AO 106 (Rev. 04/10) Application for a Search Warrant Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.1 Page 1 of 28 UNITED STATES DISTRICT Co RT F!LE for the Southern District of California In the Matter of the Search of ) ) ) ) ) ) (Briefly describe the property to be searched or identify the person by name and address) black Google cellular telephone NOV 0 8 2018 Case No. 18MJ5777 APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the pr.E.lffaa't{;?,g~feK-'27ed and give its location): Southern located in the District of , there is now concealed (identify the California -----------~ person or describe the property to be seized): Attachment B The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more): ~evidence of a crime; ~contraband, fruits of crime, or other items illegally possessed; ~property designed for use, intended for use, or used in committing a crime; 0 a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Offense Description Code Section 18 U.S.C. § 1956(a)(3) 18 U.S.C. § 1960(a) 18 U.S.C. § 1343 laundering of monetary instruments operation of unlicensed money transmitting business wire fraud The application is based on these facts: See attached affidavit (incorporated by reference). ~ Continued on the attached sheet. 0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ )is requested under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. Nick Jones, Special Agent, HSI Printed name and title Sworn to before me and signed in my presence. Date: \ '\-~ - '\ q,. City and state: San Diego, California Robert A McQuaid, U.S. Magistrate Judge Printed name and title Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.2 Page 2 of 28 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Attachment A-2 LOCATION TO BE SEARCHED The location to be searched is a black Google cellular telephone belonging to Morgan Rockcoons that was detained on October 28, 2018, and is currently in the possession of the Department of Homeland Security, San Diego Cyber Crimes Group. Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.3 Page 3 of 28 ATTACHMENT B 1 2 3 4 5 6 The items to be seized include certain items, documents, and records relating to violations of 18 U.S.C. § 1956(a)(3) (laundering of monetary instruments); 18 U.S.C. § 1960 (prohibition of unlicensed money transmitting business); and 18 U.S.C. § 1343 (wire fraud), including: 7 8 9 10 11 1. Proceeds of money laundering, operating an unlicensed money transmitting business, and wire fraud, including: evidence of cash, bitcoin, other virtual currencies, and including passwords for access to virtual currency storage and accounts, such as digital wallets and electronic lock boxes; 12 13 14 15 16 2. Records relating to the operation of an unlicensed money transmitting business, including: records of the exchange of currencies for virtual currencies, records regarding customers of an unlicensed money transmitting business, advertising and materials for unlicensed money transmitting business; 17 18 19 20 21 22 3. Financial records relating to virtual currency transactions, including: bank account records, bitcoin address information, wire transfer or money transfers records, records regarding the purchase or exchange of virtual currencies, records regarding the use of pre-paid debit or credit card accounts, records or account information regarding virtual currency exchange platforms and associated services; 23 24 25 26 27 28 4. Records relating to the website Localbitcoins.com, including profile information, transactional records, and records regarding communications occurring via that platform; Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.4 Page 4 of 28 1 2 3 4 5. Records of correspondence or communications conducted in the course of operating an unlicensed money transmitting business; or regarding money laundering transactions; or regarding real estate purchases, sales, and development in Elko County, Nevada, including the recording or transfer of deeds. 5 6 7 6. Records relating to any co-conspirators or any individuals involved in or with knowledge of the activities described herein; 8 9 7. Records tending to provide context to, or custody and control of, any responsive 10 communications, records, and attachments described above, such as electronic mail 11 sent or received in temporal proximity to a relevant communication or record and 12 any communication or record tending to identify the user(s) of the electronic 13 devices to be searched; 14 15 8. Records relating to the dominion and control of the seized electronic device(s); 16 17 Which are evidence of violations of 18 U.S.C. § 1956 (money laundering), 18 U.S.C. § 18 1960 (Prohibition of unlicensed money transmitting business), and 18 U.S.C. § 1343 19 (wire fraud). As used above, the term "records" includes all of the foregoing items of 20 evidence in whatever form and by whatever means they may have been created or stored 21 22 23 24 25 26 27 28 and any form of electronic or computer storage. Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.5 Page 5 of 28 1 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS I, Nick Jones, Special Agent with the Department of Homeland Security ("DHS"), 2 4 5 6 INTRODUCTION 1. pursuant to Rule 41 of the Federal Rules of Criminal Procedure, for: 7 a. Samsung tablet (serial number: R52JAOJ2KJN) belonging to Morgan 8 Rockcoons (further described in Attachment A-1); 9 b. black Google cellular telephone belonging to Morgan Rockcoons (further 10 described in Attachment A-2); and 11 c. brown and tan camouflage backpack belonging to Morgan Rockcoons 12 13 14 15 16 17 18 19 20 21 22 23 24 25 I make this affidavit in support of applications for issuance of search warrants, (further described in Attachment A-3). 2. The purpose of the search warrants is to seize items, more fully described in Attachment B, that constitute evidence and fruits of federal crimes, including: 18 U.S.C. § 1343 (laundering of monetary instruments with the intent to conceal the nature, location, source, ownership, or control of property believed to be the proceeds of specified unlawful activity); 18 U.S.C. § 1960 (prohibition of unlicensed money transmitting business); and 18 U.S.C. § 1343 (wire fraud). 