AO 106 (Rev.Case
04/ 10) Application
for a Search Warrant
3:19-mj-05592-MSB

Document 1 Filed 12/16/19 PageID.1 Page 1 of 37

UNITED STATES DISTRICT COURT•-•--,--•·•·•---"'• • ••
I"·,.

for the

1
, _

.· - o

• M
~-------~ 1"•-

,t;.,,,--

Southern District of California
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

Vizocom ICT LLC, a single family dwelling located at
1506 Constancia Way, El Cajon, California 92019

DEC 1 t :Wlb
)
)
)
)
)
)

CLEF-: .< . L, S ::;~ TR I: CC_,R,
SO UTHERN DISiH·CT OF C~ L FOR NiA

Case No.

BY

DE;,1., n

·.'19 MJ 55 92
1

•

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A, incorporated herein by reference .
located in the

Southern

District of

California

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment B, incorporated herein by reference.
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):

~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
Title 18 United States Code,
Sections 287, 1001 , 1343, and

Offense Description
False Claims, False Statements, Wire Fraud , and Conspiracy to Commit Wire
Fraud.

1349.

The application is based on these facts:
See attached Affidavit of Special Agent John Doyle, incorporated herein by reference.

rr/

Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

John Doyle, Special Agent
Printed name and title

Sworn to before me and signed in my presence.
Date:

I

rlt/J (r f

City and state: San Diego , California

Hon. Michael S . Berg , United States Magistrate Judge
Printed name and title

,

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.2 Page 2 of 37

ATTACHMENT A
PROPERTY TO BE SEARCHED
The property to be searched is 1506 Constancia Way, El Cajon, CA 92019, and any
and all outbuildings, appurtenances, storage areas, and locked containers, associated
therewith (the "TARGET PREMISES"). The property is further described as a
single family dwelling with a two car garage located on the front south west comer
of the house. The garage door is white in color with four narrow starburst style
windows that line the top length of the door. The exterior appears to be a white or
light tan stucco with red brick comers. The brick exterior covers the comers of the
garage from the ground up, and covers a support column to the main entrance
covered walkway.

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.3 Page 3 of 37

ATTACHMENT B
LIST OF ITEMS TO BE SEIZED AND SEARCHED
1.
All records or other information located on the premises or contained in
computer related equipment and electronic or digital storage devices which there is
probable cause to believe contain, or constitute evidence, fruits, or instrumentalities
of, violations of 18 U.S.C. § 287, False Claims, 18 U.S.C. § 1001, False Statements,
18 U.S.C. § 1343, Wire Fraud, and 18 U.S.C. § 1349, Conspiracy to Commit Wire
Fraud, between April 1, 2018, and the present, including but not limited to any and
all documents, logs, notes, records, or other files (including prior versions and drafts
of files, deleted files, and fragments of files) containing or purporting to contain, or
purporting to be:
a. Documents and/or correspondence between any representative of
Vizocom ICT LLC ("Vizocom") and any representative of the U.S.
Government;
b. Documents and/or correspondence between any representative of
Vizocom and any representative of Mastodon Design and/or CACI
International Inc.;
c. Documents and/or correspondence with Alpha Antenna or any other
third-parties related to the supply, purchase, or shipping of antennas to
the U.S. Government;
d. Documents and/or correspondence regarding the purchase, sale,
manufacture, or testing of antennas that were intended to be sold to
the U.S. Government or, alternatively, used to fulfill RFQ
N0042119Q0303 and/or contract number N0042119P0467;
e. Documents and/or correspondence regarding the purchase, sale,
manufacture, or testing of antennas matching Mastodon Design Part
Number MD 1008-1710-01, and any payments related to the purchase,
manufacture, or inspection of antennas;
f. Documents and/or correspondence regarding the receipt of payment
from the U.S. Government related to RFQ N0042119Q0303, contract
number N0042119P0467, and/or the sale of Mastodon Design Part
Number MD 1008-1710-01, and any payments related to the purchase
or manufacture of antennas;

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.4 Page 4 of 37

g. Vizocom internal documents and/or correspondence regarding any
and all of the above topics and/or subjects;
h. Any and all documents relating to financial transactions executed by
Vizocom fulfilling RFQ N0042119Q0303 and/or contract number
N0042119P0467;
1.

Any and all business records showing the operation, financing,
administration, accounting, bookkeeping or management of Vizocom;
and

J. All appointment books, schedules, calendars, list of contacts,
telephone message slips, phone records, diaries, memos, and all other
similar items that appear to have been used by any representative of
Vizocom.

2.
All images, messages, and communications regarding methods to avoid
detection by the U.S. Government and/or law enforcement;
3.
Any and all documents, records, or correspondence pertaining to occupancy,
ownership, or other connection to the TARGET PREMISES;
4.
Computer(s), computer hardware, software, related documentation,
passwords, data security devices (as described below), videotapes, and or video
recording devices, and data that may constitute instrumentalities of, or contain
evidence related to, the specified criminal offenses. The following definitions apply
to the terms as set out in the affidavit and attachment:
a.
Computer hardware: Computer hardware consists of all equipment
which can receive, capture, collect, analyze, create, display, convert, store, conceal,
or transmit electronic, magnetic, or similar computer impulses or data. Hardware
includes any data-processing devices (including but not limited to cellular
telephones, central processing units, laptops, tablets, eReaders, notes, iPads, and
iPods; internal and peripheral storage devices such as external hard drives, thumb
drives, SD cards, flash drives, USB storage devices, CDs and DVDs, and other
memory storage devices); peripheral input/output devices (including but not
limited to keyboards, printers, video display monitors, and related communications
devices such as cables and connections), as well as any devices, mechanisms, or
parts that can be used to restrict access to computer hardware (including but not
limited to physical keys and locks).

