Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 1 of 39 Page ID#: 1
AO 106 (Rev. 7/87) Affidavit for Search Warrant ~
United States District CourtDISTRICT OF OREGON
In the Matter of the Search ofINama, address o~ Criof dosc~ipti0n o~ person. prope~y or ?ramisns to ba saarGhed)
The property located at 15825 SW 80th Avenue,Tigard, Oregon 97224; described as a two-storyresidence, beige with teal trim, a brown front doorthat faces east and the numbers "15825" on the garage
APPLICATION ANb-AFFIDAVITFOR SEARCH WARRA'YT
CASE NUMBER:
'11 -MC- 9 0 6 ~I, Special ALent Joseph R. LaMonica ,being duly sworn depose and say:
am a(n) Special Aqent - Federal Bureau of Investicaation and have reason to believeOfficial 'ille
that ~ on the person of or ~ on the property or premises known as came das~-~~~~~~ ~~.n~~~ ~~~ano~~
"I~he property located at 15825 SW Roth Avenue, l~igard, Oregon 97224; described as a two-stor}~ residence, beige~~~ith teal trim, a brown front door that faces east and the numbers "15825" on the garage.
in the District of OrePonthere is Hour concealed a certain person or property, Ida R~Iely (describe tha person or properly tO be seized)
See ~~~~~~~~~~~~B
W rllCh I$ (state one cr more bases for search anA sai~ure sal lorth under Rule 41(6) of the Fetleral Kules cf Criminal Procedure)
evidence, contraband, fruits, and instrumentalities ofcrimes against the United States,
concerning a violation of Title 18 United States code, Sections) 1341 & 1343The facts to support a finding of Probable Cause are as follows:
See Attached Affidavit of Special Joseph R LaMonica, hereby incorporated by reference as if fully restated herein.
Continued on the attached sheet and made a part hereof. ~ Yes ~ No
/ ~, ~ /
Si tur of Affiant
Sworn to before me, and subscribed in my presence
March 8, 2011 at Portland, OregonDate amity and State _
Janice M. StewartUnited States Magistrate JudgeName and Title of Judicial Officer Signature of Judicial Officer
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 2 of 39 Page ID#: 2
State c~f~nregon )SS
C~~u~Ity of Multnomah)
I, Joseph R. LaMonica, being first duly sworn, depose and say:
I am a Special Agent of the I'edcral Bureau of Investigation (FBI), t;nited States
Department of Justice, and have been employed in this capacity for 19 years. I am currently
assigned to the Pr~i-tland, Oregon, office of the FBI. I am currently assigned to the White Collar
Crime Squad, where my duties include the investigation of fraud, including Mail Fraud, Fraud
by Wire, Bank Fraud and other federal violations.
2. This afftdavit is submitted in support of an Application for Search Warrant for
evidence, contraband, fruits, and instc~umentalities of violations of Title 18, United Slates Code,
Section 1341, Mail Fraud, and "I_itle 18, United States Code, Section 1343, Fraud by Wire. As
set forth below, t have probable cause to believe that such items, as set forth in Attachment B,
which is attached hereto and incorporated herein by this reference, are currentl}~ on the premises
located at 15825 SW 80th Avenue, Tigard. Ore~un 97224. The premises located at 15825 SW
80th Avenue, ~figard, Oregon 97224 is rnc~re fully described in Attachment A, which is attached
hereto and incorporated herein by this reference.
3. The facts set forth in this affidavit are based on the following: my own personal
knowledge; kn~~wledge obtained from other individuals during my participation in this
investigation, including other law enforcement officers: interviews of witnesses; my review of
records related to this investigation; communications with others who have knowledge of the
events and circumstances described herein; and information gained through my training and
experience. Because this affidavit is submitted for the limited purpose of establishing probable
AFFIDAVIT -Page 1
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 3 of 39 Page ID#: 3
cause in support of the application for a search warrant, it does not set forth each and ever}' fact
that I or others have learned during the course of this investigation.
Title 18, United States Code, Section 1341, Mail Fraud, states, in part, that:
VJh~e~~er, having devised or intending to devise any scheme or artifice to defraud, or for
obtaining money or property by means of false or fraudulent pretenses, representations, or
promises...for the purpose ot~executing such a scheme or artifice or attempting to do so, places in
any past office or authorized depository for mail matter, any matter or thing whatever to be sent
or delivered by the Postai Service, or deposits or causes to be deposited any matter or thing
whatever to he sent or delivered by any private ar commercial interstate carrier, or takes or
receives therefrom, any such matter or thing, or knowingly causes to be delivered by mail or such
carrier according to the direction thereon, or at the place at which it is directed to be delivered by
the person to whom it is addressed, any such matter or thing, shall be tined under tI~is title or
imprisoned not more than 20 years, or both.
Title 18, United States Code, Section 1343, Fraud by ~~Jire, states that: Whoever,
having devised or intending to devise any scheme or artifice to defraud, or for r>btaining money
or property by means of false or fraudulent pretenses, representations, or promises, transmits or
causes to be transmitted by means of wire, radio, or television communication in interstate or
foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose cif executing
such a scheme ur artifice, shall be fined or imprisoned not more than 20 years, ~r both.
6. Based upon the facts set forth in this affidavit, I believe that there is probable
cause that LAWRF,NCE ~I~NRY HEIM devised and executed a scheme to defraud individuals
by illegally mailing invoices to the individual and causing then to mail payments to llim for the
nFFIDAVIT -Page 2
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 4 of 39 Page ID#: 4
purchase of gold and silver coins that he did not deliver to them, in violation of Title 18, United
States Code, Section 1341, Mail Fraud, and Title 18, United States Code, Section 1343, Fraud by
Wire.
SCHEME TO DEFRAUD
7. The FBI is conducting an investigation of the activities of LAWRENCE HENRY
IIEIM, also known as (a.k.a.) LARRY HEIM. HEIM owned and operated a company known as
LJ.S. GOLD &SILVER INVEST:~~ENTS, INC. (USGSI) in Portland, Oregon. The scheme
involved HEIM promising to sell gold and silver coins to customers across the country through
USGSI. HELM would enter into transactions with customers who would then send checks to
HEIM in Portland, Oregon, typically via the U.S. Postal Service. HEIM would typically send
Invoices with details of the transaction to his customers via the li.S. Postal Service or- via fax.
HL-;IM would deposit the customers' checks into a Wells 1~'argo Bank account under the name
USGSI in the llistrict of Oregon. HEIM would not provide the customers with the gold and
silver coins that they had purchased. HI~1M we #sometimes promised his customers that he~.~~~
would send them a refund of their payment, but he c#i~d failed to send refunds to them.
1NVES"I'IGA"1'IV~; (~VE12VlEW
8. LAWRENCE HENRY HEIM owned and operatcd U.S. GOLD &SILVER
I'~1VF,STMENTS, II~C. (USGSI). As part of his business, HEIM has an Internet wcbsitc (or
USGSI at ~vww.tioirs.com/invest. Un the wcbsite, HELM identified himself as the President of~
USGSI, and provided his "calculation" of the future value of gold. HEI'~I promoted a radio
program that he hosted, and periodically posted his comments on the status of gold and silver
prices. As recently as February 14, 201 1, the wcbsitc instructed readers to "Buy gold and silver
AFFIDAVI"C - Pagc 3
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 5 of 39 Page ID#: 5
NOVA': "l~he sell-off may be over. Remember, my calculations say that gold is going to $11,500
per ounce. That is about 8 times where it is right now. Call 800-631-8292 or 503-228-9553 and
buy now from U.S (sic) Gold &Silver. It is as easy as a phone call."
