Page 1 of 13 ., 6?cr-00127- - en till SEA I A0 2l (Kml/imr?iintillComplaim . a" jug-034mb .. . UNITED STATES DISTRICT COURT cover for the JUL Eastern District of California 643 BY DEPUTY Ck??h or new 913%??I37mc7 United States of America Up ged 94mg? v. . 9? "tees. MA ABDULLAH and Case CHAUDHRY AHMAD FAROOQ{pg 5.13 . - . CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best of my knowledge and belief. On or about the date(s) of January 2016 - July 2016 in the county of Fresno in the Eastern District of California the defendant(s) violated: Code Section Offense Description 21 U.S.C. Sec. 841(a)(1) Manufacture. Distribution. and Possession with Intent to Distribute a Controlled Substance (Heroin) 21 U.S.C. Sec. 846 Conspiracy to Manufacture. Distribute. and Possess with Intent to Distribute a Controlled Substance (Heroin) This criminal complaint is based on these facts: See attached Af?davit of John T. Rabaul. attached hereto and incorporated herein. Continued on the attached sheet. . Complainant ?s signature John T. Rabaut. Special Agent. DEA Primed name and title Sworn to before me and signed in my presence. Dale: ((14 Judge '3 signature City and state; Fresno, California Hon. Erica P. Grosjean, U.S. Magistrate Judge Primed name and title Case DOcument 8 Filed 08/03/16 Page 2 of 13? AFFIDAVIT OF JOHN T. RABA-UT IN SUPPORT OF CRIMINAL COMPLAINT I, John T. Rabaut, being duly sworn, hereby depose and state as follows: I. INTRODUCTION AN AGENT BACKGROUND 7 1. I have been employed as a Special Agent with the Drug Enforcement Administration (DEA) since January 2013 and am presently assigned to the DEA Resident Of?ce in Fresno, California. I have successfully completed a seventeen (17) week DEA Basic Agent Training Academy at the DEA Academy in Quantico, Virginia. This training included - instruction in the investigation of federal drug violations, including, but not limited to Title 21, United States Code, sections 841 and 846. Additionally,ll have discussed with numerous law enforcement Of?cers, defendants, and informants, the methods and practices used by narcotics distributors. I have also been the af?ant of previous federal and state search warrants and have testi?ed in court about narcotics. 2. Further, I have completed various training programs provided by the DEA and lOcal law enforcement agencies, including, but not limited to training on identifying characteristics associated with the manufacture, sale, and transportation of various narcotics, including, but not limited to (PCP), methamphetamine, heroin, cocaine, and marijuana. These training programs involved the use, possession, packaging, sale, concealment, manufacturing, and transportation of various controlled substances as well as its precursors and chemicals used in the manufacturing process. I am familiar with narcotics traf?ckers? methOds of operation including the distribution, storage, manufacturing, and tranSportation of narcotics I and the collection of money proceeds of narcotics traf?cking. have assisted on the execution of several federal and state narcotics search warrants that resulted in the arrest of suSpects and seizure of narcotics. Case Document 8 Filed 08/03/16 Page 3 of 13 I3. I have participated in other narcotics investigations, either as a case agent or in a supporting role. I also have debriefed defendants, informants, and witnesses who had personal knowledge regarding narcotics traf?cking organizations. Additionally, I have participated in many other aspects of drug investigations including, but not limited to, undercover operations, conducting physical and electronic surveillance, and arrests. These investigations have included the unlawful manufacture, possession, distribution, and transportation of controlledsubstances, as well as conSpiracies associated with criminal narcotics, in'violation of Title 21, United States Code, sections 84l(a)(l), 841(c)(2), 843, and S46,.along analogous sections of the State of California Health and Safety Code. 4, The information contained in this Af?davit is submitted for the sole purpose of demonstrating probable cause to obtain a criminal complaint charging Abdullah ALMASHWALI and Chaudhry Ahmad AROOQ with violations of Title 21, United States Code, Sections 841 and 846 (Distribution and