IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF TENNESSEE IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH MAIL ADDRESSES karimmastergroup@gmail.com; rak.mgusa@grnail.com; rahim.mgusa@gmail.com; kmsadruddin@gmail.com; rak.tmd@gmail.com; and kms.mastergroup@gmail.com THAT ARE STORED AT PREMISES CONTROLLED BY SERVICE PROVIDER GOOGLE LLC CaseNoFiled Under Seal AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, Lars E. Schvartz, being ?rst duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this af?davit in support of an application for a search warrant for information associated with the following Google email (Gmail) accounts: karimmastergroup@gmail.com, rak.mgusa@gmail.com, rahim.mgusa@gmail.com, kmsadruddin@gmail.com, rak.tmd@gmail.com and kms.mastergroup@gmail.com. These accounts are stored at a premises controlled by Google LLC, an e-mail provider headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. The information to be searched is described in the following paragraphs and in Attachment A. This af?davit is made in support of an application for a search warrant under 18 U.S.C. 2703(a), 2703(b)(1)(A) and 2703(c)(l)(A), as well as Rule 41 of the Federal Rules of Criminal Procedure, to require Google LLC to disclose to the government copies of the information (including the content of communications) further described in Section I of Attachment B. Upon receipt of the Page 1 of 17 Case Document 2 Filed 10/18/18 Page 1 of 17 PageID 2 information described in Section I of Attachment B, government?authorized persons will review that information to locate the items described in Section II of Attachment B. 2. I am a Special Agent with the Department of Homeland Security (DHS), Of?ce of the Inspector General (OIG) and have been since November of 201 7. Further, I was previously a Special Agent with the United States Secret Service from March of 2007 through November 2017. I am currently assigned to the DHS OIG Major Frauds and Corruption Unit in Washington, DC. and my duties include proactively identifying and investigating fraud schemes and/or corrupt activities that pose signi?cant risk and major ?nancial impact to DHS. 3. I have completed the Criminal Investigator Training Program (CITP) at the Federal Law Enforcement Training Center (F LETC), Georgia, and the Special Agent Training Course in Beltsville, Maryland. My training included several investigative courses speci?cally dealing with ?nancial crimes and related fraud schemes to include training in the enforcement of laws pertaining to ?nancial crimes as found in Title 18 of the United States Code. 4. I have been a Certi?ed Fraud Examiner (CFE) since April of 2012. As such, I am required to maintain my certi?cation through annual fraud?related training and coursework. 5. The following information is based on my own personal observations and knowledge, as well as information provided by Agents/Investigators from the Federal Bureau of Investigation (FBI), the Tennessee Bureau of Investigation (TBI), and the Tennessee Comptroller of the Treasury and from documents and sources noted herein. This af?davit does not contain all of the information known to law enforcement regarding this investigation. This af?davit is intended to show merely that there is suf?cient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. Page 2 of 17 Case Document 2 Filed 10/18/18 Page 2 of 17 PageID 3 6. Based on my training and experience and the facts as set forth in this af?davit, there is probable cause to believe that violations of Title 18 USC 1040, Fraud in Connection with a Major Disaster, Title 18 USC 1343, Fraud By Wire, and Title 18 USC 37l,Conspiracy to commit an offense or to defraud United States, have been committed by Karim Sadruddin (karim.mastergroup@gmail.com, kmsadruddin@gmail.com, kms.mastergroup@gmail.com) and Rahim Sadruddin, a.k.a. Rahim Ali (rak.mgusa@gmail.com, rahim.mgusa@gmail.com, rak.tmd@gmail.com) in connection with their employment with Master Group USA, LLC (MGUSA), and Textile Corporation of America LLC (TCA), 303 Perimeter Center North, Suite 373, Atlanta, GA. There is also probable cause to search the information described in Attachment A for emails related to the initiation and proliferation of these crimes ?thher described in Attachment B. PROBABLE CAUSE CONCERNING FRAUD 7. To date this investigation has determined that Karim Sadruddin and Rahim Sadruddin, representing both MGUSA and TCA, have perpetuated fraud against the federal government and the state of Tennessee. Through the use of fraudulent documentation (to include falsi?ed wire receipts), Karim and Rahim Sadruddin, while representing MGUSA, were awarded a ?rm??xed $30.7 million contract on November 9, 2017 with the Federal Emergency Management Agency (F EMA) to deliver 475,000 self?help tarps to victims affected by the 2017 hurricanes. Ultimately, MGUSA provided FEMA with tarps that violated Country of Origin requirements speci?ed by the contract under the Trade Agreements Act (TAA) and further violated the contract by delivering tarps that did not meet the manufacturing speci?cations as outlined in the Statement of Work (SOW). In furtherance of the above, the Sadruddins, through MGUSA and TCA fraudulently misused approximately $1,400,000.00 of a $3,000,000.00 Page 3 of 17 Case Document 2 Filed 10/18/18 Page 3 of 17 PageID 4 Tennessee economic development grant to source and facilitate the purchase of FEMA tarps as described below. 