J. The ~vww.noirs.com/in~~est. website has recently been shut down, and there is a
notice on it that states "U.S. Gold &Silver Investments. Inc. has been a trusted business partner
since 1972. The current economic situation in the U.S. has been devastating for many small
businesses, and ours is no exception. We arc not currently accepting new clients, and are
working hard to resolve current clients' accounts. Thank you foe your patience. Sincerely,
Law7cnce I I. IIeim".
John Seeley
l0. On February 28, 2011, I spoke with Michael U. Uhlig, an attoi-~~ey representing
John Seeley. On March 1, 2011, Mr. Uhlig sent me a two-page letter via email with details
regarding Seeley's business dealings with LAWRENCE HL,IM. Also attac]ied tc~ the email ~~ere
copies of Seeley's documentation of his transactions with USGSI. Uhlig provided the follo~~~ing
information t~~ me: Seeley lives in Port Orchard, Washington. Seeley began investing with
USGSI in approximately 1998. Seeley has dealt exclusively with HEI'V1 when c~~nducting
transactions with USGSI. Seeley has purchased approximately $1 million in ~c~lc1 coins and
appr~ximatrly $500,000 in silver from USGSI. As part of their agreement, HEIM was to hold
the gold dins and silver for Seeley and pay him an amount of interest for holding it.
11. Al the instruction of Seeley, over the last 18 months Seeley's daughter, Janet
Ward, leas heen attempting to close Seeley's accounts at USGSI and collect his gild and sil~~er
ii~om HEIM. HEIM has obstructed and delayed this process nn several occasic~iis. In early
AFFIDAVIT -Page 4
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 6 of 39 Page ID#: G
February 201 1, Ward spoke with I-IEIM, and he assured her that he was in the process of closing
Seeley's accounts. Ward has not been able to contact HELM since then, and she has i~ot received
the balance of gold coins and silver HE1M was supposed to provide. USGSI is currently holding
200 Gold Eagle coins and 61 bags of 40°io silver that belongs to Seeley.
12. A review of the docurnentalion provided by Uhlig reveals that beginning no later
than April 2001, USGSI would send Invoices of transactions t~ Seeley at Port Orchard,
Washington. These Invoices were received by Seeley via the U.S. Postal Service.
Danny McElmoyl
13. I have spoken to Danny N1cElmoyl, who advised that on our about August 6,
2010, he purchased 100 one ounce Gold Eagle coins at a price of $1,2 8.00 each for a total of
S 125.800 from LARRY HEIM of USGSI. On or about August 6, 2010, McF.lmoyl sent to I [cim,
check number 66017 drawn on his business account in the name of McElmoyl Refrigeration,
made payable to t1SC'TSI in the amount of ~125,80U.U0. "The check was sent from Tulare,
California to HEIM in Oregon. McF,lrnoyl believes that the check was sent to P.O. Box 19435,
Portland, Oregon 97280, as that was the only address he had for IJSGSI. McElmoyl then
received a USCiSl Invoice number A7734 ~~ia the U.S. Postal Service. The envelope from
C 1SG51 had an August 6, 201 U, date and was mailed from zip code 97280.
l4. On ~~r about September 14, 2010, Mc~lmoyf purchased 1,500 one ounce Sil~~er
Fades at $22.36 each for a total ~f $33,540.00 from USGSI. Un September 14, 2010, McElmoyl
received a fax of an Invoice'~lumbered A7738 for the purchase of the Silver eagles from USGSI,
fax number (503) 603-9990. On or about September 15, 2010, McF,lmoyi sent check number
4151 drawn on his personal bank account, made payable to US Gold &Silver Invest~T~ents in the
AFFIDAVIT - Pagc 5
Case 3:11-mo-09065 Document 1 Filed 03/08/11 Page 7 of 39 Page ID#:
amount of $33,540.00. McElmoyl sent the check to IJSGSI through the U.S. Postal Service.
15. McElmoyl provided me with copies of the two canceled checks that he had sent to
HEIM. A review ~f McElmoyl Refrigeration check number 66017 in the amount of $125,800.00
revealed that it was deposited on August 10, 201 U, at Wells Fargo Bank in Tigard, Oregon, into
account number XXX6896280 in the name of i1SGSI. A review of Danny McElmoyl check
number 4151 in the amount of $33,540.00 revealed that it vas deposited on September 21, 2010,
at Wells Fargo Bank in Tigard, Oregon, into the above-mentioned account in the name of
USGSI. As of the date of this affidavit, McElmoyl has neither received the Gold oc Silver eagles
that he paid for, nor has he received a refund from USUS1.
Tamara Wagner and William Medlock
16. I have spoken to Tamara Wagner on one occasion and another Special Agent in
my office has spoken to her on another occasion. Wainer advised that c,n or about August 6,
2010, she and her husband, William Medlock, purchased 100 ounces of gold coins from HF.IM.
They wrote a check from their Bank of America account payable to USGSI in the amount of
$126,000 and mailed it from California t~ HEIM'S P.n. Box in Portland, Oregon. HEIM cashed
their check in August 2010, but did not send them the fold coins. After cashing their check,
HEIM would call them approximately every two weeks and tell them he was having problems
with the mint that made the coins, and that he was trying to work it out. On February 12, 201 1,
V~'agner and Niedlock received a call from [IEIM, and he advised them the dispute could nut be
resolved. HEIM told them he would fully refund their money plus interest from Aubust 2010.
IIe told them he would call on February 18, 201 1, to c~lake arrangements for the refund. HEI~~
did not call Wagner and Medlock on February 18, 2011, and their subsequent attempts to contact
AFFIDAVIT -Pale 6
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 8 of 39 Page ID#: 8
HF,IM have been unsuccessful. As of the date of this affidavit, Wagner and Medlock have not
received the gold coins they ordered, or a refund from HE1M.
Tlnnalri Fa~~in
17. 1 have spoken to llonald Fazzio on several occasions, and he advised me that in
October 2010, he purchased 140 one ounce Gold eagle coins at a price of $1,427.00 each for a
total of $199,780.00 from HEIM at USGSI. On or about October l 9, 201 ~, Fa~~i~ sent to HEIM,
check number 4103 drawn on his personal bank account payable to U.S. Gold &Silver in the
amount oI'$199,780.00. The coins were to be delivered to Fazzio no later January 18, ?010.
~~azzio mailed the check from Vancouver, Washington to USGSI at P.U. Box 19435, Portland,
Oregon 97280. II~CM then mailed USGSI Invoice number A7745 to Fazzio at his residence in
Vancouver, Washington. Included with the Invoice was a brochure fur American Eagle Gold
Bullion Coins with an address label of U.S. Gold &Silver, P.O. Box 19435, Portland, Oregon
97?80, telephone numbers (800) 631-829? and (503) 228-9553 and website address
~~~v~v.noirs.com/invest.