Possession With Intent to Distribute Heroin, and Conspiracy). Because this Af?davit is being submitted for the limited purpose of demonstrating probable cause, it does not contain all of the information known to me and/or other law enforcement of?cers involved in this case. . - BACKGROUND ON DIGITAL CURRENCY 5. Digital currency (also known as is generally de?ned as an electronic?sourced unit of value that can be used as a substitute for ?at currency (Le. currency created and regulated by a government). Digital currency exists entirely on the Internet and is not stored in any physical form. Digital currency is not issued by any government, bank, or company and is instead generated and controlled through computer software operating on a decentralized peer-to-peer network. Digital currency is not illegal in the United States and may Case Document 8 Filed 08/03/16 Page 4 of 13 be used for legitimate ?nancial transactions. However, digital currency is often used for conducting illegal transactions, such as. the sale of controlled substances. 6. Bitcoin is a type of digital currency. Bitcoin payments are recorded in a public ledger that is maintained by peer?to-peer veri?cation, and is thus not maintaincd by a single administrator or entity. Individuals can acquire bitcoinseither by ?mining? or by purchasing bitcoins from other individuals. An individual can ?mine? for bitcoins by allowing his/her computing power to verify and record the Bitcoin payments into a public ledger. Individuals are rewarded for this by being given newly created bitcoins. 7. An individual can send and receive bitcoins through peer?to-peer digital transactions or by using a third-party broker. Such transactions can be done on any type of computer, including laptop computers and smart phones. 8. Bitcoins are stored on digital ?wallets.? A digital Wallet essentially stores the access code that allows an individual to conduct bitcoin transactions on the public ledger. To access bitcoins on the public ledger, an individual must use a public address (or ?public key?) and a private address (brf?private key?). The public address can be analogizedto an account number while the private key is like the password to access that account. 9. - Even though the public addresses of those engaging in bitcoin transactions are recorded on the-public ledger, the true identities of the individuals or entities behind the public addresses are not recorded. If, however, a real individual or entity is linked to a public address, it would be possible to determine what transactions were conducted by that individual or entity. Bitcoin transactions are, therefore, described as ?pseudonymous,? meaning they are partially anonymous. 10. Through the dark-web or dark-net, i.e. websites'accessible only through Case Document8 Filed 08/03/16 Page 5'of 13 means, individuals have established online marketplaces, such as Alpha Bay, for narcotics and other illegal items.l . These markets often only accept payment through digital currencies, such as bitcoin. Accordingly, a large amount of bitcoin sales or purchases by an individual is often an . indicator that the individual is involved in narcotics traf?cking or the distribution of other illegal items. Individuals intending to purchase illegal items on Alpha Bay-like websites need to purchase or barter for bitcoins. Further, individuals who-have received bitcoin as proceeds of illegal sales on Alpha Bay-like websites need to sell their bitcoin to cOnvert them to ?at (government-backed) currency. Such purchases and sales are often facilitated by peer?to-peer bitcoin exchangers who advertise their services on websites designed to_ facilitate such transactions. I 11. Dark websites, such as Alpha Bay, operate on ?The Onion Router? or netvlrork. The TOR network is a special. network of computers on the Internet, distributed around the world, that is designed to conceal the true Internet Protocol addresses of the computers accessing the network, and, thereby, the locations and identities of the network?s users. TOR likewise enables websites to operate on the network in a way that conceals the true IP addresses of the computer servers hosting the websites, which are referred to as ?hidden services? on the TOR network. Such ?hidden services? operating