encryption codes, or other information

necessary to access the computer equipment, storage devices, or data.

h. All records, documents, programs, applications or materials created, modified, or


that show the actual users) of the computers or digital devices during the time

period between January 1, 2000, and present, including the web browser's history;

temporary Internet files; cookies, bookmarked or favorite web pages; email

addresses used from the computer; MAC IDs and/or Internet Protocol addresses


communications; address books; contact lists; records of social networking and

AFFIDAVIT -Page 26



device such as viruses, "l~rojan horses, and other fornis of malicious software.

36. The goverrunent has made the following prig efforts in other judicial fora to

obtain the evidence sought in the warrant: knowledge obtained from other law

enforcement officers; issuance of grand jury subpoenas; my review of financial records

related to the investigation; and information gained through my training and experience.

Retention of Image

37. The government will retain a forensic image of each electronic storage device

subjected to analysis for a number of reasons, including pr~~ving the authenticity of

evidence to be used at trial; responding to questions regarding the corruption of data;

establishing the chain of custody of data; refuting claims oC fabricating, tampering, or

destroying data; and addressing potential exculpatory evidence claims where, for

example, a defendant claims that the government avoided its obligations by destroying

data or returning it to a third party.

Inventory and Return

38. Vb'ith respect to the seizure of electronic storage media or the seizure or imaging

of electronically stored information, the search warrant return to the Court will describe

the physical storage media that were seized or imaged.

Conclusion

39. Rased on the foregoing, 1 have probable cause to believe that T,AWRENC~ II.

HF,ivi, also known as LARRY H~;1M, devised and intended to devise a material scheme

to defraud the above listed individuals, and others, in violation of Title 18, United States

C~~cie, Section ]341, Mail Fraud and Title 18, United States Code, Section 1343, Fraud

AFFIDAVIT -Page 27


by Wire, and that F,vidence, Contraband, Fruits and Instn~mentalities of those offenses,

as more fully described in Attachment B hereto, are presently located at 15825 SW 80'°

Avenue, "l~igard, Oregon 97224, more fully described in Attachment A. 1 therefore

request that the court issue a warrant authorizing a starch of the premises for the items

listed in Attachment B, and the seizure and examination of any such items found. This

affidavit, the accompanying application, and the requested search warrant were all

reviewed by Assistant United States Attorney (AUSA) Claire M. Fay prior to being

submitted to the court. AUSA Fay informed me that in her opinion, the afrdavit and

application are legally and factually sufficient t~ establish probable cause to support the

issuance ~f the requested warrant.

U 'E R. LAMONICA~cial Agent -FBI

Subscribed and sworn to before me on this ~dav of March, 2011.

Z~' CThe onorable anice M. StewartU. .Magistrate JudgePortland, Oregon

AFFTI~AVIT -Page 28


Al"1'ACH'VIENT ALocation to be Searched

Based on the information contained in this affidavit, I am requesting a warrant to searchthe following location:

"rhe property located at 15825 SW 80th A~~enue, "Tigard, Oregon 97224; described as atwo-story residence, beige with teal trim, a brown front door that faces east and the numbers" 1 ~ 825" on the garage.


ATTACHMENT 13Items to be Searched For, Seized, and F,xamined

The items to be seined are the following books and records, documents, con~espondence,

equipment, tiles and other information pertaining to LAWRENCE HF.,[M, aka LARRY HEIM,

and USUSI and found in the location set forth in Attachment A, incorporated herein by reference,

for the period beginning January 1, 2000, through the date of this wan-ant, which constitute

evidence, contraband, fruits, aricl/or instrumentalities of violations of Title 1 R, united States

Code, Section 1341, Wire Traud; and Title 18, United States Code, Section 1343, Wire Fraud:

a. f3ank/Investment Account Records -All bank account, credit card account,

transfer agent and brokerage account records. These records to include signature carcjs, cancelled

checks, deposit slips, deposit receipt~, passbooks, bank statements, certificates of deposit, stocks,

bonds, wire transfer advices, wire transfer confirmations, photos of assets, related hank advices,

safe deposit box, loan documents, loan applications, loan payments records, cashier's checks,

official checks and money order purchases, correspondence, other bank related transaction

documents, and any and all documents relating to personal, business, foreign accounts in any

foreign or domestic financial institution;

b. Cash and currency, including any packaging, bundling or notations, or other

negotiable instruments as evidence of the mail and wire fraud scheme and the accumulation cif

proceeds of such scheme;

c. Gold and silver coins, including any packaging, bundling or notations;

d. Safe deposit box records and safe deposit box keys for any box in the names ~f