18. r'azzio provided a copy of canceled check number 4103. According to the
canceled check, on or about October 21, 2010, the check was deposited at Wells Fargo Bank in
Tigard, Oregon, into the above-mentioned account in the name of USGSI. Fazzio did not receive
the coins from USGSI, and telephonically contacted HEIM on several occasions. HEIM verbally
agreed to provide Fazzio with a full refund of $19~,7~0.00. As of the date of this affidavit,
Fazzio has not yet received the coins that he purchased or a refund from I IEIM.
ether victims
19. I have also spoken to other individuals or attorneys representing individuals who
nFFIUAVIT -Page 7
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 9 of 39 Page ID#: 9
have purchased gold and/or silver from HIM through USGSI. They have sent their payments to
HEIM in Portland, Oregon, and their checks have been cashed by HEIM. They have not received
their coins or any refund from HEIM. At this point in the investigation, it is estimated that since
August 2010, HEIM has received approximately $2 million in gold and silver coin orders that he
has not fulfilled.
Patricia Heim
20. I have spoken to HEIM'S wife, Patricia Heim, who told me that she was the
bookkeeper and secretary for USGSI in the 1980s. HEIM is the sole owner of USGSI, and when
the business struggled and he couldn't afford to rent an office any longer, he moved the business
into their house in Tigard, Oregon. She moved out of the house in 2002, and has lived on her
own since then. Patricia Heim doubts that HEIM wotilcl keep any fold or silver in the house,
because it would not be very safe. She believes that he would keep gold or silver in the bank,
which is what he has done previously.
Wells Fargo Bank
21. I have reviewed records from Wells Fargo Rank for the account of L?S Gild &
Silver Investments, Inc. (USGSI), account number XXX6896280. According to the records,
USGST has two safe deposit boxes. numbered 1585 and 1X86. According to Wells Fargo Bank
representatives, these two boxes are both rented in the name of US Vold, they are both very
good-sized boxes, they are both located at the Tigard branch of Wells I'argo Bank. I I~IM last
entered the safe de~~osit bores on ~lovemher 12, 2008.
HEIM'S residence
22. According to the Oregon Department of Vlotor Vehicle records and public
Af~F1UAV1~1' - Yage 8
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 10 of 39 Page ID#: 10
databases, I3EIM's address is 15825 SW 80th Avenue, Tigard, Oregon 97223. On February 22,
201 1, i went to 1 ~82~ SVV 80th Avemie, 'Tigard, Oregon 97224, and knocked nn the door. HELM
answered the door, but would not let me enter the residence. Heim would not answer any of my
questions and provided me with his attorney's telephone number.
23. The address HEI\~I used for USGSI on Invoices acid letters v~~as P.O. Box 1943>,
Portland, Oregon 97280. According to the U.S. Postal Inspection Service, that box is physically
located at 7805 S W 40th Avenue, Portland, Oregon 17219. According to the a}~plication,
Patricia A. Heim applied for the box in the names of U.S. Uold &Silver and Heim lirvestment
Services on August 1, 1986. Z'he address listed by Patricia Heim was 720 SW Washington
Street, ~i308, Portland, Oregon 97205. Un February 28, 2011, I went to 720 SW Washington
Street, Portland, Oregon and spoke to the building manager. She advised that the company she
works for has owned the building since 2008, and HE1M has not had an office in the building
during the time they've owned it. She was nit familiar with HEIM or USGSI, bul advised they
have received several calls from individuals looking for him there in the last week or two.
24. On Mardi 7, 2011, I spoke to Robert McCurtain, who has known HEIM for thirty
years, and used to work with him in Portland. McCurtain knows that HF,IM had a~i office in
cio~~town Portland many years ago, but believes he has been working out ~f his home. Also,
when I sp~~ke to Michael Uhlig regarding John Seeley's transactions with HEIM, he advised me
that Seeley's daughter, Janet Ward, would meet HEI'VI at different locations in the Portland area
when she picked up the gold and silver from him. "they never met at a single location such as ~~n
office for F~EIM.
25. Based upon my training and eaperience, I know that individuals involved in a
AFFIDAVIT - Pagc 9
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 11 of 39 Page ID#: 11
business or income-producing activity such as the purchase and sale of gold and silver coins, w~i11
keep in their possession and at their residences, some or all of the following types of records:
cash, gold and silver coins, account Icdgers, logs of income and expenses, sales invoices, expense
invoices, purchase invoices, receipts of business transactions, bank account statements, cancelled
checks, bank deposit slips, bank withdrawal slips, check registers, safe deposit box keys and
records, asset purchase records, loan and liability records, balance sheets, diaries of business
activities, calendars, correspondence, notes and memorandums, emails, phone records, payroll
and employment records and ledgers, and journals summarizing business income and expenses. I
know that persons engaged in ~~~~~~~~~~~~that operate using cash keep records of their cash
transactions. I also know that individuals normally maintain records of their personal financial
acti~~ity, such as receipts for expenditures by cash or by check, bank records, and other financial
documents. These records often identify co-conspirators, the location oCbank accounts
associated with the fraudulent activit}~, and the identif cation of assets which were purchased
with fraudulently obtained fl~nds.
26. 1 know that individuals enga~ecl in criminal financial activities, such as mail and
wire fraud schemes, often maintain such records for long periods of time, particularly when they
are involved in ongoing criminal conduct over a long period of time. There are many reasons
why criminal ofCenclers maintain evidence for long periods of time. The evidence may be
innocuous at first glance (i.e. financial, credit card, and barilcing documents, travel documents,
receipts, documents reflecting purchases ~~f assets, personal calendars, telephone and address
directories, check books, videotapes and photographs, utility records, ownership records, letters
and notes, tai returns, and financial records, escrow files, teleph~~ne and eager bills, keys to safe
AFFIDAVIT -Page 10
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 12 of 39 Page ID#: 12
deposit boxes, packaging mxteri~tls, computer hardware and software), but have significance and
relevance when considered in light of other evidence. The criminal offender may no loner
realize he/she possesses the evidence or may believe law enforcement could not obtain a search
warrant to scizc the cvidcncc.
27. Based on my training and experience, I know that individuals who are involved in
criminal financial activities, such as mail and ti~ire fraud schemes, will often keep their fin~incial
records at locations they feel are the most private and secure. Often, this location is their
personal residence. I also lalow that individuals will go to great measures to hide the location of
assets they have acquired as the result of their criminal acti~~ity, often placing assets in nominee
names such as corporate entities and trusts, which serve nn pur~~ose but to disguise the true
ownership of assets.