8. From November 23, 2017 through January 25, 2018, EMA received and took delivery of 58,324 tarps from MGUSA and subsequently paid MGUSA a total of $3,774,895.76 before suspending the contract to review product origin and speci?cations. 9. On November 23, 2017, MGUSA, following up on a request from EMA to prove product origin], emailed shipping and billing documents to EMA from rak.mgusa@gmail.com, claiming that the initial shipment of tarps was manufactured and loaded in Taipei, Taiwan and necessarily shipped to Shanghai, China at a cost of $33,136.00. Subsequently, DHS OIG determined, through the use of physical and database searches, that the shipping/logistics company identi?ed by name and address on the documents does not exist at the California addresses listed on the documents, nor is it believed to be a registered company in the state of California; as such, the shipping documents are believed to be fraudulent. 10. On March 8, 2018, MGUSA emailed FEMA from rak.mgusa@gmail.com and provided several documents to include MGUSA Purchase Orders and Regions Bank Wire Transfer Receipts from MGUSA account ending in 7570. These documents were submitted for the purpose of proving compliance with contractual requirements, specifically that the tarps meet TAA compliance. As a result of DHS OIG subpoenas, DHS OIG investigators determined that MGUSA provided FEMA with a fraudulent wire receipt from Regions Bank, dated November 13, 2017, in the amount of $33,136.00. MGUSA had submitted the wire receipt 1 Product origin is germane to the FEMA contract as the contract requires adherence to the FAR 52.225?5 Trade Agreements Act (TAA). The TAA delineates designated countries that the U.S. Government has approved trade agreements with for the purpose of procuring goods and services to fulfill government contracts. Accordingly, by signing the contract, MGUSA agreed to provide tarps only from countries that were TAA designated, which precluded MGUSA from obtaining tarps from China. Page 4 of 17 Case Document 2 Filed 10/18/18 Page 4 of 17 PageID 5 as proof the company paid to tranSport tarps from Taiwan, the alleged place of origin, to Shanghai, China as a means of shipping expediency. DHS OIG reviewed the Regions Bank subpoena results and determined that the aforementioned amount was never wired from the account speci?ed on the submitted wire receipt and appeared fraudulent. 1. Moreover, upon review of the Federal Input Message Accountability Data (FED IMAD) reference number listed on the wire receipt, DHS OIG learned from Regions Bank that the number matched information from an actual MGUSA wire transfer processed by Regions Bank on February 13, 2018 in the amount of $552,474.00 funded to Mushtaq Ramzan Trading LLC, Dubai, United Arab Emirates. 12. On April 19, 2018, DHS OIG determined that a letter issued to FEMA by former Gildan Co. employee, Tom Bruss on behalf of MGUSA was determined to be fraudulent. MGUSA submitted the letter to FEMA as part of its Technical Proposal for the purpose of supporting its credibility and viability as a contractor capable of delivering tarps manufactured by Gildan at a facility in the TAA designated country of Honduras. According to Gildan attorneys, Gildan was not aware of the letter at the time of its submission to FEMA and accordingly, the letter was never approved by company management or counsel and was deemed fraudulent. Further, Gildan Co. voluntarily provided DHS OIG with emails from the corporate Outlook account of Bruss. A review of these emails revealed communication between Karim Sadruddin (karim.mastergroup@gmail.com) and Bruss, demonstrating knowledge that China would possibly be used to manufacture tarps sold to FEMA. 13. On January 29, 2018 and again on May 1, 2018, DHS OIG requested and received confirmation from Google LLC that a preservation request for content and non?content related data associated with gmail.com accounts karim.mastergroup@gmail.com and Page 5 of 17 Case Document 2 Filed 10/18/18 Page 5 of 17 PageID 6 rak.mgusa@gmail.com was obtained. In general, an e?mail that is sent to Google subscriber is stored in the subscriber?s ?mail box? on Google servers until the subscriber deletes the e?mail. If the subscriber does not delete the message, the message can remain on Google servers indefinitely. Even if the subscriber deletes the e-mail, it may continue to be available on Google servers for a certain period. 