on TOR have complex web addresses, generated by a computer algorithm, ending in ?.onion? and can only be accessed through speci?c web browser software designed to access the TOR network. Alpha Bay is a dark website operated as a TOR hidden service. Alpha Bay allows its users to browse anonymously to purchase a variety of illegal goods, including controlled substances. Bitcoin was the form of payment accepted by the site. A further description of Alpha Bay is included below. Case Document 8 Filed 08/03/16 Page 6 of 13 FACTS ESTABLISHING PROBABLE CAUSE A. Drug EnforcementAdministration (DEA) Identi?es ChaudhryAhmad FAROOQ and Abdullah ALMASHWALI as a Heroin Distributor 12_ Chaudhry Ahmad FAROOQ is a 24-year old male who was born in Pakistan and is a United States citizen. He is approximately 6?3? and 160 with black hair and brown eyes. Abdullah ALMASHWALI is a 31-year old male who was born in Yemen and is a United States citizen. He is approximately6?0? and 180?le with black hair and brown eyes. 13. I am part of 'a dark web/digital currency task force focused on identifying narcotics vendors operating on the dark web and using dark marketplaces (like Alpha Bay) to advertise and sell narcotics. As part of this task force, I have been trained by various law enforcement agencies about how to operate an undercover dark marketplace account and, acting in an undercover capacity, purchase narcotics on these market places, which includes how to messages utilizing Pretty Good Privacy (PGP) keys and how to purchase and use digital currency (bitcoins) to make payments for narcotics. PGP is a data program that provides for privacy and data communication, i.e. e-mails. Each public PGP key is bound to a user name or e-mail address, which is publicly'available. CommunicatiOns-to that 7 public PGP key are then with a private PGP key, which means only the user with the private PGP key can access those communications. 14_ As a result of this training, I began analyzing and investigating the top heroin vendors operating on the dark marketplace, Alpha Bay, in January of 2016. Through the course of my initial investigation, I came across two vendors, and who were advertising that they import heroin directly from Afghanistan and whose vendor web pages were selling the exact same products and quantities. Based on my training and. experience I suspected that these two vendors were operated by same individual(s). 15_ During March of 2016, I initiated a full investigation into AREASI and DARKAPOLLO. Popular dark market online forums that review Alpha Bay vendors indicated Case Document 8 Filed 08/03/16 Page 7 of 13 that customers who had previously received shipments from and DARKAPOLLO . indicated that the packages originated from Brooklyn, New YOrk. 16, and advertise on AlphaBay as vendors of Burmese and Afghan heroin, as well as uncut Peruvian and Columbian cocaine. The quantities of each of the heroin and cocaine range from one gram to five grams. Based on my review of AlphaBay transactions, as of July 25, 2016, DARKAPOLLO has sold approximately 610 grams of heroin and approximately 25 grams of cocaine- In total, DARKAPOLLO has made approximately $139,594 from the sale of heroin and cocaine on AlphaBay. As of July 25, 2016, AREASI has sold approximately 810.5 grams of heroin and approximame 47 grams of cocaine. 17, Initial analysis of DARKAPOLLO and AREAS 1?s public PGP key indicated that both keys were registered to'the same email address: Adashc3l@gmail.com. A social-media. search for the phrases ?Adashc3 l? and ?Adashc? resulted in the discovery of a Twitter, lnstagram, and Facebook account belonging to someone identi?ed as ?Ahmed Farooq? or ?Ch. Ahmed Farooq? (Hereinafter referred to as FAROOQ). The Facebook pro?le belonging to FAROOQ indicated that he resided in Brooklyn, New York. As a result, in April of .20 6, I submitted a grand jury subpoena to Facebook for the subscriber information for FAROOQ2016, I received the grand jury information from Facebook. Analysis of the acebook information indicated a veri?ed telephone number. for Facebook account; A DEA de-con?iction search for this telephone number indicated that the user of this telephone number was part of an on-going investigation targeting a Drug. Traf?cking Organization_(DTO) that