28. Based on my training, experience, and review of the evidence gathered in the
investigation thus far, the items to be seized at the location set forth in Attachment ~1,
incorporated herein by reference, for the period beginning January 1, 2000, through the date of~
this warrant, which constitute evidence, contraband, fruits and instrumentalities ~f violati~ils of
Title 18, United States Code, Section 1341, Mail Fraud, and Title 18, United States Code,
Section 1343, Wire Fraud, include the following:
a. Bank/Investment Account Records -All bank account, credit card account,
transfer agent and brokerage account records. Thcsc records to include signature
cards, cancelled checks, deposit slips, deposit receipts, passbooks, bank
statements, certificates of clep~~sit, stocks, bonds, wire transfer advises, wire
transfer confirmations, photos of assets, related bank advises, safe deposit box,
AFFIDAVIT - Pagc I 1
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 13 of 39 Page ID#: 13
loan documents, loan applications, Iran payments recrn~ds, cashier's checks,
official checks and money order purchases, correspondence, other bank related
transaction documents, and any and all documents relating to personal, business,
foreign accounts in any foreign or domestic financial institution;
b. Cash and currency, including any packaging, bundling or notations, or other
ne~utiable instruments as evidence of the mail and wire fraud scheme end the
accumulation of proceeds of such scheme;
c. Gold and silver coins, including any packaging, bundling or notations;
d. Safe deposit box records and safe deposit box keys for airy box iii the names of
LAWP~ENCE HEI,v1, LARRY HIM, and/or USGSI;
e. Client/Account Files -All files or folders containing transaction records,
including contracts, account statements and transaction summaries, agreements,
schedules, invoices, receipts, and statements or other documents evidencing
purchases and sales of gold and silver coins;
f. Contractor/Employee Files -All files or folders containing transaction records
including employee or independent contractor contracts to perform work ur
provide services, account statements and transaction summaries, agreements,
schedules, and statements or other documents evidencing salaries or expenses
paid and services provided;
g. Stock Purchase Agreements -Any contracts or agreements for the purchase, sale
or transfer ~f stocks;
h. Corporation,~Trust Documents -Any corporation or trust infoi-~ilation, instnictions,
AFFIllAVI"I~ - Yagc 12
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 14 of 39 Page ID#: 14
bylaws, corporate resolutions, trust agreements, templates, or literature including
documents showing assets, trustees, employees, or independent contractors;
i. Records ~f Receipt of~ Money -Any records of the receipt of funds by check, cash,
credit card, money order, cashier's check, wire transfer or securities;
j. Records of Disbursements -Any records of disbursements or invoices to include
payments by check, cash, credit card, cashier's check, money order, wire transfer,
or securities or the purchase of assets shown by invoices, bills, faxes, or other
documents establishing the purpose or recipient of the expenditure, including
records of mailing ~r shipping such disbursements;
k. Iteeords, information or elocurnents that reflect the receipt and disposition of
funds or property, cars, boats, any vehicle, jewelry, artwork, any and all other
assets owned and sold;
I. Applic~ti~ns for credit, financial statements, credit files acid all records relating to
credit applications, credit accounts, credit cards, loan applications, cash and loans;
m. Records of purchase or dispositions of cashiers checks, money orders, wire
transfers and other negotiable instruments;
n. Sales journals, general ledgers, general journals, purchase journals, summaries,
reconciliations, work papers relating to revenues, ex~~enses, accounts receivable,
accounts payable, assets, liabilities, owners equity, purchase ~f goods for resale,
depreciation of assets, a~llortization of intangible assets, invent~~ries of goods,
materials, supplies and products, payroll information, employees with}wldings,
monthly reports and other business bookkeeping and accounting records;
o. Invoices, statements, receipts, documents, records or other items that reflect
Ar'FID~VIT -Page 13
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 15 of 39 Page ID#: 15
receipt of income or funds, payment of cxpcnscs or liabilities, accuniulatic~n or
disposal of assets and any other item produced reflecting business or income
producing transactions;
p. Photos, passports, photo identification and other identification for aliases or
nominees use by LAWRENCE IIEIM, LARRY HF,iM, and/or USGSI;
q. Records of storage lockers and storage locker keys or access codes maintained by
LAVVRENC~, HEIM, LARRY II~IM, and/or i;SCTSi;
r. Financial statements, including income statements, balance sheets, and statements
of retained earnings, and cash flow statements;
s. Documents relating to corporate or business history of any assumed business
name or entity, including the corporate minute hook, incorporation documents,
stock transfer register, and corporate dissolution documents;
t. Records, documents, books, files, correspondence, other articles or information
relevant to the computation of the federal income tax liability of LAWRENCE
HELM, LARRY I I~IM, and/or USCiST;
u. Correspondcncc to and from i,AWRF.NCE HEIM, LARRY HEIM, and/or
~~~~~~~~including letters, cards, other written correspondence, facsimiles, e-mails,
printed c-mails, taped messages such as answering machine messages, and videos;
v. Western Union receipts, i.S. Postal Money Order receipts, and receipts of other
money exchanging businesses;
~v. "l~elephone records, cell phone records, including itemized billing and individual
toll records, address books, telephone hooks, cell phone telephone and address
books, personal digital assistants, and rolc~clex;
AFFIDAVIT -Page 14
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 16 of 39 Page ID#: 16
x. Printout of facsimile transmissions both sent and received concerning
LAWRENCE HEIM, LARRY HEIM, and/or USGSI;
y. Traveler's checks, copies of traveler's checks receipts, currency (U.S. or foreign);
z. Names or other identifiers of persons associated with LAWRENCE HEIM,
LARRY HEIM, and/or USGSI, including owners, employees and customers; any
independent or employee payment records, employment a}?plicati~ns, personnel
service contracts, photographs of employees, all business phones and other
electronic phone equipment, including pagers and portable phones, and their
contents; any items of identification, receipts from A"l NI purchases;
aa. IRS Records/Correspondence -Any tax returns or correspondence with the IRS
including notices and letters from the IRS, iiicludiil~ copies of federal and state
income tax returns for trusts, corporations, and limited liability companies and
related tax preparation documents such as forms 1099, W-2 forms, Forms 11205,
Forms K-1, Forms 1040, Forms 1065, ~~orms 990, ~~orms 941, and documentation
or correspondence evidencing dealings with an accountant or tax preparers
hb. Records of any bankruptcy filings on behalf of LAWRENCE HEIM, LARRY
HEIM, and/or USGSI;
Digital Evidence
cc. nll computers, including any electronic or digital device capable of storing and/or
processing data in digital form, including central processing units; laptop or
notebook computers; personal digital assistants; wireless conununication devices
such as telephone pa~in~ devices, beepers, and cellular telephones; peripheral
input/output devices such as keyboards, printers, scanners, plotters, monitors, and
AFFIDAVIT -Page 15
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 17 of 39 Page ID#: 1 7
drives intended for removable media; related communication devices such as
modems, routers, cables, and connections; storage media; and security devices;
dd. Any equipment used to facilitate the transmission, creation, display, encoding, or
storage of~ digital data;
ee. Any magnetic, electronic, or optical storage device capable of storing data, such as
floppy disks, hard disks, tapes, CD ROMs, CD-Rs, CD-RWs, DVDs, optical
disks, printer or memory buffers, smart cards, PC cards, memory calculators,
electronic dialers, and electronic notebooks;
ff~. Any documentation, operating logs, and refercncc manuals regarding the
operation ofi the digital device or software used in the digital device;
fig. An}' applications, utility programs, compilers, interpreters, and other software
used to facilitate direct or indirect communication with the digital device;
hh. nn}~ physical keys, encryption devices, dongles, and similar physical items that
arc necessary to gain access to the digital device or data stored on the digital
device;
ii. Any passwords, password files, test keys, encryption codes, or other information
necessary to access the digital device or data stored on the digital device;
jj. Al] records, documents, programs, applications or materials created, modified, or
stored in any form, including in digital form, on any computer or digital device,
that show the actual users) of the computers or digital devices during the period
between .lanuary 1, 2000, and present, including the web browser's history;
temporary Internet ftles; cookies, bookmarked or favorite web pages; email
addresses used from the computer; MAC IDs and/or Internet Protocol addresses
~1FFIDAVI"1, - Yage 16
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 18 of 39 Page ID#: 18
used by the computer; email, instant messages, and other electronic
commu~iications; address books; contact lists; records of social networking and
online service usage; and software that would allow others to control the digital
device such as viruses, Trojan horses, and other fornls of malicious software.
