Case Numbers: Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 1 of 20. PageID #: 2 1:18 MJ 3108 1:18 MJ 3109 10:33 PM, Apr 25, 2018 IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF OHIO EASTERN DIVISION I, Bryon Green, hereafter “Affiant,” being first duly sworn, hereby depose and state as follows: INTRODUCTION 1. I am a United States Postal Inspector and have been so employed since October 2006, presently assigned at Cleveland, Ohio to investigate Prohibited Mailing offenses. I have received training in the detection and investigation of prohibited mailing offenses. I have worked U.S. Postal Service related investigations for approximately 11 years, during which time I have been the case agent for investigations leading to prosecution in U. S. District Court, as well as state courts. Over the past two years, I have worked in conjunction with the Homeland Security Investigations (HSI) and the Border Enforcement Security Taskforce (BEST) on cases involving illegal narcotics mailed from foreign countries. 2. As a Postal Inspector, I have also conducted online investigations, analyzed pen register and telephone toll data, analyzed financial records, executed controlled deliveries of controlled substances, interviewed witnesses, drafted and executed search warrants, seized illegal drugs and other evidence of drug violations in physical and electronic sources, processed seized evidence, supervised the purchase of controlled substances by confidential sources, conducted undercover purchases of controlled substances in person and online, and debriefed persons arrested and convicted of drug trafficking offenses regarding their illegal activity. 3. Through investigation and training, I have become familiar with the types and amounts of profits made by drug traffickers and the methods, language, and terms that are used to disguise their illegal activity. I know that persons engaged in drug trafficking require expedient forms of communication to maintain an adequate and consistent supply of drugs from sources, and to effectively market those drugs to customers. 1   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 2 of 20. PageID #: 3 4. Your Affiant knows based on training and experiences those individuals who traffic in one controlled substances such as fentanyl often traffic and possesses other controlled substances and controlled substance analogues, particularly synthetic narcotics. 5. Furthermore, based on my training and experience that individuals who engage in unlawful activity on the internet (including the dark net) sometimes also use the expertise that they learn to engage in other criminal activity online. 1. This Affidavit is offered in support of a Criminal Complaint against Defendant MATTHEW ALAN ROBERTS, aka MH4LIFE and HOLLY ROBERTS, aka MH4LIFE with Conspiracy to Possess with Intent to Distribute and to Distribute Controlled Substances, in violation of 21 U.S.C. § 846. As further detailed below, your Affiant submits that there is probable cause to believe that from on or about January 2016 to the present, Defendants, with others known and unknown to law enforcement, did knowingly and intentionally combine, conspire, confederate, and agree with each other to distribute and possess with the intent to distribute mixtures or substances containing a detectable amount of the following controlled substance analogues, as defined in 21 U.S.C. § 802(32), knowing that the substances were intended for human consumption, as provided in 21 U.S.C. § 813, and controlled substances:  Methoxyacetyl Fentanyl, a synthetic opioid);1  Fentanyl  Black Tar Heroin  Gunpowder Heroin  MDMA (Molly)  Cocaine                                                              1 The DEA listed Methoxyacetyl Fentanyl as a Scheduled I controlled substance through a temporary scheduling order as of October 26, 2017. It previously qualified as a fentanyl analogue under the Analogue Act. 2   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 3 of 20. PageID #: 4  Marijuana  Alprazolam Powder Pure  ICE (Methamphetamine)  Ketamine 6. All in violation of Title 21, United States Code, Sections 802(32), 813, 841(a)(1) and (b)(1)(C), and 846. 7. The facts set forth below are based upon your Affiant’s personal knowledge learned through the course of the investigation as well as information obtained from law enforcement and additional sources. 8. This Affidavit is being submitted for the limited purpose of informing the court of the evidence establishing probable cause for a violation of federal criminal law. Since this affidavit is for this limited purpose, your Affiant has not included each and every fact known concerning this investigation. BACKGROUND CONCERNING DARK NET AND CRYPTOCURRENCY INVESTIGATIONS 9. The “clear” or “surface” web is part of the internet accessible to anyone with a standard browser and that standard web search engines can index. The deep web is the part of the internet whose contents are not indexed by standard web search engines. The dark net is a part of the deep web that not only cannot be discovered through a traditional search engine, but also has been intentionally hidden and is inaccessible through standard browsers and methods. 