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.5 Page 5 of 37

b.
Computer software is digital information, which can be interpreted by
a computer and any of its related components to direct the way they work.
Software is stored in electronic, magnetic, or other digital form. It commonly
includes programs to run operating systems, applications, and utilities.
c.
Documentation: Computer-related documentation consists of written,
recorded, printed, or electronically stored material, which explains or illustrates
how to configure or use computer hardware, software, or other related items.
d.
Passwords and Data Security Devices: Computer passwords and other
data security devices are designed to restrict access to or hide computer software,
documentation, or data. Data security devices may consist of hardware, software
or other programming code. A password (a string of alpha-numeric characters)
usually operates a sort of digital key to "unlock" particular data security devices.
Data security hardware may include encryption devices, chips, and circuit boards.
Data security software or digital code may include programming code that creates
"test" keys or "hot" keys, which perform certain pre-set security functions when
touched. Data security software or code may also encrypt, compress, hide, or
"booby-trap" protected data to make it inaccessible or unusable, as well as reverse
the progress to restore it.
As used above, the term "records, documents, messages, correspondence, data, and
materials" includes records, documents, messages, correspondence, data, and
materials, created, modified or stored in any form, including electronic or digital
form, and by whatever means they may have been created and/or stored. This
includes any handmade, photographic, mechanical, electrical, electronic, and/or
magnetic forms. It also includes items in the form of computer hardware,
software, documentation, passwords, and/or data security devices.
5.
For any computer, computer hard drive, or other physical object upon which
computer data can be recorded (hereinafter, "COMPUTER") that is called for by this
warrant, or that might contain things otherwise called for by this warrant:
a. evidence of who used, owned, or controlled the COMPUTER at the
time the things described in this warrant were created, edited, or
deleted, such as logs, registry entries, configuration files, saved
usemames and passwords, documents, browsing history, user profiles,
email, email contacts, "chat," instant messaging logs, photographs, and
correspondence;

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.6 Page 6 of 37

b. evidence of software that would allow others to control the
COMPUTER, such as viruses, Trojan horses, and other forms of
malicious software, as well as evidence of the presence or absence of
security software designed to detect malicious software;
c. evidence of the lack of such malicious software;
d. evidence of the attachment to the COMPUTER of other storage devices
or similar containers for electronic evidence;
e. evidence of counter-forensic programs (and associated data) that are
designed to eliminate data from the COMPUTER;
f. evidence of the times the COMPUTER was used;
g. passwords, encryption keys, and other access devices that may be
necessary to access the COMPUTER;
h. documentation and manuals that may be necessary to access the
COMPUTER or to conduct a forensic examination of the
COMPUTER;
1.

contextual information necessary to understand the evidence described
in this attachment.

6.
With respect to the search of any of the items described above which are stored
in the form of magnetic or electronic coding on computer media or on media capable
of being read by a computer with the aid of computer-related equipment (including
CDs, DVDs, thumb drives, flash drives, hard disk drives, or removable digital
storage media, software, or memory in any form), the search procedure may include
the following techniques (the following is a non-exclusive list, and the government
may use other procedures that, like those listed below, minimize the review of
information not within the list of items to be seized as set forth herein, while
permitting government examination of all the data necessary to determine whether
that data falls within the items to be seized):
a. surveying various file "directories" and the individual files they contain
(analogous to looking at the outside of a file cabinet for markings it
contains and opening a drawer believed to contain pertinent files);

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.7 Page 7 of 37

b. "opening" or cursorily reading the first few "pages" of such files in
order to determine their precise contents;
c. "scanning" storage areas to discover and possibly recover recently
deleted files;
d. "scanning" storage areas for deliberately hidden files; or
e. performing key word searches or other search and retrieval searches
through all electronic storage areas to determine whether occurrences
of language contained in such storage areas exist that are intimately
related to the subject matter of the investigation.

If after performing these procedures, the directories, files or storage areas do not
reveal evidence of the specified criminal activity, the further search of that
particular directory, file, or storage area, shall cease.

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.8 Page 8 of 37

AFFIDAVIT IN SUPPORT OF SEARCH WARRANT

1

I, John Doyle, being duly sworn, hereby state as follows:

2

INTRODUCTION

3
1.

4

I make this affidavit in support of an application under Rule 41 of the Federal

5 II Rules of Criminal Procedure for a warrant to search the following premises, as further
6 II described in Attachment A:
7

Vizocom ICT LLC ("Vizocom"), located at 1506 Constancia
Way, El Cajon, California 92019 ("TARGET PREMISES")

8

9 and to seize evidence of the Target Offenses (defined in paragraph 2, infra), including any
10 computers, electronic media, or files seized from the TARGET PREMISES, as further
11 described in Attachment B. Attachments A and Bare incorporated herein by reference.

2.

12

There is probable cause to believe that evidence, instrumentalities, and/or

1311 fruits of the following offenses (collectively, the "Target Offenses") will be found within
14 the TARGET PREMISES:
15

a. False Claims, in violation of 18 U.S.C. § 287;

16

b. False Statements, in violation of 18 U.S.C. § 1001;

17

c. Wire Fraud, in violation of 18 U.S.C. § 1343; and

18

d. Conspiracy to Commit Wire Fraud, in violation of 18 U.S.C. § 1349.

The facts and information contained in the affidavit are based upon my
3.
19
20 personal knowledge, the investigation and observations of other agents involved in the
21

investigation, information obtained from interviews of witnesses, a review of documents

22 and other records obtained during the course of the investigation, my training and
23 experience, and the training and experience of other agents with whom I have consulted.
24 This affidavit does not include each and every fact known to the government, but only
25 those facts necessary to support a finding of probable cause to support the requested
26 warrant.
27 I I
28 / /
1

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.9 Page 9 of 37

BACKGROUND AND TRAINING

1

211

4.

I am a Special Agent with the U.S. Department of Defense, Defense Criminal

3 II Investigative Service ("DCIS"), assigned to the Southern Maryland Resident Agency. As
4 II a Special Agent with DCIS, I am authorized to investigate crimes involving computer
5 II intrusions and other financial crimes governed by federal law, including Title 18 of the
611 United States Code. I was so employed from 2007-2014, and then returned to DCIS in
7112015. As a special agent of the DCIS, I am authorized to make arrests for felony offenses.
8 II I have over 20 years of federal law enforcement experience. In addition to DCIS, I have
9 II also been employed by the Department of the Interior - Office of the Inspector General,
1O II Food and Drug Administration - Office of Criminal Investigations, and U.S. Immigration
11 and Customs Enforcement. I have a B.A. in Criminal Justice and have received extensive
12 training from the Federal Law Enforcement Training Center (FLETC) in the area of white
13 II collar crime, to include attendance of the Money Laundering and Asset Forfeiture Training
14 II Program and Procurement Fraud Investigations Training Program.