Search and Seizure of Digital Data
29. This application seeks permission to search for and seize evidence of the crimes
described above, including evidence of how computers, digital devices, and digital
storage media were used, the purpose of their usc, and who used them.
30. Based upon my training and experience, and information related to me by agents
and others involved in the forensic examination of computers and digital devices, I
know that data in digital form can be stored on a variety of systems and storage devices,
including hard disk drives, floppy disks, compact disks, magnetic tapes, flash drives,
and memory chips. SoiY~e of these devices can be smaller than a thumbnail and can take
several forms, including thumb drives, secure digital media used in phones and
cameras, personal music devices, and similar items.
Removal of Data Storage Devices
31. I know that a forensic image is an exact physical copy of the data storage media.
A forensic image captures all data on the subject media without viewing or changing
the data in any way. Absent unusual circumstances, it is essential that a forensic image
be obtained prior to conducting any search of data fir itif~rmation subject to seizure
pursuant to the warrant. I also know that during the search of the prei~~ises it is not
always possible to create a forensic image of or search digital devices or media fur data
fur a number of reasons, including the following:
AFFIDAVIT -Page 17
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 19 of 39 Page ID#: 19
a. Searching digital devices can he a highly technical ~~rocess that requires
specific expertise and specialized e9uipment. Because there are so many different
types of digital devices and software in use today. it is difficult to anticipate all of
the ncccssary technical ma~luals, specialized cquipmcnt, and specific cxpertise
necessary to conduct a thorough search of the media to ensure that the data will be
preserved and evaluated in a useful manner.
b. Searching digital devices can require the use of precise, scientific procedures
designed to maintain the integrity of the evidence and to recover latent data not
readily apparent to the casual user. The recovery oi~such data may require the use
of special software and procedures, such as those used in a law enforcement
laboratory.
c. The volume of data stored on many digital devices is typically so large that it
will be highly impractical to search for data during the execution of the physical
search of~the premises. Storage devices capable of~ storing 500 gigabytes of data
are nov~~ commo»place in desktop computers. It can take several hours, or eve~l
days, to image a single hard drive. The larder the drive, the longer it takes.
Depending upon the number and size of the devices, the length of time that agents
must remain onsite to image and examine digital devices can become impractical.
Laboratory Settine Mav Be Essential For Complete And Accurate Analysis Uf Data
32. Since digital data may be vulnerable to inadvertent modification or destruction, a
controlled envirolunent, such as a law enforcement lab~rat~ry, may he essential to
conduct a complete and accurate analysis of the digital devices from which the data will
be extracted. Soft~~~are used in a laboratory setting can often reveal the true nature of
~1FF1D~IVIT -Page 18
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 20 of 39 Page ID#: 20
data. Therefore, a computer forensic reviewer needs a substantial amount of time to
extract and sort through data that is concealed or encrypted to determine whether it is
evidence, contraband, or an instrumentality of a crime.
33. Analyzing the contents of a computer or other electronic storage device,
even without significant technical difficulties, can be very challenging, and a variety of
search and analytical methoels imist be used. For example, searching by keywords,
which is a limited text-based search, often yields thousands of hits, each of which must
be reviewed in its context by the examiner to determine whether the data is within the
scope of the warrant. Merel}~ finding a relevant hit does nit encl the review process.
The computer may have stored information about the data at issue which may not be
searchable text, such as: who created it; when and ho~v it was created, downloaded, or
co~~ied; when it was last accessed; when it was last modified; when it was last printed;
and when it was deleted. The relevance of this kind of data is often contextual.
Furthermore, many common email, database, and spreadsheet applications do not store
data as searchable text, thereby necessitating additional search procedures. To
determine who created, tnuclitied, copied, downloaded, transferred, communicated
about, deleted, or printed data requires a search of events that occurred on the computer
in the time periods surrounding activity regarding the relevant data. Information about
which users logged in, whether users shared passwords, whether a computer was
connected to other computers or networks, and whether the users accessed or used other
programs or services in the relevant time period, can help determine who was sitting at
the keyboard.
A. Lutent Da[a: Searching digital devices can require the use of precise, scientific:
AFFIDAVIT -Pale 19
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 21 of 39 Page iD#: 21
procedures designed to maintain the integrity of the evidence and to recover latent data.
1'he recovery of such data may require the use of special software and procedures. Data
that represents electronic files or remnants of such files can be recovered months or
even years after it has been downloaded onto a hard drive, deleted, or viewed via the
Internet. Even when such files have been deleted, they can be recovered months or
years later using readily available forensic tools. Norn~ally, when a person deletes a file
on a computer, the data contained in the file does not actually disappear; rather, that
data remains on the hard drive until it is overwritten by new data. Therefore, deleted
files, or rernnailts of deleted files, may reside in space on the hard drive or other storage
media that is not allocated to an active file. In addition, a computer's operating system
may keep a record of deleted data in a swap or recovery file or in a program specifically
designed to restore the computer's settings in the event of a system failure.
B. Contextual Data:
1. In some instances, the computer "writes" to storage media without the specific
knowledge or permission of the user. Generally, data or files that have been
received via the Internet are automatically downloaded into a temporary Internet
directory or cache. The browser typically maintains a fixed amount of hard drive
space devoted to such data or files, and the files are only overwritten as they are
replaced with chore recently viewed Internet pales. Thus, the ability to retrieve
artifacts of electronic activity from a hard drive depends less on when the file was
downloaded or viewed than on a particular user's operating system, storage
capacity, and computer usage. Logs of access to wehsites, file
managemenUtransfer programs, fire~vall permissions, and other data assist the
AFFIllf1VIT -Pale 20
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 22 of 39 Page ID#: 22
examiner and investigators in creating a "picture" of what the computer was cloin~
and how it was being used during the relevant time in question. Given the
inlen-elationships of the data to various parts of the computer's operation, this
information cannot be easily segregated.
2. Digital data on the hard drive that is not currently associated with any file may
reveal evidence of a file that was once on the hard drive but has since been deleted
or edited, or it could reveal a deleted portion of a file (such as a paragraph that has
been deleted from a word processing file). Virtual memory paging systems can
leave digital data on the hard drive that show what tasks and processes on the
computer were recently used. Web browsers, email programs, and chat programs
store configuration data nn the hard drive that can reveal information such as
online nicknames and passwords. Operating systems can record additional data.
such as the attachment of~periphcrals, the attachment of US~3 Clash storage
devices, and times the computer was in use. Computer file systems can record
data about the dates files were created and the sequence in which they were
created. This data can be evidence of a crime, indicate the identity of the user of
the digital device, or point toward the existence of evidence in other locations.
Such data may' also lead to exculpatory evidence.
