Case 1.19-m1-00078-N Document 8 FHed 04/05/19 Page 1 011 ,m m: Hmun Awh mm A,va mm; UNXTED STATES COURT for {he Sonlht'm Dimicromhbama 1n um Mauu' 0mm Search at my) (Mun/Jun mm msuun . ,wmmowurr. Hmum I ,uxxorcowx'm \nwu mm: mm>> mm onx um-m: mom . rmuuwlwir MOBIL: < 11m 0' <>ka mom; vfcyidem <Case Document 871 Filed 04105/19 Page 1 of 27 AFHDAVIT IN SUPPORT OF AN APP UNDER RULE ll FORA WARRANT TO SEARCH AND SEIZE being rm duly sworn. hereby deposc and slate as ramm- INTRODUCTION AND AGENT NI) 1 hmke mi; amduwt in suppon ohm npplicalian under Rula 41 othe l'cdcral Rulcs ofCriminal for a search warrant uulhorizing me Examination of pmpeuy. namely. mm.- (3) devices, which are cuncml) in enforcemem passession. and extraction 1y stored information described in I3 2, I am a Special Agent mm m: m1ch Bureau onnvesugmim. lam 1| Inw cnfumcmenl olfictr ofth United Shams who is empowered by cunducl of and to make ("Tests for on'enses agnins: the United Slams. 1 hm been mploycd by the FBI for months. Duringmy tenure mm the rm, I have been assigned dealing wilh insurancc Fraud. wire fraud. idem; um and mm corruption, Through my training. cdncatkm and expuricncc, have become familinr ixh the manner in which ofi'endm communism: using c-muil. social media, me inwmm 'ransmh, shan or of Cl'iuws. J. This alTldavil is Show only [hax mere is suffician probabic cans: far we wqucsmd warrant and does mm mm ail army klmwicdge about [his mum Case Document 8-1 Filed 04i05f19 Page 2 of 2? 4. Te (Estes thirty-six grandjery subpeenas have been served to various banks and insurance carriers helictr'ed te have-(innit: business with 'l?hntnas i3. Bums er Tommy Burns Agency, List; ??ttldititnmiiyt severe} siieged victims and an einpinyee {Ennis Agency, LLC have provided snnte documents reiated to 'I?iiemas E. Bums andfer ?tensity Burns Agency. LLC. White seine decutnents- received frern these entities previdc petential evidentiary value they eenstittite an record of suspected business {teenage perpetrated in}; ?tissues E. Burns. The warrant i apply in? today wettid allnw seizure of? the additi'euai int?ermetiun not yet ebtained by investigatnrs associated with this ease. CAUSE 1. (Tie December 4. 2018; the Mebiie Fieid Office et? lite Federal Bureau of iiwesugatien a walk-in stampieint from Orange Beanie AL resident Katheryn Scett that Thomas Edward Estes Libs Tommy Bums was collecting insurance premiums {rent customers and net paying paiicy premiums to the underwriter, South Shore insurance Underwriters {535313}. 3. Kstiteryn Seett werkses pert. time aecnuntant fer anti eperates a business Dri'l?twned investigations- LLC, as a certi?ed fraud examiner. Site previnnsi}: werkcti as a forensic accent-dent fer the Federal Berean c-f Investigatien in Mebile. in October EDIE. Katheryn Scott was contacted by he? dasghter. Misti}; Bees; Marketing Director at SSIU, aeeut a pattern of? sen-payment fer pniicies by Tummy Burns Agency, LLC. was sentiing cancellatiun nntiees tn customers due to the non-payment. Scett?s intemai investigation i?etmd that eight nut of?: 6 pelicies bound by en behaifef?l?emmg Burns Agency were cancelled tier men-payment. 2 Case lzlg-mj-GUOTS-N Document 8-1' Filed DMUEIEQ Page 3 of 2? 3. On March 2&19, Dennis Wright from tin: Alabama Bepar?mem of insurance t?eceivnd a compiaint againat '1'Gmm}: Barns sigma}; LLC from Insurance Servicns nan-ml company ef?natiiem Un?nrwriters The compiainl detailed {hat SCU imumi pniicies fin *f?nmm}; Bums ?ctivecn Novamber 2813 anti 2i} i 9 for a 10qu (if in premiums. As ni? March IS. 2019, Bf the pnlicies ?nd an: inn-:11 paid and had cancelia?nns issued nr expecicd ?0 be issned. SCU ?ind the complaint after being cnnincmd by Swami customers 8f ?iiommy Burns campinining ?int i?ny had made full payment In Tammy 4. On March 2 I, 20 9. i intewiew?cd Carolyn Sh? hath: policy paid viz: encz'nw ?i'bmmy Bums Agenny. LLC. Shit had receivnd a-cancnilzninn notice from SCU . When she ca?iln? Sm}, $563; was told 521:: was rant a-bie in git? i161? policy rci?nst'nin? due in unn- payment. Mrs. (Bent-y Tammy gums rcques?ng a 30 ?21,211 she conid get a [393 icy aisnwherc. Mr. Burns ciicl offer a refund but nffemd tn find Mrs. Genry insurance: with uncierwrilcr. 5. March 22- 2mg, i {einphenicaiiy interviewed Meiisa i-[aitmarig the Vice Presidcni Appaimmenm and Adminiwminn with'CRC Engnrancn Service-:3 (CRCL the in?rm: company of Southern Cress Underwriters (SCH). Prior In March is, 2% i 9, sewmiingum? nailed the ?fties in MiSSissipgi a?er having recni?v?ed poiicy canaeilazinn nniicns. This was abnormai because ?id noE nefmaily deal dirnstiy with SCU is a brokerage {hat anEecied payments agents: and piaan? than with insurance exchanges. {he insnred individuals {fiat coni'acte? SCU imd apgiinti far pniicies titrnugh "i?nmmy Bun-:3 Agent-3;. LL13. {Eati} claimed they made fuii paymen?is in Burns. SCU had $22 pniicies pending canc?eJ-iaiinn {in . .3 Case 1:19-mj-00078-N Document 8-1 Filed 04/05/19 Page 4 of 27 wuh five more be issued. The lolal unpaid was 316383.32 scu cummullicaled email mm m: 'l onlmy Bums Agency. LI 6 Tommy Burns Agency. lib received a writmn from scu scnlon March 4. 