10. The dark net is accessible only with specific software, configurations, and/or authorization, including non-standard communications protocols and ports, such as a TOR (“The Onion Router”) browser. A TOR browser is designed specifically to facilitate anonymous communication over the internet. In order to access the TOR network, a user must install TOR 3   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 4 of 20. PageID #: 5 software either by downloading an add-on to the user’s web browser or by downloading the free “TOR browser bundle.” Use of the TOR software bounces a user’s communications around a distributed network of relay computers run by volunteers all around the world, thereby masking the user’s actual IP address, which could otherwise be used to identify a user. Because of the way TOR routes communications through other computers, traditional IP identification techniques are not viable. When a user on the TOR network accesses a website, for example, the IP address of a TOR “exit node,” rather than the user’s actual IP address, shows up in the website’s IP log. An exit node is the last computer through which a user’s communications were routed. There is no practical way to trace the user’s actual IP address back through that TOR exit node IP address. A criminal suspect’s use of TOR makes it extremely difficult for law enforcement agents to detect a host, administrator, or user actual IP address or physical location. 11. Dark net marketplaces operate on the dark net. These sites are generally only accessible through the input of specific addresses in a TOR browser. The dark net marketplaces function primarily as black markets, selling or brokering transactions involving drugs, cyberarms, weapons, counterfeit currency, stolen credit card details, forged documents, unlicensed pharmaceuticals, steroids, and other illicit goods as well as the occasional sale of legal products. Dark net vendors (also known as distributors) operate on these dark net markets as sellers of these goods. They provide detailed information about their wares on these sites, including listings of their drugs for sale, (contact information such as TOR-based email or encrypted messaging applications), and the prices and quantities of drugs for sale in bitcoins. Customers purchase these goods using a computer or smartphone. 12. Your affiant is aware that some dark net marketplace vendors conduct the entirety of their transactions on the marketplace. Other vendors use the sites as an advertising base and 4   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 5 of 20. PageID #: 6 messaging system and conduct their financial business in peer-to-peer transactions in order to avoid using third party escrow systems that they believe could be subject to law enforcement seizures as well as thefts, hacks, and scams. 13. Bitcoin (BTC)2 is a type of virtual currency, circulated over the internet. Bitcoin are not issued by any government, bank, or company, but rather are controlled through computer software operating via a decentralized, peer-to-peer network. Bitcoin is just one of many varieties of virtual currency. 14. Bitcoin are sent to and received from BTC “addresses.” A Bitcoin address is somewhat analogous to a bank account number and is represented as a 26-to-35-character-long case-sensitive string of letters and numbers. Each Bitcoin address is controlled through the use of a unique corresponding private key. This key is the equivalent of a password, or PIN, and is necessary to access the Bitcoin address. Only the holder of an address’ private key can authorize any transfers of bitcoin from that address to other Bitcoin addresses. Users can operate multiple BTC addresses at any given time and may use a unique Bitcoin address for each and every transaction. 15. To acquire bitcoin, a typical user purchases them from a virtual3 currency exchange. A virtual currency exchange is a business that allows customers to trade virtual currencies for other forms of value, such as conventional fiat money (e.g., U.S. dollars, Russian rubles, euros). Exchanges can be brick-and-mortar businesses (exchanging traditional payment methods and virtual currencies) or online businesses (exchanging electronically transferred money and virtual currencies). Virtual currency exchanges doing business in the United States                                                              2 Since Bitcoin is both a currency and a protocol, capitalization differs. Accepted practice is to use “Bitcoin” (singular with an uppercase letter B) to label the protocol, software, and community, and "bitcoin" (with a lowercase letter b) to label units of the currency. That practice is adopted here. 3 Bitcoins can accurately be referred to as a virtual, digital, and/or cryptographic currency. 