3. The facts set forth in this affidavit are based on my own personal knowledge; knowledge obtained from other individuals during my participation in this investigation, including other law enforcement officers; my review of documents and computer records related to this investigation; communications with others who have personal knowledge of the events and circumstances described herein; and information gained through my training and experience. Because this affidavit is submitted for the limited purpose of establishing probable cause in support of the applications for search warrants, it does not 26 27 AFFIDAVIT IN SUPPORT OF APPLICATIONS FOR SEARCH WARRANTS Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.6 Page 6 of 28 1 set forth each and every fact that I or others have learned during the course of this 2 investigation. 3 4. I am a Special Agent employed by United States Immigration and Customs 4 Enforcement, Homeland Security Investigations (HSI) and have been so employed since 5 2004. I am currently assigned to HSI's San Diego Cyber Crimes Group. My current 6 responsibilities include the investigation of cybercrimes, including virtual currency money 7 laundering and unlicensed money transmitting businesses specializing in the exchange of 8 virtual currencies. 9 University of California, Los Angeles. I am a graduate of the Criminal Investigator I have a Bachelor of Arts Degree in Political Science from the 1O Training Program and the Immigration and Customs Enforcement Special Agent Training 11 Program at the Federal Law Enforcement Training Center. I have completed Network+ 12 and Global Information Assurance Certification Security Essentials Certification (GSEC) 13 training. Based on this training and experience, I am familiar with the manner in which 14 persons engaged in cybercrimes operate; the manner in which cybercrimes are perpetrated; 15 certain techniques, methods, or practices commonly used by persons engaged in 16 cybercrime activity; and indicia of cybercrime activity. This training and experience 17 forms the basis for opinions I express below. 18 STATEMENT OF PROBABLE CAUSE 19 Summary 20 5. Morgan Rockcoons operated a bitcoin exchange business in San Diego, 21 selling bitcoin to individuals that he met through the Internet. Rockcoons is not registered 22 to conduct this business as required by law. Accrodingly, on or about November 8, 2017, 23 a federal grand jury in San Diego, California, returned a two-count indictment against 24 Morgan Rockcoons (docket no. 17-cr-3690-AJB), charging him with (i) laundering of 25 monetary instruments, in violation of 18 U.S.C. § 1956(a)(3); and (ii) operation of 26 unlicensed money transmitting business, in violation of 18 U.S.C. § 1960(a). Rockcoons 27 was arrested on these charges in February 2018 and was released on bond. While on 28 pretrial release, Rockcoons hatched a land fraud scheme, purporting to sell land in Elko AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 2 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.7 Page 7 of 28 1 County, Nevada that Rockcoons did not own. As a result, the grand jury returned a 2 superseding indictment adding four counts of wire fraud in violation of 18 U.S.C. § 1343. 3 Rockcoons was arrested on the new charges on October 28, 2018. At the time of his arrest, 4 Rockcoons was in possession of a Black, 16 GB, Samsung tablet (serial number: 5 R52JAOJ2KJN); a Black, Google cellular telephone; and a brown and tan camouflage 6 backpack, with black patch, stating "Stealth Angel." I seek authorization to search those 7 items. 8 Overview of Bitcoin 9 6. Based on my training and experience, I know that bitcoin is a digital, or 1O "virtual," currency that exists entirely on the Internet and not in any physical form. No 11 government, bank, or company generates bitcoin. Instead, computer software operating 12 on a decentralized "peer-to-peer" network generates and controls the digital currency. To 13 acquire bitcoin, a user typically must purchase the currency from a bitcoin exchanger. 14 Bitcoin exchangers generally accept payments of conventional currency and, in return for 15 a commission, transfer a corresponding number of bitcoin, based on a floating exchange 16 rate, to a bitcoin address designated by the customer. A bitcoin address is analogous to a 17 bank account number, designated by a complex string of letters and numbers. Further, 18 based on my training and experience, I know that persons operating as unlicensed money 19 transmitters, offering bitcoin exchange services, will facilitate their activities utilizing 20 computers, electronic tablets, and smart phones. Computers, tablets, and smart phones are 21 vital in conducting the transfer ofbitcoins from one person to another or from one address 22 to another, because, as noted, bitcoin exists entirely on a digital network. 23 Initiation of Investigation 24 7. In September 2015, I learned that San Diego-based bitcoin exchangers were 25 advertising their services on the website Localbitcoins.com. My review of persons listing 26 their services on this website revealed that the most prolific San Diego-based seller at the 27 time went by the nickname "Metaballo," and advertised his services as both a trader and 28 a seller of bitcoin. I reviewed Metaballo' s Localbitcoins.com profile, discovering that it AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 3 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.8 Page 8 of 28 1 indicated that between January 2013 and September 2015, he had conducted more than 2 100 transactions on Localbitcoins.com and that he operated out of San Diego, Yuba City, 3 Upper Lake, and Sacramento, California. His profile listed a website, www.kinetics.cc. 8. 4 Also in September 2015, I reviewed Metaballo's website and found Facebook 5 pages for Kinetics.cc and Metaballo. The Kinetics Facebook page included a post, dated 6 July 11, 2014, which read: "Dear bitcoin community, my name is Morgan Rockwell, I am 7 CEO ofBitcoin Kinetics Inc. I created the first Bitcoin operated service machine to allow 8 Bitcoin to be used in the real world in all machines and businesses. We are rapidly 9 expanding and growing into new territories, industries into a competitive and profitable 10 environment." Metaballo's Facebook page included posts identifying Morgan Rockwell 11 as Morgan Rockcoons. 12 2014, stating, "Metaballo on Localbitcoins.com buy and sell bitcoins with trader 13 Metaballo." 14 9. 1 This Facebook page also contained a post, dated January 15, In April 2016, I again reviewed Rockcoons's Localbitcoins.com profile, 15 which showed that he continued to advertise as a trader and seller ofbitcoin in San Diego, 16 with his profile reflecting that he had engaged in more than 500 transactions and 17 describing him as a professional trader. In March 2017, Rockcoons's Localbitcoins.com 18 profile reflected that he was also offering bitcoin exchanging services in Las Vegas, 19 Nevada. In October 2017, I again reviewed ROCKCOON's LocalBitcons.com profile, 20 which showed that as of October 2017, Rockcoons' s profile indicated that he conducted 21 more than 1,000 bitcoin trades with more than 644 people. 