14. On June 27, 2018, the af?ant became aware of a separate investigation of the Sadruddins being conducted in Tennessee by the FBI, TBI, and TCOT regarding fraud involving a grant issued by the State of Tennessee?s Department of Economic and Community Development (ECD). The Tennessee grant fraud investigation began in June 2018 based on information provided by a Con?dential Human Source (CHS) to the FBI. The Af?ant has met with the Agents/ Investigators working on this grant fraud investigation, and they provided me with information and records regarding the fraud. 15. According to the CH8, the Sadruddins perpetrated fraud involving the $3 million grant from ECD for the purchase and renovation of the ?Dura? building in Pikeville, Tennessee. Cagle DeveIOpment was hired to do the renovation work on the building. Karim Sadruddin submitted a fictitious Cagle Development invoice and a ?ctitious Regions Bank wire transfer record in order to fraudulently obtain a $1,406,000 reimbursement check from the grant funds for renovation work allegedly completed on the building. As of the date of the alleged Cagle Development invoice, the work re?ected on the invoice had not been completed. A second Cagle Development invoice dated November 3, 2017, in the amount of $806,100 for work allegedly done on the building, was submitted by TCA to obtain additional grant funds, and this second invoice, according to the CH8, is also fraudulent. The CHS further provided information Page 6 of 17 Case Document 2 Filed 10/18/18 Page 6 of 17 PageID 7 that Cagle Development has only received approximately $477,333 in total from the Sadruddin?s for the build?out/rehab of the building. 16. In the spring of 2017, the Sadruddin?s proposed establishing a textile plant in Pikeville, Tennessee, and claimed that the operation would employ approximately 1,000 people. On May 9, 2017, TCA submitted a ?Tennessee Application For Incentives? which ECD utilizes in determining eligibility for various state economic development programs. application indicates that TCA was applying for a Fast Track Job Training Assistance Program and a Fast Track Economic Development Grant. The application was submitted by ?Karim Sadruddin, Manager,? and it provides contact information for Karim Sadruddin and Rahim Ali, a.k.a. Rahim Sadruddin, including their email addresses of kms.mastergroup@gmail.com and rak.tmd@gmail.com, respectively. 17. In June 2017, ECD offered a $3 million Fast Track grant incentive package to the Bledsoe County Industrial Development Board (IDB), which in tum would disburse the grant funds to TCA. The $3 million grant was to be used for the purchase and renovation of the ?Dura? building located in the city of Pikeville, Bledsoe County, Tennessee, which TCA would use as its manufacturing facility. $850,000 was to be used for the purchase of the building, and the remaining funds were to be used for the renovation of the building. The IDB engaged the services of the Southeast Tennessee Development (SETD) to assist in administering the grant. Grant funds were not advanced to TCA for the purchase and renovation of the building. Instead, TCA had to buy the building with its own funds, or pay for an approved expense associated with the renovation of the building, and then submit a claim for reimbursement by providing an invoice and proof of payment. TCA engaged the CH8 and the services of Cagle Development to assist with the initial purchase and subsequent renovation work on the building. Page 7 of 17 Case Document 2 Filed 10/18/18 Page 7 of 17 PageID 8 18. On August 1, 2017, Rahim Sadruddin called the Director of SETD and asked what a Fast Track contract and request for reimbursement looked like, and in response, the Director emailed an example of a contract and request for reimbursement. The Director sent the email to Karim Sadruddin (karim.mastergroup@gmail.com) and Rahim Sadruddin. 19. On August 25, 2017, Rahim sent an email (rak.mgusa@gmail.com) to the Director of SETD asking to schedule a phone call to discuss how TCA was currently making payments to their general contractor and to be sure that exact records were being kept to turn in for reimbursement. During the Director?s subsequent telephone conversation with Karim and Rahim Sadruddin, they talked about the example which the Director had emailed to the Sadruddins on August 15?, and the Director explained to them that they had to submit invoices and proof of payment in order to get reimbursed. 