5   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 6 of 20. PageID #: 7 are regulated under the Bank Secrecy Act and must collect identifying information about their customers and verify their clients’ identities. 16. To transfer bitcoin to another Bitcoin address, the sender transmits a transaction announcement, which is electronically signed with the sender’s private key, across the peer-topeer BTC network. To complete a transaction, a sender needs only the Bitcoin address of the receiving party and the sender’s own private key. This information on its own rarely reflect any identifying information about either sender or recipient. As a result, little-to-no personally identifiable information about the sender or recipient is transmitted in a Bitcoin transaction itself. Once the sender’s transaction announcement is verified by the network, the transaction is added to the blockchain, a decentralized public ledger that records every Bitcoin transaction. The blockchain logs every Bitcoin address that has ever received bitcoin and maintains records of every transaction for each Bitcoin address. 17. While a Bitcoin address owner’s identity is generally anonymous within the blockchain (unless the owner opts to make information about the owner’s Bitcoin address publicly available), investigators can use the blockchain to identify the owner of a particular Bitcoin address. Because the blockchain serves as a searchable public ledger of every Bitcoin transaction, investigators can trace transactions to third party companies that generally collect identifying information about their customers and are responsive to legal process. 18. Dark net marketplace buyers and sellers generally use bitcoin or some other form of cryptocurrency to conduct their transactions. Bitcoin is a decentralized digital/virtual currency that uses cryptography to secure the transactions and to control the creation of additional units of the currency. The digital currency gives the vendor and customer a perceived sense of anonymity. However, before a customer can make a purchase on a dark net marketplace, 6   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 7 of 20. PageID #: 8 they must first convert fiat currency, such as United States Dollars, into the digital currency accepted on the market place. Dark net marketplace vendors also often have to convert the bitcoins that they earn through their sales into legal currency. These conversions generally take place on bitcoin exchangers, businesses who take bitcoin and give a certain amount of legal currency (such as the U.S. dollar) back at a set exchange rate and for a certain fee. 19. Your affiant is aware that individuals conducting business in this manner must use a computer or other electronic device, such as a smartphone, tablet, or computer to conduct transactions involving bitcoin. Users of bitcoin must establish electronic wallets to receive and send the bitcoin during these transactions. These wallets are electronic in nature and may be stored on mobile devices (phones or tablets), external or removable media, or computers. They may also be stored on third party wallet providers (such as Armory). Individuals often associate email accounts with these wallet providers and store information relating to that wallet on their email account. Your affiant is also aware that individuals conducting business by bitcoin can back-up wallets to paper printouts that would contain information to restore the wallet in an electronic form (cold storage). Passwords for access to electronic wallets are typically complex and are often written down or saved in an accessible manner on paper or on some electronic device. They are also often stored on email accounts, cloud or shared drives stored online (such as Google Drive), and other online storage mediums. FACTS AND CIRCUMSTANCES REGARDING PROBABLE CAUSE 20. The United States Postal Inspection Service (USPIS), the Department of Homeland Security Investigations (HSI), Federal Bureau of Investigation (FBI), and Internal Revenue Service (IRS) are engaged in online undercover investigations targeting fentanyl and fentanyl analogue vendors on dark net marketplaces. These marketplaces are commonly used to facilitate purchases of narcotics and other illicit goods via vendors who operate ‘stores’ using 7   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 8 of 20. PageID #: 9 monikers. 