10. 22 In September 2015, April 2016, and again in October 2017, I confirmed that 23 neither Rockcoons nor any of his companies were registered as a money services business 24 with the U.S. Department of Treasury as required under federal law. 25 II 26 At some point, Rockcoons decided to change his legal last name by merging his father's last name, Rockwell, with his mother's last name, Coons. For much of his life, 28 however, he went by his given name of Morgan Rockwell. 27 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 4 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.9 Page 9 of 28 1 Undercover Investigation 2 11. In December 2016, I, acting in an undercover capacity as a person named 3 "Nima," left a voice message with Rockcoons (at (619) 721-3384, the number posted by 4 Rockcoons on his profile on Localbitcoins.com). I requested his service in exchanging 5 cash to bitcoin. In subsequent text message conversations, Rockcoons explained to me 6 that he was aware of and followed anti-money laundering and know your customer 7 requirements. 8 requirement, stating that if I engaged in a transaction in excess of $10,000 USD cash, 9 information about me would have to be obtained. In the course of this early exchange of 10 text messages, Rockcoons provided me with Rockcoons' s full name as "Morgan 11 Rockwell," and further provided his legal name as "Morgan Rockcoons." Rockcoons also 12 provided me with his Localbitcoins.com profile as proof that Rockcoons exchanged 13 between 30 and 60 bitcoins per week. 14 12. Rockcoons also informed me of the currency transaction reporting In a text message, I informed Rockcoons in my undercover capacity that I was 15 engaged in the manufacture of butane hash oil (a Schedule I controlled substance). I 16 further informed Rockcoons that the $14,500 in cash that I wanted to exchange into bitcoin 17 were the proceeds of the manufacture of hash oil. I informed Rockcoons that the cash was 18 being exchanged to bitcoin to buy an extraction device, which would be used to increase 19 my hash oil manufacturing capacity. 20 statements to me that indicated that Rockcoons was knowledgeable about butane hash oil. 21 Rockcoons also told me that he operated a business engaged in the sale of marijuana and 22 hash oil in San Francisco. Rockcoons offered to assist me in selling the hash oil that I 23 manufactured. Rockcoons wrote that he wanted to be the "Steve Jobs" of "Cannabis and 24 bitcoin," and that he had provided currency exchange services to other marijuana industry 25 individuals and entities. 26 13. In text messages, Rockcoons made multiple Also in December 2016, in a text message, I told Rockcoons that, because I 27 was engaged in the manufacture and sale of hash oil, I did not want to provide any 28 identifying information in connection with my exchange of $14,500 cash for bitcoin. AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 5 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.10 Page 10 of 28 1 Rockcoons responded that he understood and suggested that I could break up the 2 transaction over two days, each transaction being less than $10,000 USD, to avoid the 3 currency transaction reporting requirement. Rockcoons later completely abandoned the 4 requirement of making me break up the transaction into two separate transactions, 5 accepting all $14,500 from me in one transaction, and not requiring any identifying 6 information from me. Rockcoons did not file a currency transaction report. 7 14. On December 30, 2016, as instructed by Rockcoons, I sent Rockcoons 8 $14,500 cash concealed in a FedEx package for the purpose of Rockcoons exchanging it 9 to bitcoin. 10 11 On January 3, 2017, the package was delivered to Rockcoons, which Rockcoons confirmed to me via text message. 15. On January 8, 2017, in exchange for the $14,500 in cash that I sent to him, 12 Rockcoons transferred 9.998 bitcoins to a bitcoin address at my direction, with an 13 equivalent value of $9,208.62. Rockcoons charged a fee of $5,291.38 (more than thirty- 14 six percent) for conducting the exchange. 15 16. In June 2017, I introduced a second undercover persona to Rockcoons named 16 "Chris." At the time, Rockcoons was looking for people to invest in his marijuana 17 distribution business in Las Vegas. On June 15, 2017, I, posing as Chris, met with 18 Rockcoons at the Gold Spike, 217 Las Vegas Blvd North, Las Vegas, Nevada. I arrived 19 at the Gold Spike early and sat in the lobby. I then observed Rockcoons exit an elevator 20 within the Gold Spike. I recognized Rockcoons from his California Department of Motor 21 Vehicles photograph. 22 that he used to send the texts detailed in this affidavit. In the course of the meeting, 23 Rockcoons told me that he resided at the Gold Spike and that he had signed a one-year 24 lease to live there. Rockcoons also told me that he had been very busy the prior night 25 trading bitcoins into the late hours of the night. Also during the meeting and in subsequent 26 text messages, Rockcoons described his involvement in the exchanging ofbitcoin as well 27 as his marijuana and marijuana concentrates activities. Rockcoons described his bitcoin 28 activities in a text message to me as, "I'm a professional money manager and mover of The meeting was arranged by Rockcoons using the same phone AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 6 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.11 Page 11 of 28 1 funds without personal identification information attached to the funds or equity. This is 2 my speciality [sic]." 3 Interview of Rockcoons 17. 4 Based on my ongoing undercover communications with Rockcoons, I knew 5 that Rockcoons planned to be at the Coffee Bean and Tea Leaf on West Broadway in San 6 Diego on August 30, 2017. Another HSI special agent and I approached Rockcoons at the 7 cafe, identified ourselves, and asked Rockcoons if he was willing to speak with us about 8 Rockcoons' s bitcoin business. Rockcoons agreed. 