20|9 delailillg 16 out or :9 accounts past due mulling mmun. 6. On March 22, 20m Special Agcm--and I interviewed Wanda Stewart Tumel' [Turner] Turner is the daughter or Barkley (Stewaru' aged 0n 26.20121 Tumor and small visiled 10mm,>> Bums LLC and Bums. Sicwarl agreed to home on ncr' nsumnce policy rm nrle ycm'. Tumenuww a nn Svman's behalf to Tommy Burns Agency LLC for Sloswe. ln |a|c January or carly February 2019. Sicwan received 3 Keller in the mail from Southern Cross. the underwriter {hill had hound (he homeownm pollcy from Burns. The leucr slaled um pulley was bcing cancelled rol- In midl'ebmmy 20107 'I'umcr made ammo! null Bums ml the phone and Burns promised to Wrilc a check SCU lhal day. Burns did write a check lhe following day. However. an laler [old Turner [[135 the check had and Slcwurl's policy was Tumor filed a pollce repon with [he Mobile County Sheriff's Officc, 7, On March 33' 2029. Special Agen--alld inlervlewud William Henry Couch, lulliur {Cum On 19. 2018' Couch llad a check l'mln his Walk Fargn autumn 5cm .0 Formle Bums Agency, LLC in the <Case 1'197mj7000787N Document 8-1 Filed 04/05/19 Page 5 0127 Cancelled. demandcda cash refund. which Bums prmidcd later day a! (Imleh's place 01 work hu! only aficr Bums Couch sign ill document the" he would not haid Bums liable for any losses msuhiug from |hc policy cnnucllniion, Couch muved his polls) (0 Ryan Raid Agency and pald \0 get his polic) back in rim Couch provided Agilms wiih prinninn nrunnils from nums |o Couch "sing cmail address: (0mm nn mm and lens! in Support or his allegations. a. On March 25_ 2019. special Again--and interviewed Michael Dennis Hardy (Hardy), a Friend of Thomas Bimini who has known him for whom mic mi, Number :0 Bum: provided Hardy a humfimllm's insurance qumc mm was nimosl halrofwlnil Hardy hnn' previously pziid for similar mange, Th: quote was Ihmugh south Slim Insurance (SS Hmdy Wi'Dm Burns check for lam on IOII lzzols. The policy was roi one insurance Hardy lale: learned from Tommi Bum asVisan Angela Basscl! (Basscn). lhax Bums cashed his check ni the Cenluly Bank adjacent lo Buni's ufl'lcc within minulefi analdy Hardy ublaillcd a nl' 1h: enshed check from U): bank. which Changed by Burns on me back ol' ihn check 3mm! monllw him. Hardy raceivzd later in the mail from ssw. Hardy ssn: Spoke to Mlnd3 Dec: (0cm Dads :on Hacdy ihln $an we: received payincni rni hi. lmmemmufs insurance policy and. therefore. was canceling polic, r0: non--paymenl, Dec: also Hardy lhni ssxu no longer did business huh Bums. Burns loin Hardy lhai he honla his policy lie" company. scu. However. Hardy never filled out any applicaximls in olher For SCU. Hardy Ialer cnniacied scu and :enmed ihni his hommwner's policy with \hcm "ills only valid through March 3L 5 Case 1 197mj7000787N Document 8-1 Filed 04/05/19 Page 6 of 27 9. On March 26. 20194 Spaciai Agcnl_ and I incl with Angela Kn) McConncil Basscn (Bunsen), Basset! curmml) serves as me onicr assislunl Tommi Bums Agenc}. LLC Besides Bums, Hamil islhl: onl) ofTommy Bums Agency. amen began working then: in early 0mm 2mg. had no pdar knowlmge of me insurunu: business, so she relied on Bums to teach iltl'r Bassm knew Burns began moving a number ur insurance policies from lo Scull: snore insurance (gSiU). in lax: October or earl). me of Burns' customers Hunk Thompaun (Thompson) sun'ch grease flu: in his hem: Thompson had paid Bums for onc-ycar 3 msumnc: ssm. However. Bums had um pissed on me payment lo SSIU. Shnniy before (he [in SSIU had cancelled Thompson's insumce poke) l'or Ai'lcr Thompsun notified Bum: i'lrc his mm to fii: a claim. 