LAWRENCE HEIM, LARRY HEIM, and/or i1SGSI;

e. Client/Account Files -All files or folders containing transaction records,


including contracts, account statements and transaction summaries, agreements, schedules,

invoices, receipts, and statements or other documents evidencing purchases and sales of gold and

silver coins;

f. Contractor/Employee Files -All files or folders containing transaction records

including employee or independent contractor contracts to perform work or provide services,

account statements and transaction summaries, agreements, schedules, and statements or other

documents evidencing salaries ~r expenses paid and services provided;

g. Stock Purchase Agreements -Any contracts or agreements for the purchase, sale.

or transfer of stocks;

h. Corporation/Trust Documents -Any corporation or trust information, instructions,

bylaws, corporate resolutions, trust agreements, templates, or literature including documents

slowing assets, trustees, employees, ~r independent contractors;

Records of Receipt of Money -Any records of the c-eceipt of funds by check, cash,

credit card, money order, cashier's check, wire transfer or securities;

j. Records of Disbursements -Any records of disbursei~lents or invoices to include

payments by check, cash, credit card, cashier's check, money order, wire transfer, or securities or

the purchase of assets shown by invoices, bills; faxes, or other documents establishing the

purpose or recipient of the expenditure, including records of mailing or shipping such

disbursements;

k. Records, information or documents that reflect the receipt and disposition of

binds or prope~y, cars, boats, any vehicle, jewelry, artwork, any and all other assets owned and

sold;

Applications for credit, financial statements, credit files and all records relating to


credit applications, credit accounts, credit cards, loan applications, cash and loans;

m. Records of purchase or dispositions of cashiers checks, money orders, wire

transfers and other negotiable instruments;

n. Sales journals, general ledgers, general journals, purchase jotimals, summaries,

reconciliations, work papers relating to revenues, expenses, accounts receivable, accounts

payable, assets, liabilities, owners equity, purchase of goods for resale, depreciation of assets,

amortization of intangible assets, inventories of goods, materials, supplies and products, payroll

information, ernployees withholdings, monthly reports and other business bookkeeping and

accounting records;

Invoices, statements, receipts, documents, records or other items that reflect

receipt of income or funds, payment of expenses or liabilities, accumulation or disposal of assets

and any other item produced reflecting business or income producing transactions;

p. Photos, passports, photo identification and other identification for aliases or

nominees rise by LAWRENCE HEIl~1, LARRY HEIM, and/or USGSI;

Records of storage lockers and storage locker keys or access codes maintained by

LAWRENCE HEIM, LARRY HEIM, and/or USGSI;

Financial statements, including income statements, balance sheets, and statements

of retained earnings, and cash flow statements;

s. Documents relating to corporate or business history of any assumed business

name or entity, including the corporate minute book, incorporation documents, stock transfer

register, and corporate dissolution documents;

Records, documents, books, files, correspondence, other articles or information

relevant to the computation of the federal income tax liability of LAWRENCE HEM, LARRY

H~1M, and/or USGSI;

Case 3:11-mc-09065 Document 1 Fred 03/08/11 of 39 Page ID#: 34

u. Correspondence to and from LAWRENCE HEIM, LARRY HELM, and/or

USGSI, including letters, cards, other written correspondence, facsimiles, e-mails, printed

e-mails, taped messages such as answcrin~ machine messages, and videos;

v. Western Union receipts, U.S. Postal Money Order receipts, and receipts of other

money exchanging busi~iesses;

w. Telephone records, cell phone records, including itemized billing and individual

toll records, address books, telephone books, cell phone telephone and address books, personal

digital assistants, and rolodex;

x. Printout of facsimile transmissions both sent and received concerning

LAWkENCE HEIM, LARRY HELM, and/or USUSI;

y. Traveler's checks, copies of traveler's checks receipts, currency (U.S. ar foreignl;

z. Names or other identifiers of persons associated with LAWKENCL HEIM,

LARRY HEIM, and/or USGSI, including owners, employees and customers; any independent or

employee payment records, employment applications, personnel service contracts, photographs

of employees, all business phones and other electronic phone equipment, including pagers and

portable phones, and their contents; any items of identification, receipts from A1~M purchases;

aa. IRS Records/Correspondence -Any tax returns or correspondence with the IRS

including notices and letters from the IRS, including copies of federal and state income tax

returns for trusts, corporations, and limited liability companies and related tax preparation

documents such as farms 1099, W-2 foetus, Forms ] 120S, Forms K-1, corms 1040, Forn~s 106.5,

Forms 990, Forms 941, and documentation or correspondence evidencing dealings with an

accountant or tax preparers

bb. Records of any bankruptcy filings on behalf of I.AWRENCF, HEIM, LARRY

H~IVI, and/or USGSI;