9 18. Rockcoons admitted that for the past nine years, his sole source of income has 10 been from fees charged for the buying and selling of bitcoin for different customers. He 11 estimated that he had conducted transactions with third parties totaling 10, 000 bitcoin (as 12 of August 1, 2017, one bitcoin traded for $4,738). Rockcoons explained that he advertises 13 his bitcoin exchange business on Localbitcoins.com. He said that he meets people on this 14 website and then meets them in person to conduct the exchange. Rockcoons admitted that 15 he conducted thousands of bitcoin transactions with customers he met on 16 Localbitcoins.com. Rockcoons said that he charges his customers between 10 to 20 17 percent commission and that he conducts about 5 to 10 transactions per day. 18 19. Rockcoons acknowledged that his business constitutes a money services 19 business. He also admitted that when he conducts an exchange in which he receives more 20 than $10,000, he is required to fill out a currency transaction report (CTR). Rockcoons 21 said that he has never filed a CTR. He also said that he never asked for a customer's 22 identity, even though he knew that he should, because he did not want to risk losing 23 customers. He admitted that he should have had an anti-money laundering program and 24 that he should have followed know your customer practices but did not. Rockcoons told 25 me that he had various business records regarding his operation of his unlicensed money 26 transmitting business at his residence in Las Vegas. 27 II 28 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 7 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.12 Page 12 of 28 1 Indictment 2 20. On or about November 8, 2017, a federal grand jury sitting in San Diego, 3 California, returned a sealed two-count indictment against Rockcoons (docket no. 17-cr- 4 3690-AJB), charging him with (i) laundering of monetary instruments, in violation of 18 5 U.S.C. § 1956(a)(3); and (ii) operation of unlicensed money transmitting business, in 6 violation of 18 U.S.C. § 1960(a). Pursuant to 18 U.S.C. § 982, the indictment also includes 7 forfeiture allegations, seeking the forfeiture of any property involved in the charged 8 offenses, property traceable to such property, or property up to the value of property 9 subject to forfeiture. 10 11 First Arrest of Rockcoons/Conduct on Pre-Trial Release 21. On February 9, 2018, law enforcement arrested Rockcoons at the Palms Hotel 12 in Las Vegas, Nevada, where he was staying. Rockcoons was arraigned on the indictment 13 on February 22, 2018, and he was released on bond on about March 15, 2018. 14 22. While on pretrial release, Rockcoons has been committing land fraud, 15 purporting to sell parcels ofland in the Nevada desert as part of a development he is touting 16 as "Bitcointopia." As part of this scheme, Rockcoons has "sold" (that is, accepted payment 17 for) more land than he owns. In addition, Rockcoons has lulled a victim with false 18 statements to induce him to not seek a refund of his payment. 19 Bitcointopia 20 23. In spring 2018, Rockcoons began promoting Bitcointopia on the Internet at 21 www.bitcointopia.org, a website that was registered by Rockcoons. A purported real estate 22 development in the desert in Elko County, Nevada, Rockcoons touted Bitcointopia as a 23 place where bitcoin is "legal tender." Rockcoons described Bitcointopia as "the capital of 24 a newly formed nation run by Bitcoin appropriations, Blockchain voting & BIP based 25 laws." The website listed contact telephone number (619) 721-3384 (the same number 26 that Rockcoons used to communicate with me as an undercover agent conducting the 27 earlier money laundering investigation detailed above) and the contact email 28 land@bitcointopia.org. AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 8 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.13 Page 13 of 28 1 24. On the website, Rockcoons offered parcels of land for sale, claiming: "The 2 land is currently owned by Bitcointopia, Inc corporation" and that "500-1000 Acre plots 3 are for sale for 0.5 BTC per acre." As detailed below in paragraph 30, Bitcointopia, Inc. 4 owns only about 5 acres of land in Elko County, Nevada. 5 Victim 4 6 25. In June 2018, Victim 4, a San Diego resident, visited bitcointopia.org and 7 learned that he could purchase one acre of land for .5 bitcoin (one bitcoin is currently 8 worth about $6,400). Reviewing the website, Victim 4 learned that "[r]unning water is 9 provided by a brand new water pump" and that "500 Acres of Solar Panels are being 1O installed to build a local power grid." 26. 11 Victim 4 wished to buy land as detailed on the website. Accordingly, on June 12 26, 2018, Victim 4 communicated with Rockcoons via Rockcoons' Twitter account 13 "nodefather". 2 Rockcoons wrote, "You let me know when your ready. Need: Legal Name 14 Name of property TXID of BTC payment Email to land@bitcointopia.org." ["TXID" 15 means transaction i.d. Rockcoons was explaining to Victim 4 that once he paid for the 16 land with bitcoin, he should send the transaction i.d. to land@bitcointopia.org to prove 17 that payment had been made.] 18 27. On June 27, 2018, Victim 4 visited the Bitcointopia website and pressed the 19 button "BUY LAND" to conduct the transaction. Pushing that button, Victim 4 arrived at 20 a screen that directed him to "Send BTC Payment Here to Verified Addresses" and listed 21 two addresses where payment could be sent. The same page stated, "Please provide 4-6 22 weeks for you land deed & city contract to arrive." Victim 4 sent .5 bitcoin to the listed 23 bitcoin address as directed. Victim 4 then sent an email to land@bitcointopia.org with his 24 legal name (for the deed) and the transaction identification confirming that he sent 25 26 2 Rockcoons has been established as the user of the nodefather Twitter account, because (i) he uses his own photo for the profile, and (ii) he uses this account to 28 comment on the pending prosecution against him (17cr3690-AJB). 27 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 9 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.14 Page 14 of 28 1 payment. Rockcoons confirmed via Twitter direct message (from his nodefather account) 2 that he received this email and the payment. 