36356" otcriicnrd Burle call 11 mpmsemalivc nl SSIU and ask for Thompson's po|icy lo be reinstated with ml lacs During this phone wnversulion. Burr>> did uol inform rim Thomman had suffered a kudicn live and mail a claim would be forthcoming. Burns paid the money owed on me pair. in ordar lo gel il reinsuiled. agreed lo reinstall: lhe puiicy. but only al lzmum me fixilowing day. The morning Burn: to submll :4 claim un hemll'ror un- kitchen fire, 0n the claim Bums changed dale ofilie lire ro unsure 'llrompsurr Would be cm'umd. Bussen also overheard Burns lciephune commaiirm the Grand Uzly i'lm and clmvinccd lhem lhaz rlre are hm: aclualiy occurred on a dilTewui day. resulling in rim 1 u'rng an amendml report ufthe fire lhal Falser actual dam or the fire. i0. Afitr [his incidan Bassell began (0 "mice than Bums (men cashed checks received 6 Case 1:19-mj-00078-N Document 8-1 Filed 042?05119 Page of 2? From customers that was supposed to be for their insurance bet Burns was not forwarding the 'titoney on to the insurance underwriters. Burns wouid often walk. next door from the office to the Century Bank and Cash the checks mere. Berns-weuid aiso go to the banks where the customers had their accounts to cash the checks. in Nosern'ber 2918, direeted ?essett to get new policies for all of his because 5311} had eut hint oft?. Burns had Bassett get new quotes front a different insurance underwriter; create faisi?t?ied statements of no toss. and generate new policies. Burns then directed ?a'ssett te? Sign the customer?s name on the new policy apptications. {terns toid Basset? that it was fine and normal to switch the insurance carrier and that the customer did not need to know- according to i-Bessett, the gsaner documents associated with these transactions were most likeiy sitredded after the}; were saved and nploaded to the Microso? {)neDriee aceotznt from EZ-linI-ts. a so?wa re erogram that organizes 'liies. Bessett indicated that any remaining paper documentation wotdd he iocated at the Ettsiness. i 1. Despite moving to new insurance underwriters. after about {30 days the insurance underwriters stiil had not heen paid and began sending out canceilation notices for notepawnent. Front November 8 tntengia the present Bessett stated that more and have come to the office to demand their money beet-r, as they had received cancellation notices in the mail. in one recent month, Burns tool-t in over 320.038 in payments l?rorn customers, but did not pass any of iton to insurance underwriters. Bessett'is maintaining an active list of peopie that site beiieves? Barns ltas stoien from. About three weeks ago, started tnrning away new customers for fear that they too won he victimized by Burns. Without Burn?s knowledge, l-3assett told these individuals that they could not take on any new business and recommended other insurance agents in the area. Case Document 8-1 Filed 04/0319 Page 8 of 27 12. 13mm my Easewiew with Basses end from reviewing docemeres received via saiipeeaa. i learned that the ?oiiowing individuals and businesses pai? iheir iesumnee eresniams te the Tommy Burns Agency, be: received aotices of nonpayment or solicits For nonpaymene Cai'eiye Gem-y. stkeiy Lamar Stewart, Michael Hardy. Albert Patten. Charles Mercer. Henry ?l'hempson. William Couch. Michelle Pagois. Jen Custer. .leimey Shepherd. Gee-ale Caeps, Gleria Capps. Christophe? Taylor. Calvin Caihouo. Dan Riley. Joseph Spieciaili. lane Spice-ism. Shane Sigsbee. Karen lessons. Nino Mondaini. Samanths Aispaugh. Amy Swiiaer, loyarie Barker. Aleia Bondi?eaes, Merl: I-lsle. Traci ?aie. Pei Richards. Joseph Me?ogis. Lalashe Sclaeiiz. "l?hunnari Kittie?. john Kitirell. Christine Michael? Mallini. Michaela l-lollowsy. Christepher l-layes, FQCEAB Marine Services. Spicy?roup. LLC. Citizens For a Beiter Grand Bay Library and Museum. end Amy Spitzes Pmperties. Basses indicesed the: {he associated with these customers was smred in?o Burns" Microso? OrieDrive account. While workiag at Elie Easiness. Burns direcied Bassett to scan all documents late {he Microsofl Gnel?rive account. that Burns uses to store records and infermatioa missed to Tommy Burns Agency. Li Many documents are else eepieel to me Microsoft OneDrive aceeanl from EEKliaks. a sofzwsee program that ergenizes files. Burns Pres Riki Besseti ?9 shred everything once the ?ecumenis have lace-n scanned and uploaded. Basset: believes that Burns does not wan: to lease a paper {rail an? believes {hat he woel? hegin dele?eg ?ies ii? he {heegia law enforcement were an to him. Barns eiso (Eire-steel .lsesseit to slop issuing receipts to easiomers who pay in cash. Basses indicated that. there is an excel ssreaeslieez to record payments (by both cash and check} z'cceivecf by customers. ?ns excel spreadsheet is saved on Bassett?s HP compui'er [sealed at ?le (is she i"remlses. Barns has not shares} the Microsoft One?i?lvc account pessweitl with Bassell. but {he account is always 8 Case Document 8-1 Filed 04/05/19 Page 9 of 27 lagged in on lsuwu's desktop Compulcl on her desk |hc nlficc. Bums acmsses Sam: Micrusufl Ont l'lm' couln Frum the gray HP laptop on his desk at work. ln uduilluh. 