Digital Evidence

cc. All computers, including any clectronic or digital device capable of storing and/or

processing data in digital form, including central processing units; laptop or

notebook computers; personal digital assistalits; wireless communication devices

such as telephone paging devices, beepers, and cellular telephones; peripheral

input/output devices such as keyboards, printers, scanners, plotters, monitors, and

drives intended for removable media; related communication devices such as

modems, routers, cables, and connections; storage media; and security devices;

dd. Any equipment used to facilitate the transmission, creation, display, encoding, or

storage of digital data;

ee. Any magnetic, electronic, or optical storage device capable of storing data, such as

floppy disks, hard disks, tapes, CD ROMs, CD-Rs, CD-RWs, DVDs, opticzl

disks, printer or memory buffers, smart cards, PL cards, memory calculators,

electronic dialers, and electronic notebooks;

ff. Any documentation, operating logs, and reference manuals regarding the

operation cif the digital device or software used in the digital device;

gg. Any applications, utility programs, compilers, interpreters, anc3 other software

used to facilitate direct or indirect communication with the digital device;

hh. Any physical keys, encryption devices, donglcs, and similar physical items that

are necessary to gain access to the digital device or data stored on the digital

device;

ii. Any passwords, password files, test keys, encryption codes, or other infornlation

necessary to access the digital device or data stored on the digital device;

jj. All records, documents, programs, applications or materials created, modified, or



that show the actual users) of the computers or digital devices during the period

between January 1, 2000, and present, including the wcb browser's history;

temporary Internet files; cookies, bookmarked or favorite web pages; email

addresses used from the computer; MAC Ills and/or Internet Protocol addresses


communications; address books; contact lists; records of social networking and


device such as viruses, Trojan horses, and other forms of malicious sofrware.

Search Procedure

kk. In searching for data capable of being read, stored, or interpreted by a computer

or storage device, law enforcement personnel executing the search warrant will

employ the following proced~il-e:

On-site search, if practicable. Law enforcement officers trained in

computer forensics (hereafter, '`computer personnel"), if present, may be able to

determine if digital devices can be searched on-site in a reasonable amount of time

and without jeopardizing the ability to preserve data on the devices. Any device

searched on-site will be seized only if it contains data falling within tl~e list of

items to be seized as set forth in the warrant and in Attachment B.

2. Un-site imaging, if practicable. If a digital device cannot be

searched on-site as described above, the computer personnel, if present, ~~~ill

determine whether the device can be imaged nn-site in a reasonable amount of~

time without jeopardizing the ability to preserve the data.

3. Seizure oJdigital devices for off-site imaging and search. If no


computer personnel are present at the execution of the search warrant, or if they

determine that a digital device cannot be searched or imaged on-site in a

reasonable amount cif time and without jeopardizing the ability to preserve data,

the digital device will be seized and transported t~ aii appropriate law enforcement

laboratory for review.

4. Law enforcement personnel will examine the digital device to

extract and seize any data that falls within the list of items to be seized as set i'orth

in the warrant and in Attachment B. To the extent they disco~~er data that falls

outside the scope of the warrant that they believe should be seized (e.g.,

contraband or evidence of other crimes), they will seek an additional warrant.

5. I,aw enforcement personnel will use procedures designed to

identify items to be seized under the warrant. These procedures may include the

use of a "hash value" library to exclude normal operating system files that do not

need to be searched. In addition, law enforcement personnel may search for and

attempt to recover deleted, hidden, or encrypted data to determine whether the

data falls within the list of items to be seined under the warrant.

6. If the digital device was seized or imaged, law enforcement

personnel will perform an initial search of the original digital device or image

within a reasonable amount of time not to exceed 120 days from the date of

execution of the warrant. If after conducting the initial search, law enforcement

personnel determine that an original digital device contains any data falling within

the list of items to be seized pursuant to this w~-rant, the government will retain

the original digital device to, among other things, litigate the

admissibility/authenticity of the seized items at trial, ensure the integrity of the


copies, ensure the adequacy of chain of custody, and resolve any issues regarding

contamination of the evidence. If the govercunent needs additional time to

determine whether an original digital device or image contains any data falling

within the list of items to be seined pursuant to this warrant, it may seek an

extension of the time period from the Court within the original 120-day period

from the date of execution of the warrant. The government shall complete the

search of the digital device or image within 180 days of the date of execution of

the warrant. If the government needs additional time to complete the search, it

may seek an extension of the time period from the Court within the original 180-

day period from the date of execution of the warrant.

7. If, at the conclusion of the search, law enforcement personnel

determine that particular files or file folders on an original digital device or image

do not contain any data falling within the list of items to be seized pursuant to the

warrant, they will not search or examine those files or folders further without

authorisation from the Court. Law enforcement personnel may continue to

examine files or data falling within the list of items to be seined pursuant to the

warrant, as well as data within the ~~~~~~~~~~~system, file system, or software

application relating or pertaining tc~ files or data falling within the list of items to

be seized pursuant to the warrant (such as Iog file, registry data, and the like),

through the conclusion of the case.

8. If an original digital device does not contain any data falling within

the list of items to be seized pursuant to this warrant, the government will return

that original data device to its owner within a reasonable period of time followinb

the search of that original data device and will seal any image of the device,


absent further authorization from the Court.