3. Further, evidence of how a digital device has been used, what it has been used for.
and who has used it, may he learned fi~oin the absence of particular data on a
digital device. Specifically, the lack of computer securit~~ software, virus
protection, malicious software, evidence of remote control by another computer
system, or other programs or software may assist in identifying the user indirectly
AFFIDAVIT -Page 21
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 23 of 39 Page ID#: 23
and may provide evidence excluding other causes fc.~r the presence or absence of
the items sought by this application. Additionally, since computer drives may
store artifacts from the installation ~f software that is no loner active, evidence ot~
the historical presence of the kind of software and data described may have
special. significance in establishing timelines of usage, confirming the
identification ~f ~~~~~~~~~users, establishing a point of ~~~~~~~~~~~for usage and; in
some cases, assisting in tl~e identification of certain users. This data can be
evidence of a crime, can indicate the identity of the user of the digital device, or
can ~~oint toward the existence of evidence in other locations. Such data may also
lead to exculpatory evidence. Evidence of the absence of particular data on the
drive is not generally capable of being segregated from t}~e rest of the data on the
drive.
Search Procedure
34. In searching for data capable of being read, stored, or interpreted by a computer or
storage device, law enforcement personnel executing the search warrant will employ the
following procedure:
a. On-site search, ifproctic~ahle. Law enforcement officers trained in computer
forensics (hereafter, "computer personnel"), if present, may be able t~ cletennine ii~
digital devices can be searched on-site in a reasonable amount of time and without
je~pardi~ing the ability to preserve data on the devices. If such an on-site search
can be conducted, the reviewing persoru~el will attempt to seize data falling within
the list of items to be seized as set forth in the warrant and in Attachment ~3.
b. Un-site ima~7ing, iTJ~rncticahle. If a digital device cannot be searched o~1-site as
AFFIDAVIT -Page 22
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 24 of 39 Page ID#: 24
described above, the computer personnel will determine whether the device can be
imaged ~n-site in a reasonable amount of time without jeopardizing the ability to
preserve the data.
c. Seizure of digital devices fnr oJf-site imaging and search. Tf no computer
personnel are present at the execution of the search warrant, or if they determine
that a digital device cannot be searchec3 or imaged on-site in a reasonable amount
of time and without jeopardizing the ability to preserve data, the digital device
will be seized and transported to an appropriate law enforcement laboratory for
rcvtcw.
cl. I,aw enforcement personnel will examine the digital device to extract and seize
anv data that falls within the list of items to he seized as set forth in the warrant
and in Attachment B. T'o the extent they discover data that falls outside the scope
of the warrant that they believe should be seized (e.g., contraband or evidence of
other crimes), they will seek an additional warrant.
e. I.aw enforcement personnel will use procedures designed to identify items to be
seised under the warrant. "These procedures may include the use of a "hash value"
library to exclude normal operating system files t}iat do not need to be seai•clled.
In addition, law enforcement personnel may search for and attempt to recover
deleted, hidden, or encrypted data to determine whether the data falls ~~~ithin the
list of items to be seized under the warrant.
f. If the digital device was seized or imaged, law enforcement personnel will
perform an initial search the original digital device or image within a reasonable
amount of time not to exceed 120 days from the elate of execution of the warrant.
AFFiI~AVIT -Page 23
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 25 of 39 Page ID#: 25
If, after conducting the initial search, law enforcement personnel detern~ine that an
original digital device contains any data falling ~vit}iin the list of items to be seized
pursuant to this warrant, the government will retain the original cligital device to,
among other things, litigate the admissibility/authenticity of the seized items at
trial, ensure the integrity of the copies, ensure the adequacy of chain of custody,
and resolve any issues regarding contamination of the evidence. If the
government needs additional time to determine whether an rn-iginal digital device
ur ~~~~~~~contains any data falling within the list of items to be seized pursuant to
this warrant, it may seek an extension of the time period from the Court within the
original 120-day period from the date of execution of the warrant. The
government shall complete the search of the digital device or image within 180
days of the date of the execution of the warrant. 1f the ~~vernment needs
aciclitional time to complete the search, it may seek an extension of the time period
from the Court within the original 180-day period from the date of the execution
of the warrant.
g. If, at the conclusion of the search, law enforcement personnel determine that
particular tiles or file folders on an original digital device or irTlage do not contain
any data falling within the list of items to be seized pursuant to the warrant, they
will not search ur examine those files or folders further without authorization
from the Court. Law enforcement personnel may continue to examine files or
data falling within the list of items to be seii.ed pursuant to tkzc warrant, as well as
data within the operating system, file system, or softwa~~e application relating or
pertaining to files or data falling within the list of itetms to be seized pursuant to
AFFIDAVIT -Page 24
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 26 of 39 Page ID#: 2G
the warrant (such as log files, registry data, and the like), through the conclusion
of the case.
h. If an original digital device does not contain any data falling within the list of
items to be seized pursuant to this warrant, the government will return that
original data device to its o~mer within a reasonable period of time following the
search of that original data device and will seal any image of the device, absent
further authorization from the Court.
Data to be Seized
35. In order to search for data that is capable of being read or interpreted by a
computer, law enforcement personnel will need to seize, image, copy, and/or search the
following items, subject to the procedures set forth herein:
a. Any computer equipment or digital devices that are capable of being used to
commit or further the crimes outlined above, or to create, access, or store the types
of evidence, contraband, fruits, or instrumentalities of such crimes, as set forth in
Attachment B;
b. Any computer equipment or digital devices used to facilitate the transmission,
creation, display, encoding, or storage of data, including word processing
equipment, modems, docking stations, monitors, printers, plotters, encryption
devices, and optical scanners that are capable of being used to commit or further
the crimes outlined above, or to create, access, process, or store the types of
evidence, contraband, fruits, or instrumentalities of such crimes, as set forth in
Attachment B;
c. Any magnetic, electronic, or optical storage device capable of storing data, such as
AFFIDAVIT -Page 25
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 27 of 39 Page ID#: 27
Iloppy disks, hard disks, tapes, CD-ROVIs, CD-Rs, CD-RWs, DVDs, optical
disks, printer or memory buffers, smart cards, PC cards, memory calculators,
electronic dialers, electronic notebooks, personal digital assistants, and cell
phones capable of being used to commit or further the crimes outlined above, or
to create, access, or store the types of evidence, contraband, fruits, or
instrumentalities of such crimes, as set forth in Attachment B;
d. Any documentation, operating logs, and reference manuals regarding the
operation of the computer equipment, storage devices, or software;
e. Any applications, utility programs, compilers, interpreters, and other software
used to facilitate direct or indirect communication with the computer hardware,
storage devices, or data to be searched;
f. Any physical keys, encryption devices, dongles, or similar physical items that are
necessary to gain access to the computer equipment, storage devices, or data: and
~. Any passwords, password files, test keys, encryption codes, or other information
necessary to access the computer equipment, storage devices, or data.
h. All records, documents, programs, applications or materials created, modified, or
stored in any form, including in digital form, on any computer or digital device,
that show the actual users) of the computers or digital devices during the time
period between January 1, 2000, and present, including the web browser's history;
temporary Internet files; cookies, bookmarked or favorite web pages; email
addresses used from the computer; MAC IDs and/or Internet Protocol addresses
used by the computer; email, instant messages, and other electronic
communications; address books; contact lists; records of social networking and
AFFIDAVIT -Page 26
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 28 of 39 Page ID#: 28
online service usage; and software that would allow others to control the digital
device such as viruses, "l~rojan horses, and other fornis of malicious software.