3 28. On June 28, 2018, Victim 4 received an email from land@bitcointopia.org. 4 The email was from: "Bitcointopia Inc Founder - Morgan Rockwell 4160 South Pecos 5 Road, Las Vegas NV 89121 6504279098 land@bitcointopia.org." Rockcoons wrote: 6 7 8 9 10 11 12 13 14 15 16 17 18 thank for your purchase of land! Your payment, once confirmed will be logged with your information, including your name, the name of your property & your TXID on the Bitcoin Blockchain to record your payment. The information is transferred to the county recorder and put into public records within 2 months or less. Please allow for 4-6 weeks for the deed to be filed and mailed out with the accompanying City Plan Contract. This contract states that Bitcointopia Inc will pay the first 5 years of annual land taxes, then those taxes become your responsibility after 5 years. City Services are provided on the contingency of this contract being agreed to & signed by your Bitcoin transaction and signature on paper. You will then be able to come do what you want with your land, such as camp, bring an RV, build a home or start a business. We will be building the city grid around all these plots to bring city services to your land, city services will be protected to be available by late 2019. 21 We want to thank you for your support of the Bitcointopia Expansion Project and helping start the Bitcointopia City. Your purchase of land helps fund the construction of the city and the development of Bitcointopia into the future. If you have any questions or want to come to see the land at any time, just message us and we will accommodate you. 22 Thank you for your support & purchase. 23 29. 19 20 Thereafter, Victim 4 continued to communicate with Rockcoons via Twitter, 24 email, and a messaging platform called Telegram. On July 20, 2018, Victim 4 asked 25 Rockcoons via Telegram about the status of the deed for the property he purchased on 26 June 27, 2018: "Any timeline for deeds?" Rockcoons replied, "will be sometime in Aug 27 for deed, submitted it June 29, so takes minimum of 6-8 weeks for county to record." 28 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 10 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.15 Page 15 of 28 1 Later on the same day, Rockcoons wrote to Victim 4, "I know you purchased land and 2 you might have trust issues like all Bitcoin users do especially with me." 30. 3 By early August 2018, Victim 4 still had not received his deed, and he 4 participated in online forums that discussed Rockcoons and shared derogatory information 5 about him. On August 2, 2018, Rockcoons messaged Victim 4 from his nodefather 6 Twitter account and wrote that he had "no problem giving you refund if you don't want 7 to participate in our new city." Victim 4 replied on the same day, "If I wanted a refund, 8 when would that be processed?" Rockcoons asked, "Is that what you want?" and Victim 9 4 replied, "I'm simply asking what that process would look like." Rockcoons wrote, "I 10 did submit your deed to the county, so I'd have to pay the taxes and transfer title to 11 company name and then once that title has Bitcointopia name on the deed I'd just send 12 BTC back, it's not very fast takes about 3 weeks to get a response from the county, it's 13 like selling the land all over again." As detailed below in paragraph 31, this statement 14 was false, as Rockcoons never filed a deed on behalf Victim 4. Based on my training and 15 experience and my involvement in this investigation, I believe that Rockcoons made this 16 false representation to lull Victim 4 into not seeking a refund for his land purchase and to 17 dissuade Victim 4 from contacting law enforcement. 18 Elko County Records Office 19 31. Investigation at the Elko County, Nevada Records Office established that 20 Bitcointopia Inc. owns two parcels of land. 3 Specifically, on May 22, 2018, Bitcointopia 21 Inc. bought parcel 024-001-001 (2.9 acres) for $2,300 and parcel 024-032-004 (2.070 22 acres) for $1,999. The parcels are not contiguous. There is no record that any other name 23 or entity associated with Rockcoons owns any land in Elko County. 24 32. Records checks confirmed that other than the two parcels noted above, there 25 have been no deeds of sale or transfer, or requests to transfer or sell any land by Rockcoons 26 or any other name or entity associated with him. 27 3 The deeds for Bitcointopia Inc.' s two parcels of land list Rockcoons' telephone 28 number wallet(619) 721-3384 as contact information. AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 11 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.16 Page 16 of 28 1 Victims 1-3 2 33. As noted above in paragraph 26, on the Bitcointopia.org land purchase page, 3 land purchasers are directed to send payment to one of two wallet addresses. Analysis of 4 the blockchain for those wallets indicates that from May 5, 2018, through July 28, 2018, 5 the wallets received about 36 transfers for a combined total of more than 12 bitcoins with 6 an approximate value of $95,856. 7 (consistent with the sale of 1 acre of land) and 13 transfers were .1 bitcoin (at one point, 8 Rockcoons was offering 114 acre in Bitcointopia for .1 bitcoin). 9 10 34. Of these transfers, 12 transfers were .5 bitcoin Investigation has identified three other victims of Rockcoons' land-fraud scheme who were willing to speak with agents: a. 11 On May 18, 2018, Victim 1, relying on the representations on 12 bitcointopia.org, paid 1.6 bitcoin for a 3 acre parcel in Bitcointopia. As of November 13 7, 2018, Victim 1 still had not received a deed for the purchased land. 14 b. On June 1, 2018, Victim 2, relying on the representations on 15 bitcointopia.org, paid .2 bitcoin for a .5 acre parcel in Bitcointopia. As of November 7, 16 2018, Victim 2 still had not received a deed for the purchased land. 17 c. On June 17, 2018, Victim 3, relying on the representations on 18 bitcointopia.org, paid 1.6 bitcoin for a 3.25 acre parcel in Bitcointopia As of November 19 7, 2018, Victim 3 still had not received a deed for the purchased land. 20 35. The land purchased by Victims 1-3 between May 2018 and June 17, 2018, 21 totaled 6. 75 acres ofland. Bitcointopia Inc only owns about 5 acres ofland in Elko County, 22 Nevada. When the San Diego victim purchased 1 acre of land on June 27, 2018, 23 Bitcointopia had no more land to sell. 24 25 Superseding Indictment/Arrest of Rockcoons/Detention of Laptop, Cell Phone, and Portable Drive 26 27 28 36. On October 24, 2018, a Grand Jury in the Southern District of California returned a Superseding Indictment in case no. 17cr3690-AJB adding four counts of wire AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 12 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.17 Page 17 of 28 1 fraud in violation of 18 U.S.C. § 1343 against Rockcoons in connection with his 2 Bitcointopia scheme described above. The Court issued an arrest warrant. 