20. On October 3, 2017, Karim Sadruddin (kalim.mastergroup@gmail.com) sent an email to a representative of SETD, the mayor of Bledsoe County, and Rahim Sadruddin to which Karim Sadruddin attached an alleged Cagle DeveIOpment invoice dated August 26, 2017, in the amount of $1,406,900, and a purported wire transfer record re?ecting a transfer of $1 ,406,900 on September 14, 2017, from account at Regions Bank ending in 7570 (7570 is associated the MGUSA Regions Bank account and is believed to be a typo associated with this document) to Cagle Development?s account at SunTrust Bank. The purported wire transfer record appears to be an email from Regions Bank to Karim Sadruddin (kmsadruddin@grnail.com) with the subject ?Outgoing Funds Transfer Debit Information TRN 170914-008066.? (Regions Bank has since advised the Affiant that this email con?rmation is fraudulent and that Regions Bank records do not show a wire for the aforementioned amount was processed). In his October 3, 2017, email, Page 8 of 17 Case Document 2 Filed 10/18/18 Page 8 of 17 PageID 9 Karim Sadruddin references the alleged invoice and wire transfer record by stating, in part, ?Please see attached invoice and backup for the 1St draw Please let us know when the funds will be released, we have a finance meeting this week and I would like to update everyone on where we stand.? 21. On November 8, 2017, the IDB issued two checks to TCA in the amounts of $850,000 and $1,406,900. The $850,000 check was to reimburse TCA for the purchase of the building, and the $1,406,900 check was for reimbursement of expenses associated with the renovation of the building. The Mayor of Bledsoe County called Karim Sadruddin to inform him that the checks were ready, and Karim Sadruddin then drove from Atlanta to Pikeville, Tennessee, to pick up the checks. The following day, November 9th, the checks, totaling $2,256,900.00, were deposited to bank account ending in 1663 at the Regions Bank branch in Suwanee, GA. The account balance at the time of deposit was ?ve hundred dollars 22. On November 16, 2017 through November 20, 2017, a total of $483,480.00 was transferred from TCA Regions Bank account ending in 1663 to MGUSA Regions Bank account ending in 7570. During this period, wires totaling $308,080.00 were paid to Korea Tarpai Co. Ltd, Red Rock Sourcing and Toyop Relief Pvt. Ltd. from the MGUSA account. These recipients are known to this Af?ant as companies associated with the acquisition of tarps on behalf of MGUSA to ful?ll the aforementioned FEMA contract. Thus, Karim Sadruddin?s October 3, 2017, email referenced in paragraph (20) aided in the fraud perpetrated against EMA, as well as the State of Tennessee; because the email resulted in the disbursement of grant funds to TCA, and a portion of these ?'audulently obtained grant funds were then utilized by the Sadruddins to acquire tarps which the Sadruddins falsely claimed met TAA compliance. Page 9 of 17 Case Document 2 Filed 10/18/18 Page 9 of 17 PageID 10 23. On November 29, 2017, Karim Sadruddrin (karim.mastergroup@gmail.com) sent an email to a representative of SETD and Rahim Ali, a.k.a. Rahim Sadruddin to which Karim Sadruddin attached an alleged Cagle Development invoice in the amount of $806,100 and a Domestic Wire Transfer Request/Authorization showing a transfer of $806,100 on November 15, 2017 from account at Regions Bank ending in 1663 to Cagle Development?s account at SunTrust Bank. In the email, Karim Sadruddin stated, in part, ?Please see attached the paperwork for the next draw for the work performed at the building. Please review and con?rm. Please let me know when you think this can be funded?? According to Cagle Development records, the actual purpose of this $806,100 was to repay the lender who had loaned TCA the money to purchase the Pikeville building, and not for the renovation of the building. 24. On December 14, 2017 through January 3, 2018, a total was wired from TCA Regions Bank account ending in 1663 to tarp manufacturing sources: Qingdao Wins Shipping Go, Red Rock Sourcing, Richt International Inc., Success Kingdom Corp. and Korea Tarpia Co. Ltd. All of these companies are known to this af?ant as businesses associated with or believed to be associated with the acquisition of tarps on behalf of MGUSA to fulfill the aforementioned FEMA contract. 25. On January 5, 2018, the IDB wired $728,100 to account at Regions Bank ending in 1663. This amount was less than the $806,100 wire record submitted by Karim Sadruddin for reimbursement because only $728,100 of the original $3 million in grant ?mds were still available for disbursement. Page 10 of 17 Case Document 2 Filed 10/18/18 Page 10 of 17 PageID 11 26. On January 16, 2018, a total of $353,936.05 was wired from TCA Regions Bank account ending in 1663 to Richt International Inc. and Qingdao Wins Shipping Co. It is believed that approximately $52,000.00 of this amount was directly attributable to the grant funds, as the remaining amount is believed to be from funds associated with FEMA receipts/payments to MGUSA. As stated previously, both companies are known to this Af?ant as businesses believed to be associated with the acquisition of tarps on behalf of MGUSA to ful?ll the aforementioned FEMA contract. Thus, the $728,100 wire transfer referenced in paragraph (25) aided in the fraud on FEMA, as well as the fraud on the State of Tennessee, because the fraudulently obtained funds were utilized, in part, by the Sadruddins to acquire tarps which the Sadruddins falsely claimed met TAA compliance. 