I specialize in

15 II investigations of fraud against the Department of Defense, contract fraud, bribery of public
16 II officials, and false claims to the government. During my tenure, I have worked extensively
17 II on contract fraud and public corruption cases, particularly complex cases, and thus I am
18 II familiar with the techniques, strategies, and behavior of individuals who have defrauded
19 11 the government or have made false claims to the government, and who seek to conceal
20 II such illicit activities from detection by law enforcement.
21 II

PROBABLE CAUSE
Vizocom's Sale of Counterfeit Antennas to the U.S. Navy

22
5.

23

In October 2019, the DCIS Mid-Atlantic Field Office was contacted regarding

24 II the alleged sale of counterfeit antennas by Vizocom to the U.S. Navy.
25 II

6.

On April 25, 2019, 1 the Naval Air Warfare Center Aircraft Division

26 II ("NA WCAD"), Patuxent River, Maryland, issued a Request for Quote ("RFQ"),
27 IIN0042119Q0303, which sought quotes for the purchase of 450 Mastodon Design
28
1

All dates and times are approximate and omit "on or about" for the sake of brevity.
2

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.10 Page 10 of 37

1 II ("Mastodon") antennas to be utilized by members of the U.S. Naval Special Warfare
2 II Command ("NS WC").

In order to maximize procurement opportunities for small

3 II businesses, the Rapid Acquisition Team ("RAC"), NA WCAD, which was responsible for
4 II this procurement effort, offered priority to qualified small businesses. The RFQ indicated
5 II that the U.S. Government intended to purchase the antennas on a firm-fixed price basis6 II i.e., that the price was not subject to adjustment based on the contractor's cost in performing
7 the contract.
8

7.

A requirement of the RFQ was that the antennas supplied be Mastodon Design

9 II brand antennas. Accordingly, "Section B - Supplies or Services and Prices" of the RFQ
1O II explicitly required that the antennas supplied carry the Mastodon Part Number (PIN):
11 II MD1008-l 710-01. This is a part number specific to the "Scourge" VHF/UHF 2 body-worn
12 II antenna manufactured by Mastodon of Rochester, New York. CACI International Inc. is
13 II the parent company of Mastodon. The RFQ also stated that the offeror "MUST BE AN
1411 AUTHORIZED Mastodon Design DISTRIBUTOR/RESELLER." The deadline for bids
15 II in the RFQ was May 2, 2019.
16 II

8.

On May 1, 2019, Dennis Marco from Vizocom's Procurement Department

17 II sent an e-mail-using a vizocom.com email address-to Mastodon requesting a quote for
18 11450 Mastodon antennas, PIN MD1008-1710-01. In response, Mastodon informed Marco
19 llthat the price (including delivery to destination) would be $165,109.50.

Vizocom

20 II submitted a timely electronic bid for the RFQ through the government portal for Federal
21 II Business Opportunities. Marco also emailed Vizocom's bid from a vizocom.com email
22 II address. In his email signature, Marco provided a San Diego, California, address for
23 II Vizocom. Based on additional investigation, I have reason to believe that Vizocom does
24 II not conduct business out of that San Diego address, but instead operates out of the
25 IITARGET PREMISES. See infra ,-r 19. Vizocom's bid was $165,109.50-the exact
26 II amount quoted by Mastodon. The header of the Vizocom price proposal stated that the
2711 company's address is the TARGET PREMISES:
28
2

Very High Frequency and Ultra High Frequency-two sets of radio wave signals.
3

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.11 Page 11 of 37

1

2
3
4

- .

_,Jc._vaz~a. .~.

., .......
~,,

l

·t.zc,c

5
6
7

8

9.

On May 7, 2019, a Purchasing Agent at NAWCAD emailed Marco-at a

911 vizocom.com email address-to inform him that Mastodon did not require reseller
1O II agreements and to confirm that the antennas Vizocom intended to supply would be covered
11 II under Mastodon's warranty. Marco responded that he had spoken with Mastodon and that
12 II the items were covered under its warranty and that Vizocom also provided a one year
13 !!limited warranty.
1411

10.

On May 14, 2019, the U.S. Navy awarded the contract to Vizocom for

15 II $165,109.50. The contract number was N0042119P0467. On May 15, 2019, NAWCAD
16 II issued an "Order for Supplies or Services" (DD Form 1155) to Vizocom for contract
17 II number N0042119P0467. Page one of the order listed the contractor-Vizocom-and the
18 11 address for Vizocom-the TARGET PREMISES.

Consistent with the RFQ,

19 NA WCAD's order was for 450 Mastodon antennas at a cost of$366.91 each, for a total of
20 $165,109.50.
21

11.

On or before August 1, 2019, the completion date of the contract, Vizocom

22 II delivered 450 antennas to the U.S. Navy. The shipping labels for these antennas stated that
23 II they were shipped from Alpha Antenna in Pleasant Hill, Missouri to the U.S. Navy in St.
24 II Inigoes, Maryland. Consistent with the specifications on the RFQ and the DD 1155, the
25 delivered antennas each had the requisite Mastodon part number etched on them. A
26 purchase order issued to Alpha Antenna by Vizocom, dated July 17, 2019, requested
27 II testing, packaging, and sealing for 450 antennas for $12,208.50. This purchase order listed
28
4

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.12 Page 12 of 37

1 II the billing address for Vizocom as the TARGET PREMISES, and requested that the
211 antennas be shipped to the U.S. Navy.
3 II

12.

On July 30, 2019, George Attar ("Attar"), with the email address

411 finance@vizocom.com, initiated an invoice and payment in the Wide Area Work Flow
5 II ("WA WF") system, which is used by the government and vendors to submit invoices and

611 initiate payments. The payee was Vizocom at the TARGET PREMISES. On August 7,
7112019, Vizocom was paid $165,109.50 by the U.S. Navy, pursuant to the contract. The
8 II payment was made via electronic funds transfer to Vizocom' s Bank of America Account
9 II Number ending in 6928.
10 II

13.