3 3 7. On October 28, 2018, Rockcoons was arrested in Chula Vista, California. At 4 the time of his arrest, Rockcoons had the following items in his possession: a Black, 16 5 GB, Samsung tablet (serial number: R52JAOJ2KJN); a Black, Google cellular telephone; 6 and a brown and tan camouflage backpack, with black patch, stating "Stealth Angel." 7 Before taking the backpack into custody, and with Rockcoons' consent, I asked 8 Rockcoons if there was anything of value in the backpack. Rockcoons identified the 9 Samsung tablet and a "pearl" and a "ruby". The two stones were put in an evidence bag, 10 and the tablet was taken into custody. I also verified that there were no weapons in the 11 backpack. During this process, I observed that there were documents in the backpack, 12 which I did not review. 13 14 Training and Experience Regarding Transactional Records and Computer Evidence 15 38. In my experience and training, individuals involved in operating unlicensed 16 money transmitting businesses and real estate development schemes maintain 17 transactional records on electronic media, such as laptop computers, desktop computers, 18 electronic tablets, mobile phones, and portable drives for long periods of time. Based on 19 the investigation to date, the unlicensed money transmitting, money laundering , and wire 20 fraud activities, as outlined above, were facilitated by utilizing a computer and/or other 21 electronic devices, including telephones. 22 23 24 25 26 27 28 39. With today's advanced technology, which includes cloud-based computing, large storage devices, and automated backup systems, electronic evidence can persist for long periods of time with or without the user's knowledge. The nature of some storage devices, such as hard disk drives, allows recovery of data that have been deleted by the user. As storage devices increase in size, the chances of successful recovery also tends to increase, because the odds that deleted data being overwritten by fresh data diminishes. AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 13 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.18 Page 18 of 28 1 40. Computer evidence can also persist if a user switches to a different computing 2 device. One example is the use of a service provided by Apple called "iCloud," which 3 syncs data across multiple user devices. With this technology, a file created or modified 4 on one particular device will be synchronized to appear on all the user's devices. Many 5 users employ iCloud or similar services to move data from an old device to a new device 6 (sometimes called data "migration"). 7 8 9 10 11 12 13 14 41. Based on my communications with Rockcoons, I know that he is very knowledgeable about computers, even authoring computer code. Sophisticated computer users often maintain computer backups called "images" of their computer( s) and device( s) in an effort to preserve data and quickly replicate time-consuming settings and configurations in the event of a system crash, loss of device, or migration to a new device. The use of these images mean that evidence on a particular individual's computer(s) or device(s) can persist over time as they are moved from device to device. In my opinion, Rockcoons, would be likely to employ such a methodology. 15 16 PROCEDURES FOR ELECTRONICALLY STORED INFORMATION 17 42. With the approval of the Court in signing these warrants, agents executing 18 these search warrants will employ the following procedures regarding computers and other 19 electronic storage devices, including electronic storage media, that may contain data 20 subject to seizure pursuant to the warrants: 21 22 Forensic Imaging a. A forensic image is an exact physical copy of the hard drive or other 23 media. A forensic image captures all the data on the hard drive or other media without the 24 data being viewed and without changing the data. Absent unusual circumstances, it is 25 essential that a forensic image be obtained prior to conducting any search of the data for 2 6 information subject to seizure pursuant to these warrants. 27 28 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 14 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.19 Page 19 of 28 1 b. After verified images have been obtained, the owner of the devices will 2 be notified and the original devices returned within forty-five (45) days of seizure absent 3 further application to this court. Identification and Extraction of Relevant Data 4 5 c. After obtaining a forensic image, the data will be analyzed to identify 6 and extract data subject to seizure pursuant to the warrants. Analysis of the data following 7 the creation of the forensic image can be a highly technical process requiring specific 8 expertise, equipment and software. There are thousands of different hardware items and 9 software programs, and different versions of the same programs, that can be commercially 10 purchased, installed, and custom-configured on a user's computer system. Computers are 11 easily customized by their users. Even apparently identical computers in an office or home 12 environment can be different with respect to configuration, including permissions and 13 access rights, passwords, data storage, and security. It is not unusual for a computer 14 forensic examiner to have to obtain specialized hardware or software, and train with it, in 15 order to view and analyze imaged data. 16 d. Analyzing the contents of a computer or other electronic storage device, 17 even without significant technical challenges, can be very challenging. Searching by 18 keywords, for example, often yields many thousands of hits, each of which must be 19 reviewed in its context by the examiner to determine whether the data is within the scope 20 of the warrants. Merely finding a relevant hit does not end the review process for several 21 reasons. The computer may have stored metadata and other information about a relevant 22 electronic record - e.g., who created it, when and how it was created or downloaded or 23 copied, when it was last accessed, when it was last modified, when it was last printed, and 24 when it was deleted. Keyword searches may also fail to discover relevant electronic 25 records, depending on how the records were created, stored, or used. For example, 26 keywords search text, but many common electronic mail, database, and spreadsheet 27 applications do not store data as searchable text. Instead, the data is saved in a proprietary 28 non-text format. Documents printed by the computer, even if the document was never AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 15 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.20 Page 20 of 28 1 saved to the hard drive, are recoverable by forensic programs because the printed document 2 is stored as a graphic image. Graphic images, unlike text, are not subject to keyword 3 searches. Similarly, faxes sent to the computer are stored as graphic images and not as 4 text. In addition, a particular relevant piece of data does not exist in a vacuum. To 5 determine who created, modified, copied, downloaded, transferred, communicated about, 6 deleted, or printed the data requires a search of other events that occurred on the computer 7 in the time periods surrounding activity regarding the relevant data. Information about 8 which user had logged in, whether users share passwords, whether the computer was 9 connected to other computers or networks, and whether the user accessed or used other 1O programs or services in the time period surrounding events with the relevant data can help 11 determine who was sitting at the keyboard. 12 e. It is often difficult or impossible to determine the identity of the person 13 using the computer when incriminating data has been created, modified, accessed, deleted, 14 printed, copied, uploaded, or downloaded solely by reviewing the incriminating data. 15 Computers generate substantial information about data and about users that generally is 16 not visible to users. Computer-generated data, including registry information, computer 17 logs, user profiles and passwords, web-browsing history, cookies and application and 18 operating system metadata, often provides evidence of who was using the computer at a 19 relevant time. In addition, evidence such as electronic mail, chat sessions, photographs 20 and videos, calendars and address books stored on the computer may identify the user at a 21 particular, relevant time. The manner in which the user has structured and named files, run 22 or accessed particular applications, and created or accessed other, non-incriminating files 23 or documents, may serve to identify a particular user. For example, if an incriminating 24 document is found on the computer but attribution is an issue, other documents or files 25 created around that same time may provide circumstantial evidence of the identity of the 26 user that created the incriminating document. 27 f. Analyzing data has become increasingly time-consuming as the volume 28 of data stored on a typical computer system and available storage devices has become AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 16 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.21 Page 21 of 28 1 mind-boggling. For example, a single megabyte of storage space is roughly equivalent of 2 500 double-spaced pages of text. A single gigabyte of storage space, or 1,000 megabytes, 3 is roughly equivalent of 500,000 double-spaced pages of text. Computer hard drives are 4 now being sold for personal computers capable of storing up to 2 terabytes (2,000 5 gigabytes) of data. And, this data may be stored in a variety of formats or encrypted 6 (several new commercially available operating systems provide for automatic encryption 7 of data upon shutdown of the computer). The sheer volume of data also has extended the 8 time that it takes to analyze data. Running keyword searches takes longer and results in 9 more hits that must be individually examined for relevance. Once reviewed, relevant data 10 leads to new keywords and new avenues for identifying data subject to seizure pursuant to 11 the warrant. g. 12 Based on the foregoing, identifying and extracting data subject to 13 seizure pursuant to the warrants may require a range of data analysis techniques, including 14 hashing tools to identify data subject to seizure pursuant to the warrants, and to exclude 15 certain data from analysis, such as known operating system and application files. The 16 identification and extraction process, accordingly, may take weeks or months. The 17 personnel conducting the identification and extraction of data will complete the analysis 18 within ninety (90) days of the warrants, absent further application to this court. 19 h. All forensic analysis of the imaged data will employ search protocols 20 directed exclusively to the identification and extraction of data within the scope of this 21 warrant. 22 23 Procedures For Electronically Stored Information on Cellular Phone 1. It is not possible to determine, merely by knowing the cellular 24 telephone's make, model and serial number, the nature and types of services to which the 25 device is subscribed and the nature of the data stored on the device. Cellular devices today 26 can be simple cellular telephones and text message devices, can include cameras, can serve 27 as personal digital assistants and have functions such as calendars and full address books 28 and can be mini-computers allowing for electronic mail services, web services and AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 17 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.22 Page 22 of 28 1 rudimentary word processing. An increasing number of cellular service providers now 2 allow for their subscribers to access their device over the internet and remotely destroy all 3 of the data contained on the device. For that reason, the device may only be powered in a 4 secure environment or, if possible, started in "flight mode" which disables access to the 5 network. Unlike typical computers, many cellular telephones do not have hard drives or 6 hard drive equivalents and store information in volatile memory within the device or in 7 memory cards inserted into the device. Current technology provides some solutions for 8 acquiring some of the data stored in some cellular telephone models using forensic 9 hardware and software. Even if some of the stored information on the device may be 10 acquired forensically, not all of the data subject to seizure may be so acquired. For devices 11 that are not subject to forensic data acquisition or that have potentially relevant data stored 12 that is not subject to such acquisition, the examiner must inspect the device manually and 13 record the process and the results using digital photography. This process is time and labor 14 intensive and may take weeks or longer. J. 15 Following the issuance of this warrant, I will collect the subject cellular 16 telephone and subject it to analysis. All forensic analysis of the data contained within the 17 telephone and its memory cards will employ search protocols directed exclusively to the 18 identification and extraction of data within the scope of this warrant. 