was selling heroin in Brooklyn, New York. 19- Case Document 8 Filed 08/03/16 Page 8 of 13 B. ALMASH WALI and FAROOQ Sells Heroin an Alpha Bay 21. On May 1 l, 2016, Ipurchased approximately .451 bitcoins to use in purchasing heroin from either DARKAPOLLO or AREAS l. '22, On May 16, 2016, acting in an undercover capacity, I logged into my undercover Alpha Bay account and purChased approximately?One gram of heroin from AREASI for $165. I included a message to AREASI to send the package to a predetermined undercover address, I also instructed to address the package to.?Alex Mendoza.? '23_ On May 19, 2016, DEA SA Christen Brook received a notice from US Postal Service Inspector Jessica Burger that a package had arrived at the undercover address I had instructed to AREAS 1. 24_ On May 20, 2016, I retrieved the package from Inspector Burger and noticed that 7 Case Document 8 Filed 08/03/16 Page 9 of 13 the package from addressed to ?Alex Mendoza.? The return address of this paCkage was to 8 ?Jessica Brown? at 286 Ave X, Brooklyn, NY 1 1223. The tracking number for this parcel was identi?ed as (hereafter referred to as PARCEL 25. I brought UC PARCEL #1 back to the Fresno Resident Of?ce to Open it and to begin processing it into evidence. I, as witnessed by DEA SA Jay Dial, opened UC PARCEL #1 and located a silver Mylar envelope inside the parcel. Inside of the silver Mylar envelope was a small clear zip lock back that contained a white powder. I, as. witnessed by SA Jay Dial, conducted a presumptive test on the powder, which tested positive for the presence of heroin. I submitted all ofthe contents of UC PARCEL #1 to the DEA Western Regional Lab for ?ngerprint and drug analysis. On'this sameday, I also released approximately .3507 BTC that was in escrow to AREA51 as payment for UC PARCEL 26. On May 24, 2016, I purchased approximately .458 bitcoin for another undercover purchase of heroin from AREA51. On this same date, I, acting in an undercover capacity, purchased approximatelyl gram of heroin from AREAS 1, as witnessed by SA Jay Dial. I instructed AREA51 to ship the package to a pre-established undercover address. I also instructed AREA51 to again address the package to ?Alex Mendoza.? I I 27. On May 27, 2016, Inspector Burger noti?ed me that a package had been delivered to the undercover address I provided to AREA51. On this date, I picked up the package from Inspector Burger and noticed that the package was addressed to ?Alex Mendoza? (hereafter referred to as UC PARCEL The return name and address written on UC PARCEL #2 was ?Valerie Desperado? at 286 Avenue X, Brooklyn, NY. This return address was the same address as UC PARCEL The tracking nuniber for UC PARCEL #2 was EK739980413US. 28. I I then brought UC PARCEL #2 to the DEA Fresno Resident Of?ce for processing. -When I Opened LIC PARCEL as iwitnessed by SA Jay Dial, I found a cream colored envelope. Inside of the envelope was another silver Mylar envelope. Inside of the Mylar envelope was a? small clear plastic bag that contained a white powder. SA Jay Dial and I c0nducted a presumptive test on the powder, which tested positive for the presence of heroin. 8 Case Document 8 Filed 08/03/16 Page 10 of 13 SA Dial and I sent all of the contents of UC PARCEL #2 to the Western Regional Lab for ?ngerprint and drug analysis. 29. On May 31, 2016, I received the laboratory and ?ngerprint analysis back for UC PARCEL According to the drug analysis, thewhite powder was identi?ed to be heroin. Additionally, three latent ?ngerprints were found on the Mylar envelope located inside?of UC PARCEL #1 These ?ngerprints were positively identi?ed as belonging to ALMASHWALI. 