21. One such moniker on a known dark net marketplace is called “MH4LIFE.” MH4LIFE is a dark net market vendor currently operating on the “Dream” marketplace for approximately two years. “Dream” is a marketplace on the dark net that facilitates the sale of illegal narcotics. According to MH4LIFE’s vendor Profile, MH4LIFE has previously operated stores on various other dark net markets such as the AlphaBay and Agora markets, other dark web marketplaces known to Your Affiant that facilitated the sale of illegal narcotics. MH4LIFE makes periodic updates to the MH4LIFE vendor profile. This is used as a mass communication method to apprise customers of changes in order protocol, shipping issues, and all other business-related correspondence. MH4LIFE uses the word “we” when referring to themselves, indicating that more than one person is responsible for operating the store. 22. As of April 23, 2018, the MH4LIFE profile indicated the store has conducted 1,900 verified transactions on the Dream Market, with 600 reviewed transactions.4 His profile also shows records indicating a total of 3,100 sales of illegal narcotics across multiple dark net marketplaces, including for fentanyl analogues and other opioids. The only products listed for sale by MH4Life are illegal narcotics. MH4LIFE advertises the narcotics with photographs and detailed descriptions of each drug. As of April 23, 2018, MH4Life advertises the following items for sale:  MAF (Methoxyacetyl Fentanyl, a synthetic opioid);5  MAF Powder;                                                              4 Similar to vendors on legitimate sites like Amazon and eBay, customers of a particular vendor can leave reviews for the transaction. Customers commonly review the speed of shipment and quality of illegal narcotics received from the seller. In Your Affiant’s experience, the number of reviews for a vendor is generally lower than the total number of transactions, as leaving a review is voluntary. 5 The DEA listed Methoxyacetyl Fentanyl as a Scheduled I controlled substance through a temporary scheduling order as of October 26, 2017. It previously qualified as a fentanyl analogue under the Analogue Act. 8   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 9 of 20. PageID #: 10  MAF Old Batch;  BTH (Black Tar Heroin);  Gunpowder Heroin;  MDMA (Molly);  High Quality Cocaine;  Marijuana; and  Alprazolam Powder Pure; 23. On February 21, 2018, Cleveland Postal Inspector B. Green (PI Green) and Homeland Security Investigations Special Agent M. Grote (SA Grote) conducted an undercover purchase of 3.6 grams of methamphetamine6 from Dream Market vendor MH4LIFE. PI Green requested the purchase be sent to an undercover address located in the Northern District of Ohio. 24. On February 22, 2018, PI Green recovered U.S. Postal Service Priority Mail parcel #92701901755477000000354299 in the Northern District of Ohio resulting in the identification of approximately 3.6 grams of a substance that field-tested positive for methamphetamine. Laboratory confirmation is pending. The subject parcel is further described as a U.S. Priority Express Mail Envelope bearing the return address of Digital Memories, 9200 Cliffvale Street, San Antonio, TX 78250. 25. PI Green used U.S. Postal Service records to determine that 15 other parcels listing the same return address were placed in a U.S. Postal Service collection box along with the subject parcel in the San Antonio, Texas, area. 26. On March 8, 2018, PI Green subpoenaed a third party postage provider and received                                                              6 Dark net vendors, such as MH4Life, often change the drugs that they are selling based on their current supply. At that time, MH4Life was selling methamphetamine. MH4Life later stopped selling methamphetamine. 9   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 10 of 20. PageID #: 11 records identifying 86 mailings bearing characteristics associated with the subject parcel. 27. On March 12, 2018, MH4LIFE updated MH4LIFE’s Dream Market profile and indicated MH4LIFE will only be shipping on Tuesday and Thursday (and Friday for orders of $300 or more with Express Shipping). 28. On March 25, 2018, PI Green and SA Grote conducted an undercover purchase of 0.6 grams of Methoxyacetylfentanyl, a Schedule I Controlled substance, from MH4LIFE. PI Green requested the purchase to be sent to an undercover address located in the Northern District of Ohio. During the undercover purchase, PI Green paid an additional fee to have the fentanyl packaged inside of a decoy, a non-contraband item used to prevent detection by law enforcement during the shipping. 29. On March 30, 2018, PI Green recovered U.S. Priority Mail parcel tracking #92055901755477000065508006 in the Northern District of Ohio which contained a package of 12 glow bracelets (the decoy)7 concealing a silver bag containing a .5 grams of N-MethylNorfentanyl1 and Methoxyacetylfentanyl, Schedule I Controlled substance (Cuyahoga County Lab #2018-003507-0001). The subject parcel is further described as a U.S. Priority Mail Envelope bearing the return address of Collectibles4Less, 307 Lockhart St. #125, Martindale, TX 78655. 