2:18-mj-07130-EIL # 4

E-FILED

Page 1 of 10

Thursday, 27 September, 2018 09:38:33 AM
Clerk, U.S. District Court, ILCD
AO 93 (Rev. 12/09) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
Central District of Illinois
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH Evemote account
associated with Stephan4096@gmail.com
THAT IS STORED AT PREMISES CONTROLLED BY

)
)
)
)
)
)

Case No. 18-MJ-

1t 30

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location) :

INFORMATION ASSOCIATED WITH Evemote account associated with Stephan4096@gmail.com
THAT IS STORED AT PREMISES CONTROLLED BY Evernote Corporation, more particularly described in
Attachment A, wh ich is attached hereto and specifically incorporated herein.
The person or property to be searched, described above, is believed to conceal (identify the person or describe the
property to be seized):

See Attachment B, which is attached hereto and specifically incorporated herein .

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or
property.
YOU ARE COMMANDED to execute this warrant on or before
{

0 in the daytime 6:00 am. to 10 p.m.

(notto exceed 14 days)

~ at any time in the day or night as I find reasonable cause has been
established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the
place where the property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge
ERIC I. LONG
(name)

D I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be
searched or seized (check the appropriate box) Ofor _ __ days (not to exceed 30).

• until, the facts justifying, the later specific date of
--s/Eric
I. Long

A

Date and time issued:

City and state:

-U~rb=a=n=a~,l=lli~
•=Pi~s_ __ __

ERIC L LONG, U,S, District Court Judge
Printed name and title

 2:18-mj-07130-EIL # 4

Page 2 of 10

AO 93 (Rev. 12/09) Search and Seizure Warrant (Page 2)

Return

Case No.:
18-MJ- 7130

Date and time warrant executed:
July 18, 2018 at 6:19am

Inventory made in the presence of :

Copy of warrant and inventory left with:
Nury Siekkinen attorney for Evernote

GS t>.latthew Noblet

Inventory of the property taken and name of any person(s) seized :
One flashdrive provided by Evernote consisting of 18 data fo lders in Evernote proprietary software
Folder

Folder Name

9b7cea3S-ac8b-4beb-8cd0-c0cd7ffldde7 tephan's Notebook
f61826c3-Sb9c-44cl -a 725-42c60c61bcec Grad school stuff
bfe6992c-9b36-49fa-8203-b95a 73bd47bc exercise
10fdfalb-ddf8-45c2-bece-bdc99d4cc79 rTrading
Math Studying goa ls/ Deep
6079fbd0-99b0-452e-814c-Ofebfbd3bdf 2
work
684d40ee-d63f-470b-9ade-Olfc64f796fb expat plan
i9d6a2c40-8eb9-4dd2-b354~ brooks notes
d6bfd4b18acl
45c5f6ad-.,da-4e4a-9d5f-b022b89594d7 SARMs
bd804bef-cd48-423b-bbfa-f8e 7bc66763c rTripping
c9d3ce04-a 77e -4 lf5-b365-7f324963 l ea4 Stirn Log
bb9620ab-183e-47ac-a ld3microdosing 4 AcO MIT
276b06efa28a
fb220413-6f82-457b-9bfe-76cc03f76f0f Stuff I need to do
3ee85bed-e81c-4084-9d46Polish notes
71bea0b4f796
ea la9d34-32ea-45ac-a lac-Od0d23601e0 Programming notes/tips
39833b8a-Ocbb-4772-9eldMachine Leaming and tradnig
2abb2ee2e72d
7241f23c-98ea-41a6-8baf-48c75b0b76fd misc stuff im excited for
Olbe97c0-6480-4399-b2aadepressiion
e 1082dcc371e
trash

Number of
Documents

6

'
3
21

H

'
2

,
14

'
'
E
3(

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant
to the designated judge.

s/Todd M. Emery

Date : August 29, 2018
z.-:..-=t;cuting officer's signature

Todd M. Emery, Special Agent
Printed name and title

 2:18-mj-07130-EIL # 4

Page 3 of 10

ATTACHMENT A
Property to Be Searched

This warrant applies to information associated with Evernote account associated
to email stephan4096@gmail.com, that is stored at premises owned, maintained,
controlled, or operated by Evernote Corporation, a company headquartered at 305
Walnut Street, Redwood City, California, 94063.

 2:18-mj-07130-EIL # 4

Page 4 of 10

ATTACHMENT B
Particular Things to be Seized
I.