27. A review of both TCA and Cagle DeveIOpment?s bank account records do not re?ect the alleged wire transfer of $1,406,900 on September 14, 2017. Therefore, it appears that the wire transfer record submitted by Karim Sadruddin to obtain a reimbursement of $1,406,900 in expenses associated with the renovation of the Pikeville building is, in fact, fraudulent. An investigator with TCOT has reviewed the bank records for accounts controlled by the Sadruddins, such as their personal accounts, TCA, and MGUSA. This review determined that a large portion of grant funds were diverted to pay for other expenses billed to TCA by Cagle Development, expenses which were incurred by the Sadruddins related to the operations of their other enterprises, speci?cally MGUSA, Textile Mill Direct, or to pay for personal expenses. As stated in paragraphs (22) and (26), a portion of the fraudulently obtained grant funds were utilized by the Sadruddins to acquire tarps for the FEMA contract. 28. In May 2018, TCA and MGUSA initiated a lawsuit in the Chancery Court of Bledsoe County, Tennessee, against Edgar Cagle Jr. (the owner/operator of Cagle Development), Page 11 of 17 Case Document 2 Filed 10/18/18 Page 11 of 17 PageID 12 and others, regarding the Pikeville building. During the course of testimony related to this lawsuit, a MGUSA document was introduced which states, in part, that Cagle is ?a rightful owner of 50% of MGUSA Shares.? The document appears to bear the signature of Karim Sadruddin who signed as and it re?ects address in Atlanta, as well as an email address of rahim.mgusa@grnail.com 29. In summary, through the use of subpoenas, interviews, and records analysis conducted by DHS OIG, the FBI, TBI, and DHS OIG believes MGUSA TCA have used the aforementioned email addresses as a means of communicating false documentation to further a scheme that simultaneously defrauded the United States government and the Tennessee?s Department of Economic and Community Development (ECD) through deception and false documentation by affecting FEMA to award a $30.7 million contract to MGUSA and causing ECD to advance grant funds for the reimbursement of expenses which TCA had allegedly incurred and paid to renovate the Pikeville building. BACKGROUND CONCERNING E-MAIL 31. In my training and experience, I have learned that Google LLC provides a variety of on?line services, including electronic mail (?e-mail?) access, to the public. Google LLC allows subscribers to obtain e?mail accounts at the domain name ?gmail.com,? like the e-mail accounts listed in Attachment A. Subscribers obtain an account by registering with Google LLC. During the registration process, Google LLC asks subscribers to provide basic personal information. Therefore, the computers of Google LLC are likely to contain stored electronic communications (including retrieved and un-retrieved e?mail for Google LLC subscribers) and information concerning subscribers and their use of Google LLC services, such as account access information, e?mail transaction information, and account application information. In my training Page 12 of 17 Case Document 2 Filed 10/18/18 Page 12 of 17 PageID 13 and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. 32. In my training and experience, e-mail providers generally ask their subscribers to provide certain personal identifying information when registering for an e?mail account. Such information can include the subscriber?s full name, physical address, telephone numbers and other identifiers, alternative e?mail addresses, and, for paying subscribers, means and source of payment (including any credit or bank account number). In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. 33. In my training and experience, e-mail providers typically retain certain transactional information about the creation and use of each account on their systems. This information can include the date on which the account was created, the length of service, records of log?in session) times and durations, the types of service utilized, the status of the account (including Whether the account is inactive or closed), the methods used to connect to the account (such as logging into the account via the provider?s website), and other log ?les that reflect usage of the account. In addition, e?mail providers often have records of the Internet Protocol address address?) used to register the account and the IP addresses associated with particular Iogins to the account. Because every device that connects to the Internet must use an IP address, IP address information can help to identify which computers or other devices were used to access the e?mail account. 