30. PI Green learned U.S. Priority Mail parcel tracking #92055901755477000065508006 was placed in a U.S. Postal Service collection box in the San Antonio, Texas, area. 31. On April 4, 2108, MH4LIFE updated MH4LIFE’s Dream Market profile and advised “My shipper did not send like they told me.” And “I will be handling the rest of the orders                                                              7 In Your Affiant’s training and experience, it is common for drug traffickers who use the U.S. Postal Service or other common carriers to include innocuous items in shipments of illegal narcotics. In this way, if the package is searched or breaks open in transit, it appears to be a legitimate mailing. 10   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 11 of 20. PageID #: 12 from here on out,” indicating that MH4Life, rather than a shipper proxy, would be handling all future drug shipments. 32. On April 16, 2018, PI Green identified approximately 9 mailings sent from San Antonio, Texas, using the same return address as those used on previous parcels from MH4LIFE. PI Green learned the mailings were scanned by a Postal Service letter carrier prior to arriving at the Post Office. PI Green contacted San Antonio Postal Inspector M. Scott who identified the letter carrier who collected and delivered mail out of the Heritage Post Office. Postal Inspector M. Scott interviewed the letter carrier who scanned the parcels. According to the letter carrier, he distinctly remembered being handed the envelopes and remembered that they had been handed to him by a female at 1923 Harper Ferrys St, San Antonio, TX 78245. According to the letter carrier, the mailer was a Caucasian female in her mid-30s. The letter carrier stated that the same female has given both Priority and Express Mail envelopes to be mailed from 1923 Harper Ferrys St. and on the street. 33. Postal Inspectors in San Antonio, Texas, researched the payee of utilities, address information, and a burgundy Ford Explorer plate # CR9-N648 that was observed parked in the driveway of the house. All of these indicators related to HOLLY ROBERTS, Caucasian female, 35 years old. Additional information revealed HOLLY ROBERTS was possibly married to MATTHEW ROBERTS, Caucasian male, 35 years old. 34. U.S. Postal Inspection Service databases identified the following previous seizure by U.S. Postal Inspectors on March 14, 2016: One USPS Express Mail Parcel containing $6,210 in U.S. Currency addressed to H Roberts, 1923 Harpers Ferry, San Antonio, TX, 78245 bearing the return address of Alex Fisher, 6918 Century Ave, Middleton, WI 53562. In Your Affiant’s training and experience, individuals receiving shipments of large amounts of cash are usually 11   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 12 of 20. PageID #: 13 engaged in the sale of illegal narcotics. 35. PI Green reviewed historical Postal service delivery records for 1923 Harpers Ferry St. and identified the following a parcel delivered to that address on March 24, 2018. The parcel bore U.S. Postal Service Priority Mail Parcel Tracking # 92055901755477000063652862 and was addressed to Zapit Service C/O Robert, 1923 Harpers Ferry St. San Antonio, TX 78245-2015 with the return address of Nova’s Boutique STE B2, 2011 Fairburn Road, Douglasville, GA 30135. PI Green reviewed Postal Office records and learned that the Postal Office does not have a record of a Suite B2 at the listed return address. Also, PI Green learned that the postage to mail the parcel was purchased through the same third party postage provider that MH4LIFE uses to mail narcotics. It is your Affiants experience that individuals involved with the mailing of illegal contraband including narcotics sometimes list nonexistent return address information, such as a real address that does not have the listed suite or sub-address. 36. On April 16, 2018, MH4LIFE updated MH4LIFE’s Dream Market account profile stating “We are almost out of MAF (mostly the last batch but some of the prior one too) but not sure which is which since they have been mixed. We will be liquidating inventory this week so watch out for listings. Items include, small amount of pure fentanyl, MDMA, Ketamine, Cocaine, BTH, MJ.” 37. On April 18, 2018, PI Green and HSI SA Grote conducted an undercover purchase of 1.1 grams of MAF from MH4LIFe on the Dream Market to be mailed to the Northern District of Ohio. 38. On April 19, 2018, USPIS Postal Inspectors and HSI Special Agents in San Antonio, Texas, initiated surveillance on 1923 Harpers Ferry, San Antonio, TX, 78245. Agents observed HOLLY ROBERTS’ burgundy Ford Explorer parked in the driveway of her residence 12   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 13 of 20. PageID #: 