The antennas provided by Vizocom to the U.S. Navy stated Alpha Antenna

11 11 on the packaging and listed the Mastodon antenna PIN MD 1008-1710-01 :
12
13
14
15
16
17
18
19
20
21
22 These antennas also had the Mastodon part number printed on the metal connector:
23
24
25
26
27
28
5

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.13 Page 13 of 37

1

2
3
4
5
6

7

8
9 ..
II

14.

After the U.S. Navy received and began distribution of the antennas to the end

II

10

11

users, the Tactical Communications Command within NSWC notified Special

II Communications Mission Solutions, the U.S. Navy Technical Point of Contact for the
II contract, that the Vizocom antennas differed physically from the Mastodon antennas and
12
II were of poorer quality. NSWC had previously received and utilized legitimate Mastodon
11

13

antennas matching this part number. NSWC subsequently contacted Mastodon to find out

1411
II the reason for the discrepancy in the antennas.

15

Mastodon told NSWC that the antennas

16

11

that Vizocom had provided were not supplied by Mastodon and that the serial numbers

17

11

printed on the antennas were in fact counterfeit.
15.

18

After Mastodon was contacted by NSWC, I have been informed that CACI's

General Counsel spoke with Alok Kumar, Director of Sales & Operations at Vizocom.

1911
II According to CACI, CACI informed Vizocom that CACI had learned from the U.S. Navy
20
II that Vizocom had supplied counterfeit Mastodon antennas to the U.S. Government. CACI

21

2211
23

II about this discussion with Vizocom and also told your affiant that Alpha Antenna never

2411
25

demanded that Vizocom cease such activity immediately. CACI informed your affiant

contacted Mastodon about antennas, nor is Alpha Antenna an authorized distributor or
reseller of Mastodon antennas. Moreover, Vizocom never placed an order with Mastodon

II

2611

for these (or any other) antennas.
Vizocom's Operation at the TARGET PREMISES

27

28

16.

According to California business filings, the TARGET PREMISES is the

registered address for Vizocom and Attar is the Chief Executive Officer ("CEO") at
6

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.14 Page 14 of 37

1 II Vizocom. In the System for Award Management ("SAM")-a portal that current and
2 II potential government vendors use in order to be awarded contracts by the U.S.
3 II Government-Attar is listed as the point of contact with an address at the TARGET
4 II PREMISES. Moreover, Vizocom's profile with the U.S. Small Business Administration
5 II ("SBA") lists Attar as the point of contact and Vizocom's address as the TARGET
6 II PREMISES.
7

17.

On September 17, 2018, the Department of the Army, Office of the Judge

8 II Advocate General, Procurement Fraud Division, contacted Vizocom to inform the
911 company that it had been proposed for debarment from future contracting with the U.S.
1O Government. The letter was addressed to Emad Al Attar at "Vizocom ICT LLC d/b/a
11 Ruyat Al Mantaga for General Trading LLC."

As is relevant to this affidavit, the

12 TARGET PREMISES was listed as the business address for Vizocom.
13

18.

According to 2019-2020 Tax Records for San Diego County, California, the

14 II TARGET PREMISES is owned by Fadi Attar. The deed filed in the San Diego County
15 IIRecorder's Office reflected a deed transfer to Fadi Al Attar dated July 31, 2014.
16 II Additionally according to the San Diego County Recorder's Office, a Declaration of Trust,
17 II "The Fadi Attar Living Trust," was recorded on February 17, 2016, at the request of Attar
18 II with a mailing address listed as the TARGET PREMISES. The Grantor and the Trustee
19 II of the Trust is Fadi Attar and the Trust Property is the TARGET PREMISES. Attar is
20 II named as the successor Trustee and Attar along with Anam Gogi Attar are named as the
21 II beneficiaries of the Trust. The Declaration of Trust was signed by Fadi Attar and witnessed
22 and notarized.
23

19.

On its website, Vizocom lists its business address as 101 West Broadway,

24 II Suite 342, San Diego, California 92101. This building is a 20-story business district
25 II skyscraper bearing the "Morgan Stanley" name. On November 7, 2019, law enforcement
26 II visited the building to determine if Vizocom occupies these premises. In the main lobby
27 II on the ground floor, law enforcement observed a digital directory. "Vizocom ICT LLC"
28 II was listed under Suite 300, along with several other company names (also listed as residing
7

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.15 Page 15 of 37

1 II in that suite). Law enforcement entered the third floor from the elevator and encountered

2 II a receptionist at a front desk and observed what appeared to be safety deposit boxes or mail
3 II boxes numbered Al through A30, Bl through B30, Cl through C30, and D1 through D30.
4 II None of the locked boxes had names or any other identifying markers. The entire floor
5 II appeared to be one large suite with multiple cubicle style or small partitioned offices with
6 II glass windows, many of which were frosted glass with company names and logos etched
7 II on the glass. Names of some companies included "GURU," "Borders," and "FYC." No
8 II company name or logo for Vizocom or Vizocom ICT LLC was identified on any of the
9 II cubicle style or partitioned glass office entrances. An internet search for the property
1O II address and suite number indicated Davinci Virtual, along with at least one other virtual
11 II office space provider company, provides virtual office space to other companies at that
12 II address. Specifically, Davinci Virtual rents virtual office space to companies that do not
13 II need dedicated or permanent office space, providing services such as: (i) a professional
14 II business address; (ii) mail receipt and forwarding; (iii) access to meeting spaces and
15 II workspaces; and (iv) lobby directory listing (among other services).

Corporate

16 II representatives of Irvine Company Office Properties, the corporate property owner,
17 II described the location to agents as a "workshare environment."
18

20.

Law enforcement has also conducted surveillance of the TARGET

19 PREMISES. Law enforcement identified a black or dark color, four-door, Honda Civic
20 II with California license plate "7JVB320" parked in the driveway of the TARGET
21 II PREMISES on November 21, 2019. This vehicle is registered to Fadi Attar. Additionally,
22 II a silver Nissan compact sedan with California license plate "7MUN64 l" was parked on
23 II the street in front of the TARGET PREMISES. This vehicle is registered to Attar at the
24 TARGET PREMISES. Both vehicles were observed at the TARGET PREMISES
25 during subsequent surveillance conducted on November 26 and 27, 2019. Additionally,
26 II on November 26, 2019, an individual matching Attar's description, obtained from his
27 II California driver's license, was seen leaving the TARGET PREMISES with a black brief
28 II case and driving away in the silver Nissan.
8

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.16 Page 16 of 37

Probable Cause to Find Records in the TARGET PREMISES

1

2

21.