8mm imhcaml man ulu-us possessed leasl mu laptop: and an Apple iPhone cellular than he cums him when he leaves the Premises. Baswll scaled [hm h: nflen does husin . (mm hla cellular pllonc and ill"! he has access lull ol'thc on Onclkive h) usng his cellular phone which is msodatcd telephune numher 25 Burn: luccil :3 mulls related Tummy Bums Agency. LLC on this Many individuals ufleu carry iuluphoucs on Ll, Bums drives a er 20l9 Camry. which h: fluently leased mmliug previoux vehicle ill a single vehicle accident, He uses this Hillich ln Iranspon his phmk' and a make and model) to and from wurk. Bums' ml'el) arrives the prior lo Loam-u. Bassml [lull Bums shuued up for work on Manda): March 23. 20 9. bill was |hc lirsl lime Burns had been millc Pmmim on a Munday in sacral mollth I0 unssuu. Bum: In!) spell! less and less limc al \vu(k as nfcustomor's sacking {cl'ululx ha. grown. bul continues in run business from his pllorlc and his laptop he muupnm home with Illm did spend several hnurs a! [he l'rtmifics on March 26. 2019 llown tr. did nol 00ml: 10 Ill: Pl'cmiacs on March 2 "Imughnul March 27". Hill?" cuminucd L0 can and mm mm his lelephoue number 25 l-llicll is pemmul pmvided Bantu. and send email hum his small com. _q mall-:orn. and-@yahOULOIH. hum his home a: 3950 Spring Mobllc. AL 36695. In Bums directed Baud! lo ?llbmil um .usumucc policy applications on behalf or cuslomers mlhout lhcir knowledge and 9 Case Documem 8-1 Filed 04/05/19 Page 10 of 27 consent a nu" insurance Biissell did nul submit the policiesas dimmed. 1+ On March 23. 2019. Special Agein-- an'cu, he Inemirlg occ un-cd at the Premises Wham me or Tummy Bums Agency. Ll nd 1 again met mm is operalrd. Bagel! pxm'idcd Several documents and addlLiunul information. 1h: documcnl: included a physical mp} ol'an mu 'I'Ilc a panlal 1st of Tommy Burns Agency. LLC cuslumcrs "ho had pald [or insurance policies lhmugh 'l'mnmy RumS Agency. Baasexl mum me turrenl.digiml Cop) ol'lhic Excel is savcd on me 4:5ka foldcrof Russell: 11? demon compulcl' locaml at her desk. Basset! that all will! one excepliun' listed 0n spruldshum llm: had homeownch inwl'ancc through Tommy Bums v, LLC had :lmr lor "w mlicics but Burm had i'urwm'ded the money to me l5. provided a copyofa CRC 0mm the parent Company m'scu. nn 5 IN of "in: poilcic: lhal war: listed as past due and subject lo cancellnion, Basscu sum: um all lined individuals had paid Bums rm theil'policics. bm Burm 'nad Failed pass on (he payments SCU. except in one cuss. I6. On April 4, 2019' Special Agenl_ and I interviewed a local law ulficer the Mllhile ColInIy Shcrifl's Office who "us pn'scm during the vaice ufn un'csl wumllu for Burns on unlelalcd charges 31 Bums' homu lozmed a! labile, Alabama 36695. warmm. local hm Moblle Counn Sheri [Ts Office saw drug paraphernalia in plain View. The deputies on )ccuc mn ch warmell fur 3-- Omar; mum: nrmal seal-ch. mud in plain view insurance policy document: as well as mo laptop computers and a lo Case Document 8?1 FiEed 04f05I19 Page 11 of 2? eeliolar phone. Burns provided the passeode to tittiocit the eelioiet ehoee to the deputies. The laptops and phone matched the description given i2}: Bat-reed of those items that Burns would use for conducting the business of" 'I'ommy Burns Ageoey. LLC eel} had taken home with him. During the search of the home. deputies seized two (2) lap top computers and the eeilphone ol?Tommy Burns. These electronic devices have now been turned over to the Federa} Bureau of Investigation pending the issuance ol?tlte search warrant reqriested herein. l7. Based on my training, experience. and whet i have learned from other IaWenforcetaent professionals. the amen: sohmiis there is prohable cause to heiieve electronicaliy stored evidence and ofthe crimes ofviolation Title 13 USC t3d3. Wire Fraud and Title E8 USO insurance Fraud is contained on the eleotsooic devices identi?ed as heionging to 'i?honies Edward Burns and Totem}: Barns Agency. LLC. to include, but not limited to. who clients. insurance applications, cancellation notices. payment records and bank aoditiaaneial records related to the deposit of premiums. 18. I hereby state that upon oath that the foregoing information is tree to the best of my knowiedge and belief. l9. . I seek this warrant to be certain that the seizure and exaroieatioo o?fihe deviates will comply with the Fourth Amendment and other appiicabie laws. TECHNICAL TERMS 5. Based on my training and experience, I ose the following teehniea! terms to convey the f?oliowiag meanings: Case Document 8-1 Fited 04/05t19 Page 12 of 27 at it? Address: The Internet Protect}? etidress (or address?) is 2: unique numeric address used by computers or: the intereet. .An Weedless looks titre a series oi? four numbers: each in the range Iii?2'35, eepareted by periods Every compoter attached to tire ioterne?t retreat be asst-gourd an 113? eddiess eo that letemet traf?c eerie from and directed to that competer may be directed property