19 k. Based on the foregoing, identifying and extracting data subject to 20 seizure pursuant to this warrant may require a range of data analysis techniques, including 21 manual review, and, consequently, may take weeks or months. The personnel conducting 22 the identification and extraction of data will complete the analysis within ninety (90) days 23 of the date the warrant is signed, absent further application to this court. GENUINE RISKS OF DESTRUCTION OF EVIDENCE 24 25 43. Based upon my experience and training, and the experience and training of 26 other agents with whom I have communicated, electronically stored data can be 27 permanently deleted or modified by users possessing basic computer skills. In this case, 28 Rockcoons is believed to have more than basic computer skills. If Rockcoons received AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 18 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.23 Page 23 of 28 1 advance warning of the execution of the warrants, there is likely to be a genuine risk of 2 destruction of evidence. 3 4 5 PRIOR ATTEMPTS TO OBTAIN THIS EVIDENCE 44. Other than as described above, the United States has not attempted to obtain this data by other means. 6 CONCLUSION 7 8 45. Based on the foregoing, there is probable cause to believe that the items 9 identified in Attachment B are evidence of a crime, contraband, fruits of a crime or other 10 items illegally possessed, or were designed for use, intended for use, or used in committing 11 a crime in violation of 18 U.S.C. § 1956(a)(3) (laundering of monetary instruments with 12 the intent to conceal the nature, location, source, ownership, or control of property 13 believed to be the proceeds of specified unlawful activity); 18 U.S.C. § 1960 (prohibition 14 of unlicensed money transmitting business); and 18 U.S.C. § 1343 (wire fraud) and will 15 be found in the locations to be searched as provided in Attachments A-1. A-2, and A-3. 16 17 NICK JONES Special Agent, Homeland Security Investigations 18 19 ~~ Subscribed and sworn to before me this ~ 22 day of Nove~~ ~ERT A. MCQUAID United States Magistrate Judge 23 24 25 26 27 28 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS 19 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.24 Page 24 of 28 1 Attachment A-1 2 LOCATION TO BE SEARCHED 3 4 The location to be searched is a Samsung tablet (serial number: R52JAOJ2KJN) 5 belonging to Morgan Rockcoons that was detained on October 28, 2018, and is currently 6 in the possession of the Department of Homeland Security, San Diego Cyber Crimes 7 Group. 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.25 Page 25 of 28 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Attachment A-2 LOCATION TO BE SEARCHED The location to be searched is a black Google cellular telephone belonging to Morgan Rockcoons that was detained on October 28, 2018, and is currently in the possession of the Department of Homeland Security, San Diego Cyber Crimes Group. Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.26 Page 26 of 28 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Attachment A-3 LOCATION TO BE SEARCHED The location to be searched is a brown and tan camouflage backpack, with black patch, stating "Stealth Angel" belonging to Morgan Rockcoons that was detained on October 28, 2018, and is currently in the possession of the Department of Homeland Security, San Diego Cyber Crimes Group. Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.27 Page 27 of 28 ATTACHMENT B 1 2 3 4 5 6 The items to be seized include certain items, documents, and records relating to violations of 18 U.S.C. § 1956(a)(3) (laundering of monetary instruments); 18 U.S.C. § 1960 (prohibition of unlicensed money transmitting business); and 18 U.S.C. § 1343 (wire fraud), including: 7 8 9 1. Proceeds of money laundering, operating an unlicensed money transmitting business, and wire fraud, including: evidence of cash, bitcoin, other virtual 10 currencies, and including passwords for access to virtual currency storage and 11 accounts, such as digital wallets and electronic lock boxes; 12 13 14 15 16 2. Records relating to the operation of an unlicensed money transmitting business, including: records of the exchange of currencies for virtual currencies, records regarding customers of an unlicensed money transmitting business, advertising and materials for unlicensed money transmitting business; 17 18 19 20 21 22 3. Financial records relating to virtual currency transactions, including: bank account records, bitcoin address information, wire transfer or money transfers records, records regarding the purchase or exchange of virtual currencies, records regarding the use of pre-paid debit or credit card accounts, records or account information regarding virtual currency exchange platforms and associated services; 23 24 25 26 27 28 4. Records relating to the website Localbitcoins.com, including profile information, transactional records, and records regarding communications occurring via that platform; Case 3:18-mj-05777-RAM Document 1 Filed 11/08/18 PageID.28 Page 28 of 28 1 2 3 4 5. Records of correspondence or communications conducted in the course of operating an unlicensed money transmitting business; or regarding money laundering transactions; or regarding real estate purchases, sales, and development in Elko County, Nevada, including the recording or transfer of deeds. 5 6 7 6. Records relating to any co-conspirators or any individuals involved in or with knowledge of the activities described herein; 8 9 10 11 7. Records tending to provide context to, or custody and control of, any responsive communications, records, and attachments described above, such as electronic mail sent or received in temporal proximity to a relevant communication or record and 12 any communication or record tending to identify the user(s) of the electronic 13 devices to be searched; 14 15 8. Records relating to the dominion and control of the seized electronic device(s); 16 17 Which are evidence of violations of 18 U.S.C. § 1956 (money laundering), 18 U.S.C. § 18 1960 (Prohibition of unlicensed money transmitting business), and 18 U.S.C. § 1343 19 (wire fraud). As used above, the term "records" includes all of the foregoing items of 20 evidence in whatever form and by whatever means they may have been created or stored 21 22 23 24 25 26 27 28 and any form of electronic or computer storage.