In the pages above, I have identified a number of facts which lead me to

3 II believe that evidence, instrumentalities, and/or fruits of the Target Offenses will be located
4 II in a search of the TARGET PREMISES. Some of these facts are restated below:
a. Vizocom states in its California business filings that its registered address

5

is the TARGET PREMISES;

6

b. When registering with SAM and the SBA, Vizocom provided the

7

TARGET PREMISES as its business address;

8

c. Attar is listed as the CEO of Vizocom and California property records

9

indicate that Attar has a legal interest in the TARGET PREMISES;

10

d. Vizocom does not appear to operate out of the business address that it

11

publicizes on its website;

12

e. Vizocom's bid for RFQ N0042119Q0303 stated that its business address

13

is the TARGET PREMISES; and

14
15

f. Once the alleged Mastodon antennas were delivered, Attar initiated a

16

payment through WAWF, which listed the payee as Vizocom at the

17

TARGET PREMISES.

18

22.

In addition to the facts above, from knowledge, training, and experience

19 II involving investigations of fraudulent activities and the training and experience of other
20 II agents with whom I am working in this investigation, I know:
21

a. Those involved in schemes such as the one described above often maintain

22

records, receipts, notes, ledgers, bank deposit receipts, money transfer

23

receipts, credit card receipts, money order receipts, and other papers

24

relating to wire fraud and money laundering; and that the aforementioned

25

records, receipts, note ledgers, etc., are maintained where they are readily

26

accessible, including in places controlled by the criminals (such as their

27

residences). In addition, I know that some of the information related to

28

fraud is often stored in computer equipment, smart phones, and other
9

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.17 Page 17 of 37

1

electronic storage media.

Based on the evidence gathered in the

2

investigation to date, the employees of Vizocom use email to communicate

3

with third parties (including when contracting with the U.S. Government),

4

and email is commonly stored on electronic devices, and sent and received

5

using electronic devices as instrumentalities;

6

b. That it is common for businesses, including businesses operating out of

7

residences or purporting to do so, to maintain business financial records,

8

such as payment, tax, and expenses information; information related to

9

bank accounts, wire payments, and receipts for any payments or expenses;

10

and associated correspondence and records, in both electronic and written

11

form, at addresses associated with the business and its principals, so that

12

the records are readily accessible;

13

c. That it is common for businesses that engage in government contracting

14

services to maintain information regarding their current and previous

15

contracts with the U.S. Government; their current and previous contracts

16

with suppliers, shipping companies, and other third parties that are and

17

have assisted the business in applying for or fulfilling the government

18

contracts; and associated correspondence and records, including but not

19

limited to shipping records, in both electronic and written form, at

20

addresses associated with the business and its principals, so that the records

21

are readily accessible;

22

d. That it is common for businesses that engage in government contracting

23

bidding to maintain information regarding market research, including

24

determining specifications and information regarding the items being

25

solicited by the U.S. Government, as well as competitor prices, in order to

26

ensure the lowest bid, and that such information and records are

27

maintained in both electronic and written form, at addresses associated

28
10

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.18 Page 18 of 37

1

with the business and its principals, so that the information is readily

2

accessible;

3

e. That it is common for businesses that engage in government contracting

4

services to maintain information from parts and services suppliers,

5

including conducting their own bidding process in order to ensure the

6

lowest bid to the U.S. Government, and that such information and records

7

are maintained in both electronic and written form, at addresses associated

8

with the business and its principals, so that the information is readily

9

accessible for future contracting efforts;

10

f. That it is common for businesses that engage in government contracting to

11

have records on their computer systems regarding access to U.S.

12

Government websites associated with the soliciting, bidding, and

13

contracting process, including but not limited to SAM, SBA, WA WF, and

14

the Federal Business Opportunities portal;

15

g. That it is common for employees and representatives of a company

16

involved in fraudulent activities to maintain addresses, telephone numbers,

17

and communications in books, on papers, and in computers/electronic

18

media which reflect names, addresses, telephone numbers of, and

19

communications with, their fellow employees, representatives, and

20

associates in the fraudulent activities; and

21

h. That it is common for persons involved in fraudulent activities to hide the

22

proceeds of bank transactions and records of fraudulent transactions in

23

secure locations within their residences, automobiles, and business and

24

storage facilities for their ready access and to conceal them from law

25

enforcement.

26 II
27 II

COMPUTERS, ELECTRONIC STORAGE AND FORENSIC ANALYSIS
23.

As described above and in Attachment B, this application seeks permission to

28 II search for records that might be found in the TARGET PREMISES, in whatever form
11

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.19 Page 19 of 37

1 11 they are found.

One form in which the records might be found is data stored on a

2 II computer's hard drive or other electronic storage media. Thus, the warrant applied for
3 II would authorize the seizure of electronic storage media or, potentially, the copying of
4 II electronically stored information, all under Rule 4l(e)(2)(B).
5 II

24.

Probable cause. I submit that if a computer or storage medium is found in

6 llthe TARGET PREMISES, there is probable cause to believe those records will be stored

7 II on that computer or storage medium, for at least the following reasons:

8

a. Based on my knowledge, training, and experience, I know that computer

9

files or remnants of such files can be recovered months or even years after

10

they have been downloaded onto a storage medium, deleted, or viewed via

11

the Internet. Electronic files downloaded to a storage medium can be

12

stored for years at little or no cost. Even when files have been deleted,

13

they can be recovered months or years later using forensic tools. This is

14

so because when a person "deletes" a file on a computer, the data contained

15

in the file does not actually disappear; rather, that data remains on the

16

storage medium until it is overwritten by new data.

17

b. Therefore, deleted files, or remnants of deleted files, may reside in free

18

space or slack space-that is, in space on the storage medium that is not

19

currently being used by an active file-for long periods of time before they

20

are overwritten. In addition, a computer's operating system may also keep

21

a record of deleted data in a "swap" or "recovery" file.