from its source to its destination. More Internet oervice proviciers controi a range of iP addresses. Some compoiers have Static?411211 it; addresses, while other computers have dyrtemicm?thet ES. {teem-cod}; ehrtogedmli? add b. tote-met: The interact is a giobei network of? computers and other devices that communicate wit?t each other. Doe to the structure of the connections betweeo devices on the teteroet o?'en cross state and internationat borders. even when the devices communicating weir each oteer are in the same State. or Storage medium: A storage mediom is an}r object upon which eomgueer deter can be recorded Exarnpioe iociede hard disks. RAM, ?oppy disks. flash memoryftimmb drives, CD-ROMS, and oteer magoe-tie or optical media. COMPUTERS, STORAGE. AND FORENSIC ANALYSIS 6, A5 described above and in Attachment B, tiri's appiicetiou geeks permiseion to Search for records that might be found ort ?le in wherever form the}: are footed. One Case 1:19-mi-00078-N Document 8-1 Filed 04i05119 Page 13 of 2? {one in which the records might be found is data stored on a compet?er?s hard drive or other storage media. Titles! she warraot applied For would authorize the seizure oi?eiectronic storage media on potentiaiiy: the copying ot?eieetronically stored all tinder Rule ancients; Pmbohie cruise. sniamit that it?a computer or storage medium is found on the iigii-iMifSES, than?: is pfobsiaie cease to believe those records wil! be stored on that computer or storage medium, for at ieast the foiiowing reasons: 3. Based on in}: knots-?ledge. trainings and experience? i know that computer files or remnants of such files can of: recovered months or even years after tile-3" nave been downioaded onto a storage medium. deleted. or viewed via the Intemet. Electronic f?iies downioaded 10.3 storage medium can be stored for years at iittie or no cost. Even when ?les have been deieted. ihcy can be recovered moniias or years later using forensic tools. This is so because when a person ?deletes" a file on a computer, the data contained in the fife, does not actually disapoear: mii?t?l?t that data remains on the stomge medium ttntii it is overwritten by new data. b. ?l?lierei'orc. deleted ?les: or remnants ofdeiete? ?ies: may reside in free space or siaclt space?rmtizat ist in space on the storage medium that is not currentiy being used by an active ?lewfoi? long, periods oi?time before they are overwritten. in addition. a computer?s operating system may aiso keep a record ot?deleted data in. a ?swap? or ?recovery? ?fe. Case Document 8-1 Fiied 04:05f19 Page 14 of Whe?y apart free} uses-?generated mes, computer storage mediemin pertienia?r. computers? interns? hard electronic evitienee ei?itew eemgyuter has been tise?~ what it has been useci Fer, end wee has user} it. Te give a line examples, this forensic evidence can take the form el?eperating system een?gttraiiens, artifacts frem operating system er sppiieatien operatiee. file system data st?mesures. amt? virtual it?iemery sw?ap 0r pagiitg ?les. {Seawater users typically do not erase er delete this evidence specie? software is typiesiiy reqttit?e?i fer that task. i-iewever?, it is technically sessihle to delete this inibrmatiett. Similariy, files the: have been viewed via the Internet are sometimes deweleeded iste a temporary internet directeey er "cache.? e. Ease-ti (is eetea] efether evidence reist?ed te t?iis investigatien- ineEuding spreadsheets, ?nancial and insurance peiicy applicatiens. I am aware that computer equipment was used it: generate stares and print deeunteets used in the wire and insurance Fraud schemes. is rease? it: that {item is a committee system eurrentiy ioeate? on the ESES. 3. Forensic evidence. As ?li?ti?t?i? eieserihed in Attachment B. this application seeks permissien it) leeate he: eempttier files that mighi serve as eifeet evidence efthe Crimes described en the warrant. but aise for Forensic eieetmnic evidence that estabiishes new eeiitpeters wete used, the pumese of their use. Wize used them, anti when. There-is gmbabie 14 Case Document 8-1 Filed 04105?19 Page 15 of 2? cause io believe that this {oreosic eieetronic evidence heoo any storage medium in the PREMISES E1. Data on Eire storage meriiom can evidence oi?o that was; once on the storage medium hui has since been deleted or edited, or of a dcieied poriion of a ?le {such as a paragraph that has been ciefeted From a were processing I'iEe). Virtue; memory pagieg syefems can leave irooes oi?ioiormaiion on [he Morage medium Show what tasks and processes were recentiy eeiive. browsers, e-maii program. and chat. programs store con?guration information on ?le sewage mec?om that can reveal; such ea oolioe nicknames and paesworde. Operating