36. The goverrunent has made the following prig efforts in other judicial fora to
obtain the evidence sought in the warrant: knowledge obtained from other law
enforcement officers; issuance of grand jury subpoenas; my review of financial records
related to the investigation; and information gained through my training and experience.
Retention of Image
37. The government will retain a forensic image of each electronic storage device
subjected to analysis for a number of reasons, including pr~~ving the authenticity of
evidence to be used at trial; responding to questions regarding the corruption of data;
establishing the chain of custody of data; refuting claims oC fabricating, tampering, or
destroying data; and addressing potential exculpatory evidence claims where, for
example, a defendant claims that the government avoided its obligations by destroying
data or returning it to a third party.
Inventory and Return
38. Vb'ith respect to the seizure of electronic storage media or the seizure or imaging
of electronically stored information, the search warrant return to the Court will describe
the physical storage media that were seized or imaged.
Conclusion
39. Rased on the foregoing, 1 have probable cause to believe that T,AWRENC~ II.
HF,ivi, also known as LARRY H~;1M, devised and intended to devise a material scheme
to defraud the above listed individuals, and others, in violation of Title 18, United States
C~~cie, Section ]341, Mail Fraud and Title 18, United States Code, Section 1343, Fraud
AFFIDAVIT -Page 27
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 29 of 39 Page ID#: 29
by Wire, and that F,vidence, Contraband, Fruits and Instn~mentalities of those offenses,
as more fully described in Attachment B hereto, are presently located at 15825 SW 80'°
Avenue, "l~igard, Oregon 97224, more fully described in Attachment A. 1 therefore
request that the court issue a warrant authorizing a starch of the premises for the items
listed in Attachment B, and the seizure and examination of any such items found. This
affidavit, the accompanying application, and the requested search warrant were all
reviewed by Assistant United States Attorney (AUSA) Claire M. Fay prior to being
submitted to the court. AUSA Fay informed me that in her opinion, the afrdavit and
application are legally and factually sufficient t~ establish probable cause to support the
issuance ~f the requested warrant.
U 'E R. LAMONICA~cial Agent -FBI
Subscribed and sworn to before me on this ~dav of March, 2011.
Z~' CThe onorable anice M. StewartU. .Magistrate JudgePortland, Oregon
AFFTI~AVIT -Page 28
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 30 of 39 Page ID#: 30
Al"1'ACH'VIENT ALocation to be Searched
Based on the information contained in this affidavit, I am requesting a warrant to searchthe following location:
"rhe property located at 15825 SW 80th A~~enue, "Tigard, Oregon 97224; described as atwo-story residence, beige with teal trim, a brown front door that faces east and the numbers" 1 ~ 825" on the garage.
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 31 of 39 Page ID#: 31
ATTACHMENT 13Items to be Searched For, Seized, and F,xamined
The items to be seined are the following books and records, documents, con~espondence,
equipment, tiles and other information pertaining to LAWRENCE HF.,[M, aka LARRY HEIM,
and USUSI and found in the location set forth in Attachment A, incorporated herein by reference,
for the period beginning January 1, 2000, through the date of this wan-ant, which constitute
evidence, contraband, fruits, aricl/or instrumentalities of violations of Title 1 R, united States
Code, Section 1341, Wire Traud; and Title 18, United States Code, Section 1343, Wire Fraud:
a. f3ank/Investment Account Records -All bank account, credit card account,
transfer agent and brokerage account records. These records to include signature carcjs, cancelled
checks, deposit slips, deposit receipt~, passbooks, bank statements, certificates of deposit, stocks,
bonds, wire transfer advices, wire transfer confirmations, photos of assets, related hank advices,
safe deposit box, loan documents, loan applications, loan payments records, cashier's checks,
official checks and money order purchases, correspondence, other bank related transaction
documents, and any and all documents relating to personal, business, foreign accounts in any
foreign or domestic financial institution;
b. Cash and currency, including any packaging, bundling or notations, or other
negotiable instruments as evidence of the mail and wire fraud scheme and the accumulation cif
proceeds of such scheme;
c. Gold and silver coins, including any packaging, bundling or notations;
d. Safe deposit box records and safe deposit box keys for any box in the names ~f
LAWRENCE HEIM, LARRY HEIM, and/or i1SGSI;
e. Client/Account Files -All files or folders containing transaction records,
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 32 of 39 Page ID#: 32
including contracts, account statements and transaction summaries, agreements, schedules,
invoices, receipts, and statements or other documents evidencing purchases and sales of gold and
silver coins;
f. Contractor/Employee Files -All files or folders containing transaction records
including employee or independent contractor contracts to perform work or provide services,
account statements and transaction summaries, agreements, schedules, and statements or other
documents evidencing salaries ~r expenses paid and services provided;
g. Stock Purchase Agreements -Any contracts or agreements for the purchase, sale.
or transfer of stocks;
h. Corporation/Trust Documents -Any corporation or trust information, instructions,
bylaws, corporate resolutions, trust agreements, templates, or literature including documents
slowing assets, trustees, employees, ~r independent contractors;
Records of Receipt of Money -Any records of the c-eceipt of funds by check, cash,
credit card, money order, cashier's check, wire transfer or securities;
j. Records of Disbursements -Any records of disbursei~lents or invoices to include
payments by check, cash, credit card, cashier's check, money order, wire transfer, or securities or
the purchase of assets shown by invoices, bills; faxes, or other documents establishing the
purpose or recipient of the expenditure, including records of mailing or shipping such
disbursements;
k. Records, information or documents that reflect the receipt and disposition of
binds or prope~y, cars, boats, any vehicle, jewelry, artwork, any and all other assets owned and
sold;
Applications for credit, financial statements, credit files and all records relating to
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 33 of 39 Page ID#: 33
credit applications, credit accounts, credit cards, loan applications, cash and loans;
m. Records of purchase or dispositions of cashiers checks, money orders, wire
transfers and other negotiable instruments;
n. Sales journals, general ledgers, general journals, purchase jotimals, summaries,
reconciliations, work papers relating to revenues, expenses, accounts receivable, accounts
payable, assets, liabilities, owners equity, purchase of goods for resale, depreciation of assets,
amortization of intangible assets, inventories of goods, materials, supplies and products, payroll
information, ernployees withholdings, monthly reports and other business bookkeeping and
accounting records;
Invoices, statements, receipts, documents, records or other items that reflect
receipt of income or funds, payment of expenses or liabilities, accumulation or disposal of assets
and any other item produced reflecting business or income producing transactions;
p. Photos, passports, photo identification and other identification for aliases or
nominees rise by LAWRENCE HEIl~1, LARRY HEIM, and/or USGSI;
Records of storage lockers and storage locker keys or access codes maintained by
LAWRENCE HEIM, LARRY HEIM, and/or USGSI;
Financial statements, including income statements, balance sheets, and statements
of retained earnings, and cash flow statements;
s. Documents relating to corporate or business history of any assumed business
name or entity, including the corporate minute book, incorporation documents, stock transfer
register, and corporate dissolution documents;
Records, documents, books, files, correspondence, other articles or information
relevant to the computation of the federal income tax liability of LAWRENCE HEM, LARRY
H~1M, and/or USGSI;
Case 3:11-mc-09065 Document 1 Fred 03/08/11 Page 34 of 39 Page ID#: 34
u. Correspondence to and from LAWRENCE HEIM, LARRY HELM, and/or
USGSI, including letters, cards, other written correspondence, facsimiles, e-mails, printed
e-mails, taped messages such as answcrin~ machine messages, and videos;
v. Western Union receipts, U.S. Postal Money Order receipts, and receipts of other