30. On June 13,2016, I received the laboratory and ?ngerprint analysis for UC PARCEL The white powder was positively identi?ed as heroin. Additionally, one latent ?ngerprint was found on the silver Mylar envelope inside of UC #2 and three latent ?ngerprints were found on the USPS envelope. All of these latent ?ngerprints were known ?ngerprints for ALMASHWALI. C. ALMASHWALI and AROOQ Purchase Postage for Narcotics Parcels 31. As a result of the undercoverpurchases that I conducted, Inspector Burger was able to conduct comparative analysis on these parcels to identify who purchased the postage for them. i 32. InspectorBurger was able to identify the time, date, and location the postage was purchased via the Postage Validation Imprinter (PVI) label." The postage for UC PARCEL #1 was purchased via an SSK (Self Service Kiosk) located at the Homecrest Post Of?ce, 2302 Avenue U, Brooklyn, New York 11229, on May 18, 2016 at approximately 19:39 Greenwich - time (15:39 Eastern time). This location is approximately .8 milesfrom the residence and .5 miles from the residence. Upon pulling the transaction data, Inspector Burger identi?ed ?ve (5) total transactions conducted utilizing the same credit card number, in which postage was purchased for a total of twenty-?ve (25) PVI labels in the amount of $22.95 each, including the pOStage for UC PARCEL Below is a list of the transaction; I Case Document 8 Filed 08/03/16 Page 11 of 13 Card Number SiteID Date Time' Amount i 4563 3100 2224 1214 3509739557 05/18/2016 15:37:00 $114.75 4563 310022241214 3509739557 ,05/18/2016 15:37:53 $114,715 4563 3100 2224 1214 3509739557 05/18/2016 15:39:03 $114.75 4563 3100 2224 1214 3509739557 05/18/2016 15:40:13 $114.75. 4563 3100 22241214 3509739557 05/18/2016. 15:41:11 $114.75 33. Due to SSK transactions being a non?face to face transactions, photos are taken during each transaction that is conducted. Inspector Burger retrieved the photo of the suspect who purchased the postagefor UC PARCEL #1 and provided the photo to me. 1 positively identi?ed the individual in the photo as ALMASHWALI. 34. Based on historical data, and postal databases, Inspector Burger was able to identify additional postage being purchased utilizing card number 4563 3100 2224 1214. 35. lnsPector Burger identified the following transactions that occurred on May 4, 2016, at the James A. Farley Post Of?ce located at 421 8?h Ave, New York, NY 10001 which is approximately 12 miles from residence and approximately 12 miles from s: 7* Card Number SiteID 7 Date Time Amount 4563 3100 2224 3596289550 05/04/2016 20:09:05 $114.75 I 1214 I 4563 3100 2224 3596289552 05/04/2016? 20:10:09 $114.75 1214 4563 3100 2224 3596289550 05/04/2016 20:10:35 $114.75 1214 4 4563 3100 2224 3596289552 05/04/2016 20:11:15 $114.75 10 Document8 Filed 08/03/16 Page 12 of 13 1214 4563 3100 2224 3596289552 05/04/2016 20: 12:09 $114.75 1214 4563 3100 2224 3596289552 05/04/2016 20:13:03 $114.75- 1214 4563 3100 2224 3596289552 05/04/2016 20:13:53 $114.75 1214 7.4563 3100 2224 3596289552 05/04/2016 20:14:49 $1 14.75 1214 36. Because SSK transactions are not face-to-face transactions, photos are taken during each transaction that is conducted. In pulling the photos Inspector Burger identi?ed ALMASHWALI conducting the transactions that occurred from 20:09:05 through 20:11:15. The transactions which occurred from 20:12:09 through 20:14:49 were conducted by FAROOQ, using credit card number 4563 3100 2224 1214. Inspector Burger was able to locate USPS Priority Mail Express parcel EL390130574US, in which postage was purchased by ALMASHWALI during the above listed transactions. This parcel was addressed to Scott Simonson, 322 Coronation Amherst, New York 14226, and listed a return address of Jessica Brown, 286 Ave X, Brooklyn, New York 11223, the same address listed on the two undercover purchases I conducted. 37. The investigation is ongoing and I do not believe that ALMASHWALI or AROOQ are aware of the investigation. I also believe that if they became aware of the investigation, they would likely destroy evidence, ?ee prosecution, or intimidate potential witnesses. ll Case Document 8 Filed 08/03/16 Page 13 of 13 IV. CONCLUSION 38. Based upon my training and experience, and on the facts set forth in this af?davit, there is probable cause to believe that Chaudhry Ahmad AROOQ and Abdullah ALMASHWALI have violated Title 21, United States Code, Sections 841(a)(l)& (Distribution of Controlled Substances), and 21 U.S.C. 846 and 841(a)(1) (Conspiracy to Distribute Controlled Substances). Itherefore request that you issue the attached arrest warrant and criminal complaint. Approved as to form: Grant B. Rabenn Grant B. Rabenn Assistant United States Attorney will? - Jo . Rabaut I Sp c'al Agent . Enforcement Administration Sworn to before me g: day of July 2016 HON. ERICA P. GROSJEAN United-States Magistrate Judge Eastern District of California 12