systems can record informatioor ?1?Ch3? the attachment of" periphcrais. the attachment of? USB ?ash storage devices or oiher externei storage meciia, and the times the computer was in use. Computer file eyet'eioe can record informatioe about ihe daiee ?ies were created and the sequence in wirieh we}: were created, airhoogh this can ieier be iialsi?eri, AS explained Eiei'eio. information storezi wither a computer and other electronic storage media may provi?e-orucie? evidence ofrhc ?who, when why. when. where. and how? of the criminal conduct under aims; coabiiog the United Smtee to csrabiish and prove each element or al?eroaiiveiy- to exclucfc the inooceot from ?anker Suspicion. in my training and experience. ioformaiion stored wiilzio a computer or storage media :?egierry infomatioo. i131 Case Document 8-1 Fi?ed 0420519 Page 16 of 27' communications, images and movies. ioionnstion. records of session times and dill?aii??S, internet history. and anti-virus. arid meiwore detection programs} can indicaie who has use? or controiied the Cometster or storage media. This "user attriboiion" evidence is analogous to the search {or ?iodieia oi?occopancy" while executing a search warrant at a residence. Tile existence or absence of asses-es, spyware. and msiwsre detection programs may indicate whether {he computer was remoreiy accessed. thus inceipating or excoieeting the computer owner. Further, computer stir} sroisge media activity can indicate how and when me computer or storage metiie was accessed or used. For example. as described herein. computers typically contain information that iog: computer user ecceoor session times see durations. computer activity - associated with user accomirs, electronic siorsge media that connected with Ihe compeier, and the 3P adciresses rhmogn which the composer accessed oetworics see} the iriiereet. Suck investigsiors re understand the chronoiogicel context of?computer or eiectroriie storage media access. use. and events resisting to the crime under invesiigetioe. information stereo whom at computer or electronic storage media may provide crociai evidence reietiog to the physieel iocatioo oiother evidence and the suspect. For example. images stored on a computer may; both show a particuiar Eoce?rion and have geoiocarioo ilii'ormsrion incorporated into its file dera. Such i?iie date typicsiiy eEso contaios indicating when the fiie or image was created. The existence of?suoh image ?les. eiong with esi?emsi device connection iogs. if) Case lzlg-mj-OUDTB-N Document 8-1 Filed O?f?si?lg Page 1? of 2? may also indicate the presence of additions! eiectronic storage media 3 digital camera or ceiiuler p?mt? with an ittcomot?atec} camera}. ?I?he geographic and timeiine information described herein may either er esceipste the computer user. Lest. ittformatiott stored within a computer may provide reicvenl insight into the cempet?er user?s state of mind as it relates to the effeese under investigation. For example. information within the computer may indicate the owner?s- and ieteet to commit 3 crime ietemet searches indicating criminei pieening}. or consciousness of running a ?wiping" program it?: desire}? evidence en the eemptiler or password such evidence. in are effort to ccitccei it from law A person with appropriate with how a computer werks can. after examining this forensic evidence its. its preper context. drew conciesiorts sheet how com peters were used, the purpose ot?tlte?r ttse. who used them. and when. The precess of ideetit?yicg tide exact ?ies. bieeks. registry entries. Logs. or Other forms or." forensic evitience ott a storage medium that are necessary to draw on eccto?ete conclusion is a dynamic process. Wi?tile it is possihie to specify in advance the records to he sought. computer evidence is not always data the: cart be mereiy reviewed by a review team and passed sleng to investigators. Whetiscr data stored on a computer is evidence may depend. or: other iniorrnetion stored on the computer and the ztpp?cefion of knowiedge- abeut how a computer behaves. Case Document 8d Fited 042?051'19 Page 18 of 2? ?I'hercibrc. cool'extual in Formaiion necessary to undetsiand moor evidence aiso falls within the scope ofiho Warrant. ?ower, in ?nding evidooco of how a oompuitr was usoi?, the purpose of its use, wiio ?1566 it, and when. somciimos i1 is necessary to cstaiilisia {inst a particufsr thing is not prawn; on a stomgo: medium. {ior exampie. prcsonce or absoncc ofcounter-'Ibrensic programs or anti-viros programs {and assosiatcd dam} may hit rcicvom to ostabiishizig {ht user?s imam. i koow that when an individoal uses a computer to transmit faisi?od. forged. or unauthorized docamonis. {he individuai's computer genera?