Information to be disclosed by Evemote Corporation (the "Provider")

To the extent that the information described in Attachment A is within the
possession, custody, or control of the Provider, regardless of whether such information
is stored, held or maintained inside or outside of the United States, and including any
emails, records, files, logs, or information that has been deleted but is still available to
the Provider, or has been preserved pursuant to a request made under 18 U.S.C. §
2703(f) on date April 5, 2018, the Provider is required to disclose the following
information to the government for each account or identifier listed in Attachment A:
(a) The contents of all emails or other communications associated with the account,
including stored or preserved copies of communications, draft messages, the
source and destination addresses associated with each message, the date and
time at which each message was sent, drafted or saved, and the size and length
of each message;
(b) All records or other information regarding the identification of the account, to

include full name, physical address, telephone numbers and other identifiers;
records of session times and durations; the date on which the account was
created; the length of service; the IP address used to register the account; log-in
IP addresses associated with session times and dates; account status; alternative
email addresses provided during registration; methods of connecting; log files;
and means and source of payment (including any credit or bank account
number);
(c) The types of service utilized to include, but not limited to the following:
i. Voice Number
11.

Customer Phone Number

iii. Customer Name and Date of Birth

iv. Other Email Address
(d) Names -including subscriber names, user names, and screen names;
(e) Addresses - including payment addresses, mailing addresses, residential
addresses, business addresses, and email addresses;

 2:18-mj-07130-EIL # 4

Page 5 of 10

(f) Local and long distance telephone records

(g) Telephone or instrument numbers (including MAC addresses, ESNs, MEINs,
MEIDs, MINs, SIMs, MSISDNs, IMSis, or IMEis;
(h) Other subscriber numbers or identities, including the IP address and Port
number;
(i) All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data,
pictures, financial data, purchase and sales records, and other files;

(j) All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and
(k) For all information required to be disclosed pursuant to this warrant, the
physical location or locations where the information is stored.
The Provider is hereby ordered to disclose the above information to the
government within 14 days of the issuance of this warrant.

 2:18-mj-07130-EIL # 4

Page 6 of 10

Information to be Seized by the Government

11.

All information described above in Section I that constitutes fruits, contraband,
evidence, and instrumentalities of violations of 21 U.S.C. §§ 841(a) and 846, those
violations involving Stephan CAAMANO (Evernote account associated with
stephan4096@gmail.com) and occurring after January 1, 2016, through the present,
including, for each account or identifier listed in Attachment A, information pertaining
to the following matters:
(a) Any and all documents, records or information1 relating to the purchase,
sale, importation, possession, shipment, tracking, delivery or distribution
of controlled substances, to include information regarding dark web or
dark web marketplaces; conversations about Xanax, narcotics, drugs, or
any pharmaceutical pills or materials; and "preparatory steps taken in
furtherance of the scheme;
(b) Any and all documents, records or information relating to the purchase,

sale, importation, possession, shipment, tracking, delivery or distribution
of packaging materials;
(c) Any and all documents, records or information relating to the purchase,
sale, tracking, delivery or distribution of postage or express mail
consignment;
(d) Any and all documents, records or information relating to the transfer,
purchase, sale or disposition of virtual currency;
(e) Any and all documents, records or information relating to the transfer,
purchase, sale or disposition of precious metals;
(f) Any and all documents, records or information relating to the operation of

money transmitting businesses;
(g) Any and all documents, records, or information relating to the access,
creation and maintenance of websites and hidden (Tor-based) services;
(h) Any and all documents, records, or information relating to email accounts
used in furtherance of these offenses;

As used above and on, the terms "records" and "information" includes all forms of
creation or storage, including any form of computer or electronic storage.
1

 2:18-mj-07130-EIL # 4

Page 7 of 10

(i) Any and all records or other items which are evidence of ownership or
use of computer or other electronic equipment, including, but not limited
to, sales receipts, bills for internet access, and digital manuals.