22

c. Wholly apart from user-generated files, computer storage media-in

23

particular, computers' internal hard drives-contain electronic evidence of

24

how a computer has been used, what it has been used for, and who has used

25

it. To give a few examples, this forensic evidence can take the form of

26

operating system configurations, artifacts from operating system or

27

application operation, file system data structures, and virtual memory

28

"swap" or paging files. Computer users typically do not erase or delete
12

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.20 Page 20 of 37

1

this evidence, because special software is typically required for that task.

2

However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes

3

4 II
5 II

automatically downloaded into a temporary Internet directory or "cache."
25.

Forensic evidence. As further described in Attachment B, this application

6 II seeks permission to locate not only computer files that might serve as direct evidence of
7 II the crimes described on the warrant, but also for forensic electronic evidence that
8 II establishes how computers were used, the purpose of their use, who used them, and when.
9 II There is probable cause to believe that this forensic electronic evidence will be on any
10 II computer in the TARGET PREMISES because:
11 II

a. Data on the storage medium can provide evidence of a file that was once

1211

on the storage medium but has since been deleted or edited, or of a deleted

13 II

portion of a file (such as a paragraph that has been deleted from a word

14

processing file). Virtual memory paging systems can leave traces of

15

information on the storage medium that show what tasks and processes

16

were recently active. Web browsers, e-mail programs, and chat programs

17

store configuration information on the storage medium that can reveal

18

information such as online nicknames and passwords. Operating systems

19

can record additional information, such as the attachment of peripherals,

20

the attachment of USB flash storage devices or other external storage

21

media, and the times the computer was in use. Computer file systems can

22

record information about the dates files were created and the sequence in

23

which they were created.

24

b. Forensic evidence on a computer or storage medium can also indicate who

25

has used or controlled the computer or storage medium.

26

attribution" evidence is analogous to the search for "indicia of occupancy"

27

while executing a search warrant at a residence. For example, registry

28

information, configuration files, user profiles, e-mail, e-mail address
13

This "user

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.21 Page 21 of 37

1

books, "chat," instant messaging logs, photographs, the presence or

2

absence of malware, and correspondence ( and the data associated with the

3

foregoing, such as file creation and last-accessed dates) may be evidence

4

of who used or controlled the computer or storage medium at a relevant

5

time.

6

c. A person with appropriate familiarity with how a computer works can,

7

after examining this forensic evidence in its proper context, draw

8

conclusions about how computers were used, the purpose of their use, who

9

used them, and when.

10

d. The process of identifying the exact files, blocks, registry entries, logs, or

11

other forms of forensic evidence on a storage medium that are necessary

12

to draw an accurate conclusion is a dynamic process. While it is possible

13

to specify in advance the records to be sought, computer evidence is not

14

always data that can be merely reviewed by a review team and passed

15

along to investigators. Whether data stored on a computer is evidence may

16

depend on other information stored on the computer and the application of

17

knowledge about how a computer behaves.

18

information necessary to understand other evidence also falls within the

19

scope of the warrant.

Therefore, contextual

20

e. Further, in finding evidence of how a computer was used, the purpose of

21

its use, who used it, and when, sometimes it is necessary to establish that

22

a particular thing is not present on a storage medium. For example, the

23

presence or absence of counter-forensic programs or anti-virus programs

24

(and associated data) may be relevant to establishing the user's intent.

25 II

26.

Necessity of seizing or copying entire computers or storage media. In most

26 II cases, a thorough search of premises for information that might be stored on storage media
27 II often requires the seizure of the physical storage media and later off-site review consistent
28 II with the warrant. In lieu of removing storage media from the premises, it is sometimes
14

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.22 Page 22 of 37

1 II possible to make an image copy of storage media. Generally speaking, imaging is the
2 II taking of a complete electronic picture of the computer's data, including all hidden sectors
3 II and deleted files. Either seizure or imaging is often necessary to ensure the accuracy and
4 II completeness of data recorded on the storage media, and to prevent the loss of the data
5 II either from accidental or intentional destruction. This is true because of the following:
6

a. The time required for an examination. As noted above, not all evidence

7

takes the form of documents and files that can be easily viewed on site.

8

Analyzing evidence of how a computer has been used, what it has been

9

used for, and who has used it requires considerable time, and taking that

10

much time on premises could be unreasonable.

As explained above,

11

because the warrant calls for forensic electronic evidence, it is exceedingly

12

likely that it will be necessary to thoroughly examine storage media to

13

obtain evidence. Storage media can store a large volume of information.

14

Reviewing that information for things described in the warrant can take

15

weeks or months, depending on the volume of data stored, and would be

16

impractical and invasive to attempt on-site.

17

b. Technical requirements. Computers can be configured in several different

18

ways, featuring a variety of different operating systems, application

19

software, and configurations.

20

requires tools or knowledge that might not be present on the search site.

21

The vast array of computer hardware and software available makes it

22

difficult to know before a search what tools or knowledge will be required

23

to analyze the system and its data in the TARGET PREMISES.

24

However, taking the storage media off-site and reviewing them in a

25

controlled environment will allow their examination with the proper tools

26

and knowledge.

27

28
15

Therefore, searching them sometimes

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.23 Page 23 of 37

1

c. Variety offorms of electronic media. Records sought under this warrant

2

could be stored in a variety of storage media formats that may require off-

3

site reviewing with specialized forensic tools.

4

d. Nature of examination. Based on the foregoing, and consistent with Rule

5

41(e)(2)(B), when persons executing the warrant conclude that it would be

6

impractical to review the media on-site, the warrant I am applying for

7

would permit seizing or imaging storage media that reasonably appear to

8

contain some or all of the evidence described in the warrant, thus

9

permitting its later examination consistent with the warrant.

The

10

examination may require techniques, including but not limited to

11

computer-assisted scans of the entire medium, that might expose many

12

parts of a hard drive to human inspection in order to determine whether it

13

is evidence described by the warrant. See infra ,r,r 27(b)-(j).

Business Computer Search Protocol

14
15

27.