34. In my training and experience, in some cases, e-mail account users will communicate directly with an e?mail service provider about issues relating to the account, such as technical problems, billing inquiries, or complaints from other users. E?mail providers Page 13 of 17 Case Document 2 Filed 10/18/18 Page 13 of 17 PageID 14 typically retain records about such communications, including records of contacts between the user and the provider?s support services, as well records of any actions taken by the provider or user as a result of the communications. In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. CONCLUSION 35. Based on the forgoing, I request that the Court issue the proposed search warrant. Because the warrant will be served on Google LLC who will then compile the requested records at a time convenient to it, there exists reasonable cause to permit the execution of the requested warrant at any time in the day or night. REQUEST FOR SEALING 36. I further request that the Court order that all papers in support of this application, including the af?davit and search warrant, be sealed until ?irther order of the Court. These documents discuss an ongoing criminal investigation that is neither public nor known to all of the targets of the investigation. Accordingly, there is good cause to seal these documents because their premature disclosure may seriously jeopardize that investigation. Respectfully submitted, (Lars E. Schvartz Special Agent DHS Of?ce of the Inspector General Subscribe and sworn to before me on October 2018 UNITED STATES MAGISTRATE JUDGE Page 14 of 17 Case Document 2 Filed 10/18/18 Page 14 of 17 PageID 15 ATTACHMENT A The email accounts to be searched are known active Gmail accounts assigned to Karim Sadruddin and Rahim Sadruddin, respectively karim.mastergroup@gmail.com and rak.mgusa@gmail.com. Per the System for Award Management (SAMS), these email accounts were provided as Mandatory Points of Contact and have been used throughout the term of this contract as a means of ongoing communication between EMA and MGUSA. These email accounts, as well as, rahim.1ngusa@gmail.com, kmsadruddin@gmail.com, rak.tmd@gmail.com and kms.mastergroup@gmail.com were also utilized by Karim and Rahim Sadruddin as a means of ongoing communication between Textile Corporation of America and state and local of?cials regarding the Dura/Pikeville building project. Page 15 of17 Case Document 2 Filed 10/18/18 Page 15 of 17 PageID 16 ATTACHMENT Particular Things to be Seized I. Information to be disclosed by Gmail LLC. (the ?Provider?) To the extent that the information described in Attachment A is within the possession, custody, or control of the Provider, including any emails, records, ?les, logs, or information that has been deleted but is still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A from January of2017 through present date: a. The contents of all e?mails associated with the account, including stored or preserved copies of e-mails sent to and from the account, draft e-mails, the source and destination addresses associated with each e?mail, the date and time at which each e-mail was sent, and the size and length of each e?mail; b. All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log?in IP addresses associated with session times and dates, account status, alternative e-mail addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any credit or bank account number); c. The types of service utilized; d. All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; e. All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken. Page 16 of 17 Case Document 2 Filed 10/18/18 Page 16 of 17 PageID 17 II. Information to be seized by the government All information described above in Section I that constitutes evidence of violations of 18 U.S.C. 1040 371, those violations involving Karim and Rahim Sadruddin, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: a. Discussions regarding FEMA, MGUSA, tarps, government contracts or grants, Textile Corporation of America, Ed Cagle, Cagle Development, the Dura/Pikeville building, or any associated contractors or sub-contractors; b. Contact information on individuals related to the discussions discovered above; 0. Financial discussions or records regarding MGUSA, FEMA, Textile Corporation of America, Ed Cagle, Cagle Development, or associated partners, suppliers, contractors or sub- contractors; d. Discussions regarding ?nancial relationships between Karim Sadruddin, Rahim Sadruddin, Bruss, Ed Cagle, Cagle Development, and any and all others involved with MGUSA, Textile Corporation of America, or their associates, known and unknown; e. Information relating to the development, submission, or communications concerning Technical Proposal and/or records associated with other government contract proposals, Textile Corporation of America?s application for incentives, receipt and disbursement of grant or government contract proceeds; and f. Information concerning individuals associated with MGUSA, Textile Corporation of America, and any af?liated entities, to include their identities and/or whereabouts. Page 17 of 17 Case Document 2 Filed 10/18/18 Page 17 of 17 PageID 18