}: serve bozh as 2:11 instrumentaiity For committing the crime: and a?so as a storage medium for evidence of the crime. 7311': computer is an instrumentaiity olilhr: crime because it is asset? as 3' moans of committing the criminal offeose. "?118 computer is 3350 likeiy to be a storage medium for ovicfonoo oi?crime. From my training am} {Experiences hoiiovc that a commie: itsod {o commit a crime oi'this Eypt: may comain: dam that is cvicionce of how tho computer was use?; trials that was sent or received: notes as to how the crimiosi coo?oct was achieved; records of i'niernet discussions about the crisis; anti other records that indicate {ho vision: of tin: [Tense . 9. Nazism}! ofseizfag or copying enffm? mmpufom or 3:0ng media in most cases a thoroogh search of z; premises for infoi'mation that mi glit ht: sowed on storage media o-?fiozi requires the seizure of the ohysicai sloragc media sod iaior oiT-siic rovie?w soosistom with tho 18 Case Document 8-1 Filed G4f05i'19 Page 19 of warrant. in lice of remoelng storage media titan/t the premises. it is sometimes possibic to make an image copy of storage media. Generally speaking. is tee taking of a contpieic ciectronic picture of the data. incintiing 21%? hidden secters and tieietetl files. Either seizure or imaging. is often necessary to ensure the accuracy and recorded on the etorage media. and ti} prevent the ioss refine data eititcr front acciticittai cit intentional destruction. This is true Meatlsc oi?the following: The time required For an examination. As noted abtive. no? all es?idencc takes the. Form oi?docontcnis and files that can he casiiy Viewed on Site. Analyzing evidence tti?itow a cott?tpnter has been used,wlta1 it itas been need liar. and who has used it. requires considerable time, and taking that tnuclt time on premises could be unreasonable. As explained above. because the warrant trails liar forensic electronic evidence. it it: exceedingly Eikeiy that itwili be necessary to thorottgliiy examine storage media to obtain evidence. Storage media can store a large of information. Reviewing that ini?ormation For ?xings described in the warrant can take Weeks or montits?epending on the lrolurnc ofdata store-ti. anti would be impractical and imrasive te attempt unasite. i3. Technical requirements. Computers can be configured in several different ways. featuring a variety ofdiff?ercnt systems, application software. and ccniignrations. Therefi'ire. searching tltem sometimes requires tools or knowie?gc that might not be present on ?te search site. The vast array liartl *Ell?E? and st'thware availaiale makes it ciif?ficuit to know before a search what looks 0r i9 Case 1 19-m1--00078--N Document 8--1 FHed 04105119 Page 20 of 27 be required analyze [he 5)> Jed mus m' cmirc medium. um might was: man) pans Ufa hard driw human in order It is millencc describtd b) [ht waran CON LUSION um affidavit suppons pmhahlc cans: I'm a warram lo sent: the in Attachment A sci7c [he ilcms Mama u' submitted. Spccial Agent Fedch Buvcnu mo" 20 Case Document 8-1 Fi?ed 04IOSI19 TH ABOVE AGENT HAD TIL) Ti?ifS AFHDAVIT FED. R. CRIM. P. THIS DAY OF 20E 9. US. Magistrate DN: cn=U.S. Mag i state Judge Katherine P. i Nelson,o:Fedetal Judiciary, ouzu.s. Judge Katherine P. . . .GBrunettemeritr cma i1=e? nelson?aa IsdJu scou rugmr, I SO Eater. 2019.04.05 i4:55:44 KATHERINE P. NELSON UNITED MAGISTRATE JUDGE Page 21 01?27 Case Document 8-1 Filed 04f05f19 Page 22 01?27? ATTACHME A Property jammed ?Rte gregtezzty it: be searched are the t?ellewing (hereafter referred te as devices): Type: temp Ct?m?tputer Make: Toshiba Mode]: SEN 695 69379Q ?I?ype: Laptop Computer Make: Tesitiba Mode}: SIN 9828133151 'I'ype: Ceiluler teiephette Make: Apple Modei: This; devices are earrentiy ioeated at the FBI Me?iie Evidence Centre? Keene ieeated at 200 N, Reyei Street; Mobiiet AL 36663. This we want attihoeizee the ibreneie exemieetiee 0f tee For the purpese nt?idemifyittg the electrettiealty Stored it?bmtatien in Attachment E. pun-u.- Case 1.19-mj-00078-N Document 8-1 Filed 04/05/19 Page 23 of 27 ATTACHMENT 10 [m seized I. All records on devims A n) of Milo IS gs Win: Fraud and Title I3 W33. Insurance Fraud. violations imolvu Thomas Edward Bums zina/ni- Tummy uni-ns Agency, LLC and occurring November mole mic dale in uhich Tommy BumsAgenc}: LLC insumnce liming) including in and inrommlon mlaling to insurance policies. policy applicalinns tulwellaliun natich cusinnicr requests is>> refunds polici pinnininis and ollwrul'lenl cammunicailoll, cuSlm'ner inrominiinn. financial snowing deposils orclieni premiums. shacks lircopics lolfmm cfiums. usunw scwiccs and insurance unueiwim- finfiml'lallonu Remus find inful'matlon (Chung 10 ms following email accounls