14 at 1923 Harpers Ferry, San Antonio, TX. The vehicle did not move the entire surveillance. Surveillance was terminated at approximately 4:00 p.m.. It was later discovered that MH4LIFE mailed the controlled fentanyl purchase (along with several other identical packages) on April 19, 2018. USPS records indicate that a shipping label for the controlled purchase was created on April 19, 2018 at approximately 4:30 p.m. and the parcel was scanned by the originating post office at approximately 6:45 p.m. 39. On April 19, 2018, MH4LIFE updated MH4LIFE’s Dream Market account profile stating “We are out of Fentanyl. Old MAF (crystalline batch) listed (Only a few grams of this). We will ship some products Thursday & the rest Friday. The clearance sale took off faster than expected, but everything will be sent Friday. We may even ship Sat if ordered the night before and over $200. Thanks again for everyone’s support and patience.” 40. On April 20, 2018, Postal Inspectors and Special Agents resumed surveillance of 1923 Harpers Ferry, San Antonio, Texas. The burgundy Explorer was no longer at the residence. Agents observed a gold Hyundai arrive at 1923 Harpers Ferry at approximately 9:00 a.m. The Hyundai is registered to MATTHEW ROBERTS of 1923 Harpers Ferry. A female fitting the description of HOLLY ROBERTS exited the vehicle and entered the residence at 1923 Harpers Ferry. At approximately 2:00 p.m., Agents observed HOLLY ROBERTS leave the residence in the gold Hyundai and drive to the InTown Suites located at 6625 Bandera Rd., San Antonio, Texas, 78238. Agents observed Holly Roberts enter the InTown Suite, room 114.8 Agents observed the burgundy Ford Explorer registered to HOLLY ROBERTS already parked in the parking lot of the InTown Suites directly in front of Room 114. Agents observed HOLLY ROBERTS exit the room and drive the gold Hyundai to a Walgreens Pharmacy next to the hotel.                                                              8 InTown Suite is a motel with a door to the room facing the outdoors. 13   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 14 of 20. PageID #: 15 41. Agents surveilled HOLLY ROBERTS on foot and observed her approach the checkout counter with two loadable VISA gift cards. HOLLY ROBERTS told the cashier she wanted to put $300 on one and $500 on the other. Agents observed HOLLY ROBERTS pull out a roll of $100 bills from her purse. The cashier advised HOLLY ROBERTS that she needed to see her ID. HOLLY ROBERTS contested the cashier and stated she did not have a valid driver’s license with her. HOLLY ROBERTS became agitated and left Walgreens without making a purchase. Based on Your Affiant’s training and experience, Your Affiant is aware that drug traffickers often use cash to purchase loadable gift cards such as these VISA gift cards as a way to launder their drug proceeds. Furthermore, your affiant is aware that drug traffickers – particularly dark net drug traffickers who take significant steps to hide their identity – avoid providing their identifiers or showing identification such as a driver’s license to a third party. 42. Agents observed HOLLY ROBERTS return to the hotel room. Shortly thereafter HOLLY ROBERTS was seen making several in and out trips of the hotel room to both vehicles. HOLLY ROBERTS took several items from the gold Hyundai and placed them in the burgundy Explorer. On the last trip out of the Hotel room before she departed, HOLLY ROBERTS was observed carrying what appeared to be a bag of USPS Priority envelopes in a grocery bag. She placed the envelopes in the explorer and departed the hotel. These envelopes were recognized by agents and PIs as the same USPS priority mail envelopes used by MH4LIFE to make narcotics shipments to the online undercover agents. Based on these observations and Your Affiant’s experience investigating dark net vendors, Your Affiant believes that MATTHEW and HOLLY ROBERTS are using the hotel as a staging area for their dark net drug operation, with drugs, mailings, and likely some form of electronic devices located there to facilitate creating and distributing their narcotics. Your Affiant is aware based on his training and experience that dark 14   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 15 of 20. PageID #: 16 net vendors often use multiple locations, including hotel/motel rooms and warehouses, as a staging area in addition to their home, where they keep other contraband. 43. HOLLY ROBERTS was observed departing the hotel in the burgundy Explorer. HOLLY ROBERTS returned to 1923 Harpers Ferry. No further movement was reported. 