With the approval of the court in signing this warrant, agents executing this

16 II search warrant will employ the following procedures regarding computers found on the
17 II premises that may contain information subject to seizure pursuant to this warrant:

18 II

Incremental Search

19

a. Vizocom is a functioning company with an indeterminate number of

20

employees. A seizure of the company's computer network may have the

21

unintended and undesired effect of limiting the company's ability to

22

provide lawful services to its legitimate customers. Consequently, the

23

agents who execute the search will use an incremental approach to

24

minimize the inconvenience to the company's customers, minimize the

25

intrusion into the privacy of uninvolved third parties, and minimize the

26

need to seize equipment and data. This incremental approach, which will

27

be explained to all of the agents on the search team before the search is

28

executed, will proceed as follows:
16

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.24 Page 24 of 37

1

1.

Upon arriving at the business to execute the search, the agents will

2

attempt to identify a system administrator of the network ( or other

3

knowledgeable employee) willing to assist law enforcement with the

4

identification of relevant systems and with the copying of computer

5

files from network servers and other systems reasonably believed to

6

contain information within the scope of the warrant. If the agents

7

succeed at locating such an employee and are able to obtain copies of

8

the relevant data in this fashion, the agents will not create a forensic

9

image of the entire network. Imaging network servers is complex,

10

time-consuming, usually interferes with any legitimate business

11

activities and/or computer access, and can result in the acquisition of

12

vast amounts of irrelevant data. Workstations and laptops believed to

13

contain relevant data, however, may be imaged onsite or taken for

14

imaging offsite, as provided above and below.

15

11.

If the business's employees choose not to assist the agents, the search

16

team will attempt to locate network servers and will attempt to

17

identify relevant data stores including user directories, file shares,

18

electronic mail accounts and logs, and make electronic copies of the

19

data stores reasonably believed to contain information subject to the

20

warrant.

21

111.

If identifying and copying data stores onsite is technically or

22

logistically not feasible, the entire server network may be imaged. As

23

discussed below, whether the image is obtained onsite or offsite will

24

be determined by technical issues, time-constraints, and safety

25

concerns. After the images are obtained, the data will be analyzed as

26

provided below.

27

28

1v.

To the extent that there is probable cause to believe that information
within the scope of this warrant may be found not only on servers, but
17

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.25 Page 25 of 37

1

also on personal computers, workstations, laptops, and other

2

electronic storage devices located at the business, such computers and

3

devices will be forensically imaged onsite or offsite as provided

4

below. 3

Forensic Imaging

5
6

b. After securing the premises, or if sufficient information is available pre-

7

search to make the decision, the executing agents will determine the

8

feasibility of obtaining forensic images of electronic storage devices while

9

onsite. A forensic image is an exact physical copy of the hard drive or

10

other media. A forensic image captures all the data on the hard drive or

11

other media without the data being viewed and without changing the data.

12

Absent unusual circumstances, it is essential that a forensic image be

13

obtained prior to conducting any search of the data for information subject

14

to seizure pursuant to this warrant. The feasibility decision will be based

15

upon the number of devices, the nature of the devices, the volume of data

16

to be imaged, the need for and availability of computer forensics

17

specialists, the availability of the imaging tools required to suit the number

18

and nature of devices found, and the security of the search team. The

19

preference is to image onsite if it can be done in a reasonable amount of

20

time and without jeopardizing the integrity of the data and the agents'

21

safety. The number and type of computers and other devices and the

22

number, type, and size of hard drives are of critical importance. It can take

23

several hours to image a single hard drive - the bigger the drive, the longer

24

it takes. As additional devices and hard drives are added, the length of

25

time that the agents must remain onsite can become dangerous and

26

impractical.

27

Forensic imaging of personal computers, workstations, laptops, and other electronic
28 II storage devices located at the TARGET PREMISES will be required should no
network servers be located at the business.
3

18

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.26 Page 26 of 37

1

c. If it is not feasible to image the data on-site, computers and other electronic

2

storage devices, including any necessary peripheral devices, will be

3

transported offsite for imaging. After verified images have been obtained,

4

the owner of the devices will be notified and the original devices returned

5

within sixty ( 60) days of seizure absent further application to this court.

6

d. Computers and other electronic storage devices and media that are retained

7

as instrumentalities will not be returned to its owner. The owner will be

8

provided the name and address of a responsible official to whom the owner

9

may apply in writing for return of specific data not otherwise subject to

10

seizure for which the owner has a specific need. The identified official or

11

other representative of the seizing agency will reply in writing. In the event

12

that the owner's request is granted, arrangements will be made for a copy

13

of the requested data to be obtained by the owner. If the request is denied,

14

the owner will be directed to Rule 41 (g) of the Federal Rules of Criminal

15

Procedure.

16

Identification and Extraction of Relevant Data

17

e. After obtaining a forensic image, the data will be analyzed to identify and

18

extract data subject to seizure pursuant to this warrant. Analysis of the

19

data following the creation of the forensic image can be a highly technical

20

process requiring specific expertise, equipment, and software. There are

21

thousands of different hardware items and software programs, and

22

different versions of the same programs, that can be commercially

23

purchased, installed, and custom-configured on a user's computer system.

24

Computers are easily customized by their users. Even apparently identical

25

computers in an office or home environment can be different with respect

26

to configuration, including permissions and access rights, passwords, data

27

storage, and security. It is not unusual for a computer forensic examiner

28
19

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.27 Page 27 of 37

1

to have to obtain specialized hardware or software, and train with it, in

2

order to view and analyze imaged data.

311

f. Analyzing the contents of a computer or other electronic storage device,

4

even without significant technical challenges, can be very challenging.

5

Searching by keywords, for example, often yields many thousands of hits,

6

each of which must be reviewed in its context by the examiner to determine

7

whether the data is within the scope of the warrant. Merely finding a

8

relevant hit does not end the review process for several reasons. The

9

computer may have stored metadata and other information about a relevant

10

electronic record - e.g., who created it, when and how it was created or

11

downloaded or copied, when it was last accessed, when it was last

12

modified, when it was last printed, and when it was deleted. Keyword

13

searches may also fail to discover relevant electronic records, depending

14

on how the records were created, stored, or used. For example, keywords

15

search text, but many common electronic mail, database, and spreadsheet

16

applications do not store data as searchable text. Instead, the data is saved

17

in a proprietary non-text format. Documents printed by the computer, even

18

if the document was never saved to the hard drive, are recoverable by

19

forensic programs because the printed document is stored as a graphic

20

image. Graphic images, unlike text, are not subject to keyword searches.