(j) Any and all records relating to an indicia of occupancy, residency, and
ownership or use of rental or purchased properties, including, but not
limited to, utility and telephone bills; rental, purchase or lease agreements;
and identification documents;
(k) Any and all records of any address and/or telephone books, and any
records or electronic data reflecting names; addresses; telephone numbers;
pager numbers of co-conspirators; sources of controlled substances,
precious metals and/ or virtual currency; identifying information for
customers purchasing controlled substances; and/ or virtual currency;
(1) Any and all bank records, checks, credit card bills, account information,
safe deposit box information and other financial records;

(m)

Any and all copies of income tax returns filed with the Internal
Revenue Service (IRS) or the Illinois Department of Revenue;

(n) Evidence of who used, owned, or controlled the account at the time the
things described in this warrant were created, edited, or deleted, such as
logs, registry entries, configuration files, saved usemames and passwords,
documents, access history, user profiles, email, email contacts, "chat,"
instant messaging logs, photographs, and correspondence;
(o) Evidence of the times the account was accessed;
(p) Passwords, encryption keys, and other access devices;
(q) Contextual information necessary to understand the evidence described in
this attachment;
(r) Evidence of internet activity, including screenshots or other downloads
from the Internet;
(s) Any and all records and information regarding hidden services accounts 2
Hidden services (.onion services) are accessed through the Tor anonymity network.
Most are considered dark web services with no legitimate or identified service provider to
which legal process may be served.
2

 2:18-mj-07130-EIL # 4

Page 8 of 10

used in furtherance of the offenses described above, including, but not
limited to, darknet market accounts, associated darknet forum accounts
and Tor-based email accounts.
(t) Any and all records and information regarding peer to peer (P2P) virtual
currency trading platform accounts, including, but not limited to,
localbitcoins.com3 accounts or bitcon-otc internet relay chat channel4
accounts.
(u) Any and all records and information regarding virtual currency in any
format, including but not limited to, wallets (digital and paper), public
keys (addresses) and private keys.
(v) Evidence indicating how and when the account was accessed or used, to
determine the geographic and chronological context of account access,
use, and events relating to the crime under investigation and to the
account owner;
(w)Evidence indicating the account owner's state of mind as it relates to the
crime under investigation;
(x) The identity of the person(s) who created or used the user ID, including
records that help reveal the whereabouts of such person(s).
LocalBitcoins, OY (and their associated web platform, localbitcoins.com "LBC") is a
Finnish company which is not a licensed money transmitting business registered with the U.S.
Government and compliant with the Bank Secrecy Act, which requires establishment and
maintenance of anti-money laundering (AML) programs in accordance with know your
customer (KYC) rules, such as identifying persons involved in currency transactions over
certain thresholds. LBC is not considered a legitimate service provider to which legal process
may be served for accurate subscriber information or account seizure.
3

Internet Relay Chat (IRC) is a decentralized chat system which enables people with an
installed client (computer program which sends and receives messages to and from an IRC
server via the internet) to join in live discussions with anyone else connected in the same
manner. The IRC server ensures that all messages are broadcast to everyone participating in a
discussion. There can be many discussions going on at once; each one is assigned a unique
channel. One such channel is #bitcoin-otc, in which virtual currency trades are negotiated and
arranged. All transactions that may occur are conducted directly between counterparties,
without any participation or intermediation from the hosts of IRC servers, and therefore no
entity to which legal process may be served for accurate subscriber information, transactional
history or account seizure.
4

 2:18-mj-07130-EIL # 4

Page 9 of 10

(y) The identity of the person(s) who communicated with the user ID about

matters relating to manufacturing and distributing counterfeit
pharmaceuticals/narcotics, including records that help reveal their
whereabouts.

 2:18-mj-07130-EIL # 4

Page 10 of 10

CERTIFICATE OF AUTHENTICITY OF DOMESTIC
BUSINESS RECORDS PURSUANT TO FEDERAL RULE
OF EVIDENCE 902(11)

I, _ _ _ _ _ _ _ _ _ _ _ _ __ , attest, under penalties of perjury under the
laws of the United States of America pursuant to 28 U.S.C. § 1746, that the information
contained in this declaration is true and correct. I am employed by Google Inc., and my official
title is _ _ __ _ _ _ _ _ _ _ _ _ . I am a custodian ofrecords for Google Inc.. I state
that each of the records attached hereto is the original record or a true duplicate of the original
record in the custody of Google Inc., and that I am the custodian of the attached records
consisting of _ _ _ _ (pages/CDs/kilobytes). I further state that:
a.

all records attached to this certificate were made at or near the time of the

occurrence of the matter set forth, by, or from information transmitted by, a person with
knowledge of those matters;
b.

such records were kept in the ordinary course of a regularly conducted business

activity of Google Inc.; and
c.

such records were made by Google Inc. as a regular practice.

I further state that this certification is intended to satisfy Rule 902(11) of the Federal
Rules of Evidence.

Date

Signature