44. On April 21, PI Green recovered U.S. Postal Service Priority Mail parcel #92055901755477000070075548 in the Northern District of Ohio resulting in the identification of approximately 1 gram of white powdery substance, lab results pending. The subject parcel is further described as a U.S. Priority Mail Envelope bearing the return address of Collectibles4less #137, 210 South Stage Coach Trail, San Marcos, TX 78666 mailed from a collection box in the San Antonio, Area.9 USPS records show the parcel was shipped after the discontinuation of surveillance on April 19, 2018. 45. On April 21, 2018, MH4LIFE updated MH4LIFE’s Dream Market account profile stating, “We are sold out of just about everything other than: (Cole, BTH/Gunpowder, MDMA, & MJ). We are undecided whether we will continue selling Fent related items. They are too hard to find consistently pure and as advertised. Thank you to everyone who stood by us over the years. We do appreciate the kindness and loyalty you showed us. Good luck everyone. P.S. Don’t worry all items will be delivered as promised. This isn’t goodbye yet. We are simply taking a much needed vacation and will ship everything that sells, or cancel it if no longer in stock.” 46. On April 23, 2018, PI Green and SA Grote conducted an undercover purchase of 3 grams of Gun Powder heroin and 1 gram of Black tar heroin from MH4LIFe on the Dream Market to be mailed to the Northern District of Ohio.                                                              9 Dark net vendors typically use fake return addresses to avoid law enforcement immediately finding their location. While the address is commonly not associated with the vendor, it is often an actual address because of a concern that the post office could reject a package with a return address that does not exist. 15   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 16 of 20. PageID #: 17 47. On April 24, 2018, at approximately 3:00 p.m., MH4LIFE indicated on the Dream Market that the undercover purchase had been accepted. At approximately 4:40 p.m., MH4LIFE used the Dream Market to mark the undercover purchase as shipped. 48. On April 24, 2018, Postal Inspectors and HSI Special Agents conducted surveillance on both 1923 Harpers Ferry, San Antonio, Texas, 78245 and InTown Suites located at 6625 Bandera Rd. San Antonio, Texas, 78238. Agents observed the gold Hyundai parked at the hotel and the burgundy Explorer at 1923 Harpers Ferry. 49. At approximately 5:30 p.m., Postal Inspectors parked approximately five houses away from 1923 Harpers Ferry in a dark tinted vehicle to conduct surveillance. As the Postal Inspectors watched the house from the stationary vehicle, they observed MATTHEW ROBERTS walk past their vehicle. MATTHEW ROBERTS was walking at a slow pace while carrying two white plastic bags, similar to those carried out of the hotel room by HOLLY ROBERTS. MATTHEW ROBERTS was observed walking at a very slow pace across the front yard and entering the front door of 1923 Harpers Ferry. Postal Inspectors were not able to determine where MATTHEW ROBERTS came from or how he ended up on foot walking by them. 50. Shortly after the Postal Inspectors encounter with MATTHEW ROBERTS, MH4LIFE updated MH4LIFE’s Dream Market account with the following message: “Code Red. Change your drop spots immediately. This is all I can say. Take the loss and leave negative fb. Assume address and packs have been compromised. B. Do not send messages or inquire about past orders delivered. Please trust and cut ties. This is 4 all. :( Email me (PGP) with new address if you want to rick delivery by Friday on items from this weekend and Monday. After this date no longer be logging into site or email. I am very sorry about this. No need worrying bout the past but be cautious starting now. Safety first. Not sure what happened exactly and will not discuss more 4 16   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 17 of 20. PageID #: 18 op sec reason. E SAFE and God Bless u all r being their 4 us. My advice is to let this die down and don’t draw any unneeded attention to the location it was coming from or to yourselves. Any problem would not come right away but possibility of being watched. It could just be a scare so take caution and be discreet. Instead of disappearing am be honest. Will delete soon.” 51. Law enforcement had been engaged in surveillance at the location for several days. There were a few instances where individuals, such as neighbors, potentially took notice of them. Based on the timing of these events and circumstances, Your Affiant believes that MATTHEW ROBERTS was alarmed at the presence of potential law enforcement, approached the inspectors conducting surveillance on foot in a manner that avoided immediate detection, identified the investigators as potential law enforcement, and then proceeded into 1923 Harpers Ferry, where he logged onto the MH4LIFE account and informed his customers about law enforcement’s presence. It also appears MATTHEW ROBERTS intends to make a final series of sales and mailings this week, and then stop using the account MH4LIFE as of Friday, April 27. 