used b) Bums: in and rciming lo the tracking m" payment logs. cancellalinn nmicx's for nun-payment nl'pwmiums. policy applicalinns. chucsfis for refunds orpiciniinm, rmtipis {or prcluimn payments. invoices Shmving nmniunisl chucks nrcopics nl cliccls |n rim" uliculs. csmuu scwiccs. and insurance 23 Case Document 8-1 Filed 04t05t19 Page 24 of 2? ?r 2. Records anti {staring to any agreements, contracts. or communication that may exist or existed het'weea Thomas ?ares andf?or Tensor}; Betas Agency. LLC and the individuaisfen?ries identi?e? herein as wet? as any other individuai or business who has received a notice of nonpayment or canceiiation notice doc to nonpayment From i??ovem her i, Etii? through the present: Recor?s anti information relating to sit customers who hart policies quoted oi" booed through Thomas Bares andr?or Tommy Bares Agency. List? from Novemoer 1. EMS to the present; Records and relating to any complaints rotating to poiicies hound or issued by or throogh Tommy Burns Agen?ey. LLC Fro-m November i. acts to the present. For any computer or storage medium whose seizure is otherwise authorised this warrant. and any computer or storage medium that contains or in which is stored records or information that is otherwise caller? for by this warrant {liereinat?tee a. eai?enee of who asect. owned. or controiied the COMPUTER at the time the things described in this warrant were ereaied. edited. or dei?ed- such as logs. registry entries. con?guration ?les. eased and passwords. ornaments. browsing history, user pro?les. email. email contacts. "chat." instant messaging iogs. photographs. and correspondence; 2% Case 1:19-mj-00078-N Document 8-1 Fiied OMGSIZLQ Page 25 of 27 evidence ot-?soitware teat weald allow others ?e metre] the COMPUTER, Sad?; as virusest ?I?rojan horses. and other forms at? maiicieus saith-?amt as weli as evidence ei?the presence er abseaee 91" security aetiware designe? a) detect ee?ware; evidence ef?thc iack efsueit maiicimts software; evidence i?dicatieg it?w and when the compute? were: (31' need to determine the context et? eempater? awe-351m- and events reia?ag 1'0 crime uac?er investigatien and It} ehe computer near: evitienee ind?eetieg ?the eemputer user?s; state efmied it reiatee {e the crime under Envestigatiea; evidence ef'the attachment If} the ef?ether Storage devices or similar swimmers fut" electronic evidence; evideace ef ?011I1ter~fhreitsic programs {and data) that are des?gaed to - eliminate data "fl'Qm the evidence of the times the COMPUPER was: used; passwe 1133, keys, and ether access devices; that may be necessary as access the deeaateatatiea and manaafs that may be te aecesa the er in cenduet a ferettsie examination eftite 25 Case 1:19-mj-00078-N Document 8-1 Filed Page 26 0f 2? k. of or in-Feenatiee Intereei addressee used ?25; the COM I. ef'er infomeiien eheu?: the [mernet activity. ineiue?ng ?rewaii legs. caches, breweer ?ismry and er ?Favorite? web page, Search terms that me user entered into any Entemei engine. and records web addresses; m. meet-ritual in??srmetien 1e un?erstan? the evidence ?eserihed in this attachment. A3 used eiae?sxe. the tenne ?fee/ere? eed Seefedes all forms eferee?en or eterage. ineler?ng any fern: efeempefer er storage {such a3 hard disks or other media ihat can store-dete}; an}: handmade form (Such as writing]: an}; meehahieei I'erm (suel?: as printing or typing]: and any phetegrephic ferm as; m?eref?im. micro?che. prints. slicks. negatives- metier: piemres, er 'i"}1e {erm ?eemputer? ineiudes types ef?eieen?enie. magnetic. optieei. or other high speed (feta processing devices perferming. legieal- arithmet?e. er storage f?eneiiens. inehdiag deeklep eempeiere, eeiebeek eemputers, mebiie tablets. sewer eempuiers. emf network hardware. The ierm. *?elerege medium" ine Eudes any piiysieei Object upee which eempeter data can be Exampiee disks. 5195??. ?oppy ciisks, drives. CD- RUMs, and ether magneiie er eptieai meeia. Case 1:19-mj-00078-N Document 8-1 Filed 042?051'19 Page 2? of 2? This warrant authorizes a review of?eieett?onie storage media and eieetmtti'eaiiy stored information fit-:iZt-td or copied pursuant to this warrant in order to locate evidence- fruits. and instrumentelities described in this wanent. The review oi?this electronic dete may he eeodeeted by any government personnel assisting in the investigation who may include in .adtiition te law enforcement of?cers and agents, attorneys for the govemment, attorney support staff. and teeitniest experts. i?tirsusnt to this wet-mitt, the F81 may ?eiivet eotnpiete copy of the seized or copied eieetmnie date to the custody and controi oi?attonteye fee the goveremeet and their sugagsort staff fer their independent review.