money exchanging busi~iesses;
w. Telephone records, cell phone records, including itemized billing and individual
toll records, address books, telephone books, cell phone telephone and address books, personal
digital assistants, and rolodex;
x. Printout of facsimile transmissions both sent and received concerning
LAWkENCE HEIM, LARRY HELM, and/or USUSI;
y. Traveler's checks, copies of traveler's checks receipts, currency (U.S. ar foreignl;
z. Names or other identifiers of persons associated with LAWKENCL HEIM,
LARRY HEIM, and/or USGSI, including owners, employees and customers; any independent or
employee payment records, employment applications, personnel service contracts, photographs
of employees, all business phones and other electronic phone equipment, including pagers and
portable phones, and their contents; any items of identification, receipts from A1~M purchases;
aa. IRS Records/Correspondence -Any tax returns or correspondence with the IRS
including notices and letters from the IRS, including copies of federal and state income tax
returns for trusts, corporations, and limited liability companies and related tax preparation
documents such as farms 1099, W-2 foetus, Forms ] 120S, Forms K-1, corms 1040, Forn~s 106.5,
Forms 990, Forms 941, and documentation or correspondence evidencing dealings with an
accountant or tax preparers
bb. Records of any bankruptcy filings on behalf of I.AWRENCF, HEIM, LARRY
H~IVI, and/or USGSI;
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 35 of 39 Page ID#: 35
Digital Evidence
cc. All computers, including any clectronic or digital device capable of storing and/or
processing data in digital form, including central processing units; laptop or
notebook computers; personal digital assistalits; wireless communication devices
such as telephone paging devices, beepers, and cellular telephones; peripheral
input/output devices such as keyboards, printers, scanners, plotters, monitors, and
drives intended for removable media; related communication devices such as
modems, routers, cables, and connections; storage media; and security devices;
dd. Any equipment used to facilitate the transmission, creation, display, encoding, or
storage of digital data;
ee. Any magnetic, electronic, or optical storage device capable of storing data, such as
floppy disks, hard disks, tapes, CD ROMs, CD-Rs, CD-RWs, DVDs, opticzl
disks, printer or memory buffers, smart cards, PL cards, memory calculators,
electronic dialers, and electronic notebooks;
ff. Any documentation, operating logs, and reference manuals regarding the
operation cif the digital device or software used in the digital device;
gg. Any applications, utility programs, compilers, interpreters, anc3 other software
used to facilitate direct or indirect communication with the digital device;
hh. Any physical keys, encryption devices, donglcs, and similar physical items that
are necessary to gain access to the digital device or data stored on the digital
device;
ii. Any passwords, password files, test keys, encryption codes, or other infornlation
necessary to access the digital device or data stored on the digital device;
jj. All records, documents, programs, applications or materials created, modified, or
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 36 of 39 Page ID#: 36
stored in any form, including in digital form, on any computer or digital device,
that show the actual users) of the computers or digital devices during the period
between January 1, 2000, and present, including the wcb browser's history;
temporary Internet files; cookies, bookmarked or favorite web pages; email
addresses used from the computer; MAC Ills and/or Internet Protocol addresses
used by the computer; email, instant messages, and other electronic
communications; address books; contact lists; records of social networking and
online service usage; and software that would allow others to control the digital
device such as viruses, Trojan horses, and other forms of malicious sofrware.
Search Procedure
kk. In searching for data capable of being read, stored, or interpreted by a computer
or storage device, law enforcement personnel executing the search warrant will
employ the following proced~il-e:
On-site search, if practicable. Law enforcement officers trained in
computer forensics (hereafter, '`computer personnel"), if present, may be able to
determine if digital devices can be searched on-site in a reasonable amount of time
and without jeopardizing the ability to preserve data on the devices. Any device
searched on-site will be seized only if it contains data falling within tl~e list of
items to be seized as set forth in the warrant and in Attachment B.
2. Un-site imaging, if practicable. If a digital device cannot be
searched on-site as described above, the computer personnel, if present, ~~~ill
determine whether the device can be imaged nn-site in a reasonable amount of~
time without jeopardizing the ability to preserve the data.
3. Seizure oJdigital devices for off-site imaging and search. If no
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 37 of 39 Page ID#: 37
computer personnel are present at the execution of the search warrant, or if they
determine that a digital device cannot be searched or imaged on-site in a
reasonable amount cif time and without jeopardizing the ability to preserve data,
the digital device will be seized and transported t~ aii appropriate law enforcement
laboratory for review.
4. Law enforcement personnel will examine the digital device to
extract and seize any data that falls within the list of items to be seized as set i'orth
in the warrant and in Attachment B. To the extent they disco~~er data that falls
outside the scope of the warrant that they believe should be seized (e.g.,
contraband or evidence of other crimes), they will seek an additional warrant.
5. I,aw enforcement personnel will use procedures designed to
identify items to be seized under the warrant. These procedures may include the
use of a "hash value" library to exclude normal operating system files that do not
need to be searched. In addition, law enforcement personnel may search for and
attempt to recover deleted, hidden, or encrypted data to determine whether the
data falls within the list of items to be seined under the warrant.
6. If the digital device was seized or imaged, law enforcement
personnel will perform an initial search of the original digital device or image
within a reasonable amount of time not to exceed 120 days from the date of
execution of the warrant. If after conducting the initial search, law enforcement
personnel determine that an original digital device contains any data falling within
the list of items to be seized pursuant to this w~-rant, the government will retain
the original digital device to, among other things, litigate the
admissibility/authenticity of the seized items at trial, ensure the integrity of the
Case 3:11-mc-09065 Document 1 Filed 03/08/11 Page 38 of 39 Page ID#: 38
copies, ensure the adequacy of chain of custody, and resolve any issues regarding
contamination of the evidence. If the govercunent needs additional time to
determine whether an original digital device or image contains any data falling
within the list of items to be seined pursuant to this warrant, it may seek an
extension of the time period from the Court within the original 120-day period
from the date of execution of the warrant. The government shall complete the
search of the digital device or image within 180 days of the date of execution of
the warrant. If the government needs additional time to complete the search, it
may seek an extension of the time period from the Court within the original 180-
day period from the date of execution of the warrant.
7. If, at the conclusion of the search, law enforcement personnel
determine that particular files or file folders on an original digital device or image
do not contain any data falling within the list of items to be seized pursuant to the
warrant, they will not search or examine those files or folders further without
authorisation from the Court. Law enforcement personnel may continue to
examine files or data falling within the list of items to be seined pursuant to the
warrant, as well as data within the ~~~~~~~~~~~system, file system, or software
application relating or pertaining tc~ files or data falling within the list of items to
be seized pursuant to the warrant (such as Iog file, registry data, and the like),
through the conclusion of the case.
8. If an original digital device does not contain any data falling within
the list of items to be seized pursuant to this warrant, the government will return
that original data device to its owner within a reasonable period of time followinb
the search of that original data device and will seal any image of the device,