52. On April 25, 2018, your Affiant logged onto the Dream market and saw that MH4LIFE / ROBERTS had logged in to the MH4LIFE account. Based on this observation and the prior statement that MH4Life will make sales through the week, it appears that ROBERTS will continuing to use the account and traffic in and mail drugs until Friday, April 27. 53. PI Green obtained grand jury records from InTown Suites identifying MATTHEW ROBERTS as the tenant of room 114 since December 12, 2017. MATTHEW ROBERTS provided his driver’s license when he initially rented the room through April 20, 2017. Records indicate MATTHEW ROBERTS paid a total of $4,805.82 in cash for hotel room rent. This also included a weekly technology fee for high-speed internet access. The custodian of records for InTown Suites advised MATTHEW ROBERTS paid for room 114 through April 27, 2018. Based on Your 17   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 18 of 20. PageID #: 19 Affiant’s training and experience, the consistent cash payments totaling a high-dollar value, the fact that he was paying nearly $5,000 for a hotel room that is located near his home (which he had access to, based on him entering the front door), and the consistent payments for high speed internet are all consistent with a dark net drug trafficking organization making use of the hotel room as an alternate location for drug trafficking activities. 54. Based on the evidence, your Affiant submits that HOLLY ROBERTS and MATTHEW ROBERTS have been operating MH4LIFE from both 1923 Harpers Ferry, San Antonio, TX, 78245 and InTown Suites Room 114 located at 6625 Bandera Rd. San Antonio, Texas 78238. 55. On April 25, 2018, PI Green reviewed MH4LIFE’s Dream Market Profile that identified his last activity/login occurred on April 25, 2018. As of April 25, 2018, Dream Market records indicate MH4LIFE is responsible for over 3,100 sales of illegal narcotics across multiple dark net marketplaces. Postal Service database records identify over 200 associated mailings, based on similar return addresses, origin of mailing, and postage sent by MH4LIFE since February 2018. 56. It is suspected that MH4LIFE is an acronym for Matthew (and) Holly 4 Life. 57. On April 25, 2018, Postal Inspectors and Homeland Security Investigations Specials Agents executed a federal search warrant on InTown Suites 6625 Bandera Rd, Room 114, San Antonio, TX 78238 and identified Matthew Roberts inside. A search of Room 114 resulted in the recovery of a number of items, including (but not limited to) packaging material (including U.S. Postal Service Priority envelopes), electronic devices, computers, hand written notes with codes to access cryptocurrency wallets, various packages containing substances containing suspected narcotics, a large amount of U.S. Currency, and numerous packages of glow bracelets 18   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 19 of 20. PageID #: 20 identical to the ones that MH4Life used as a decoy in the undercover purchase of Methoxyacetylfentanyl, described above 58. On April 25, 2018, Postal Inspectors and Homeland Security Investigations Specials Agents executed a federal search warrant on 1923 Harpers Ferry, San Antonio, TX 78245. Holly Roberts immediately exited the residence and stated to Special Agent Michael Grote that “my ex-husband has drugs in the house and I’ve been begging him to get them out.” A subsequent search of the residence identified a number of items, including (but not limited to) a 22 caliber pistol, large quantities of narcotics paraphernalia in various states of use, and large amounts of suspected narcotics in various states of use. Also recovered was a typed paper listing the following: “7/17/17 Monday Orders, MDMA Express [redacted name], 209A Morgan Ave. STE F, Brooklyn, NY 11237, COCAINE PM Total 1.7 Coke [redacted name], 605 North Allin Street, Bloomington, IL 61701, AMP PM ***DECOY*** [redacted name], 2905 Iola St. Denver, CO 80238.” Based on my training and experience, this paper lists dark net distribution records, with products that matches that of MH4Life. Both searches were ongoing at the time of this complaint’s signing. 19   Case: 1:18-mj-03109-TMP Doc #: 1-1 Filed: 04/25/18 20 of 20. PageID #: 21 59. For the foregoing reasons, Affiant respectfully submits that there is probable cause that MATTHEW ALAN ROBERTS and HOLLY ROBERTS, a.k.a. MH4LIFE, committed the following federal offenses: Conspiracy to Possess with Intent to Distribute and to Distribute Controlled Substances and Controlled Substance Analogues, in violation of 21 U.S.C. § 846. __________________________________ Bryon Green Postal Inspector SUBSCRIBED AND SWORN TO ME THIS ____ DAY OR APRIL, 2018 VIA TELEPHONE AFTER SUBMISSION BY RELIABLE ELECTRONIC MEANS. FED. R. CRIM. P. 4.1; 41(D)(3). ___________________________________ THOMAS M. PARKER U. S. MAGISTRATE JUDGE 20   10:31 PM, Apr 25, 2018