21

Similarly, faxes sent to the computer are stored as graphic images and not

22

as text. In addition, a particular relevant piece of data does not exist in a

23

vacuum.

24

transferred, communicated about, deleted, or printed the data requires a

25

search of other events that occurred on the computer in the time periods

26

surrounding activity regarding the relevant data. Information about which

27

user had logged in, whether users share passwords, whether the computer

28

was connected to other computers or networks, and whether the user

To determine who created, modified, copied, downloaded,

20

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.28 Page 28 of 37

1

accessed or used other programs or services in the time period surrounding

2

events with the relevant data can help determine who was sitting at the

3

keyboard.

4

g. It is often difficult or impossible to determine the identity of the person

5

using the computer when incriminating data has been created, modified,

6

accessed, deleted, printed, copied, uploaded, or downloaded solely by

7

reviewing the incriminating data. Computers generate substantial

8

information about data and about users that generally is not visible to users.

9

Computer-generated data, including registry information, computer logs,

10

user profiles and passwords, web-browsing history, cookies and

11

application and operating system metadata, often provides evidence of

12

who was using the computer at a relevant time. In addition, evidence such

13

as electronic mail, chat sessions, photographs and videos, calendars and

14

address books stored on the computer may identify the user at a particular,

15

relevant time. The manner in which the user has structured and named

16

files, run or accessed particular applications, and created or accessed other,

17

non-incriminating files or documents, may serve to identify a particular

18

user. For example, if an incriminating document is found on the computer

19

but attribution is an issue, other documents or files created around that

20

same time may provide circumstantial evidence of the identity of the user

21

that created the incriminating document.

22

h. Analyzing data has become increasingly time-consuming as the volume of

23

data stored on a typical computer system and available storage devices has

24

become mind-boggling. For example, a single megabyte of storage space

25

is roughly equivalent to 500 double-spaced pages of text.

26

gigabyte of storage space, or 1,000 megabytes, is roughly equivalent to

27

500,000 double-spaced pages of text. Computer hard drives are now being

28

sold for personal computers capable of storing up to 2 terabytes (2,000
21

A single

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.29 Page 29 of 37

1

gigabytes) of data. And, this data may be stored in a variety of formats or

2

encrypted (several new commercially available operating systems provide

3

for automatic encryption of data upon shutdown of the computer). The

4

sheer volume of data also has extended the time that it takes to analyze

5

data. Running keyword searches takes longer and results in more hits that

6

must be individually examined for relevance.

7

relevant data leads to new keywords and new avenues for identifying data

8

subject to seizure pursuant to the warrant.

9

1.

And, once reviewed,

Based on the foregoing, identifying and extracting data subject to seizure

10

pursuant to this warrant may require a range of data analysis techniques,

11

including hashing tools to identify data subject to seizure pursuant to this

12

warrant, and to exclude certain data from analysis, such as known

13

operating system and application files. The identification and extraction

14

process, accordingly, may take weeks or months. The personnel

15

conducting the identification and extraction of data will complete the

16

analysis within one-hundred twenty (120) days from the date of seizure

17

pursuant to this warrant, absent further application to this court.

18

J. All forensic analysis of the imaged data will employ search protocols

19

directed exclusively to the identification and extraction of data within the

20

scope of this warrant.

21

Genuine Risks of Destruction of Data

22

k. Based upon my experience and training, and the experience and training

23

of other agents with whom I have communicated, electronically-stored

24

data can be permanently deleted or modified by users possessing basic

25

computer skills. In this case, only if the subject receives advance warning

26

of the execution of this warrant, will there be a genuine risk of destruction

27

of evidence.

28111 /
22

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.30 Page 30 of 37

Prior Attempts to Obtain Data

1

1. The United States has not attempted to obtain this data by other means.

2

Procedures to Protect Third Party Privacy

3
4

m. All forensic analysis of the imaged data will employ search protocols

5

directed exclusively to the identification and extraction of data within the

6

scope of this warrant. In the event that the personnel lawfully conducting

7

the analysis identify information pertaining to crimes outside the scope of

8

the warrant, such information will not be used except to obtain a new

9

warrant authorizing a search for such information. In the event a new

10

warrant is obtained, the government may make use the data seized in any

11

lawful manner.

12

analysis may continue to search for and seize data only within the scope of

13

this warrant.

14

28.

Absent a new warrant, the personnel conducting the

In light of the issues enumerated above, your affiant requests the Court's

15 II permission to seize the computer hardware ( and associated peripherals) and storage media
16 II that are believed to contain some or all of the evidence described in the warrant, and
17 II conduct an off-site search of the items for relevant evidence if, upon arriving at the scene,
18 II the agents executing the search conclude that it would be impractical to search the computer
19 II items on-site for this evidence.

CONCLUSION

20
21 II

29.

Based on the facts set forth herein, I respectfully submit that there is probable

22 II cause to believe that the TARGET PREMISES, as further described in Attachment A,
23 II contains evidence, fruits, and instrumentalities of the Target Offenses.
24 II

30.

Therefore, I request the issuance of a search warrant pursuant to Rule 41 of

25 II the Federal Rules of Criminal Procedure authorizing law enforcement to search the
26 II TARGET PREMISES described in Attachment A and seize the items listed in
27 Attachment B.
28 I I
23

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.31 Page 31 of 37

1

31.

I affirm under penalty of perjury that the facts and circumstances outlined in

2 II this affidavit are true and accurate to the best of my knowledge and belief.
3
4 II I swear the foregoing is true and correct to the best of my knowledge and belief.
5
6

Jo~
uetense Criminal Investigative Service

7

811
911 Subscribed and sworn to ~

1'-

e me this

/u -

10
11

12
13
14
15
16

17
18

19
20
21
22
23
24
25
26
27

28
24

day of December, 2019.

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.32 Page 32 of 37

ATTACHMENT A

PROPERTY TO BE SEARCHED
The property to be searched is 1506 Constancia Way, El Cajon, CA 92019, and any and
all outbuildings, appurtenances, storage areas, and locked containers, associated
therewith (the "TARGET PREMISES"). The property is further described as a single
family dwelling with a two car garage located on the front south west comer of the
house. The garage door is white in color with four narrow starburst style windows that
line the top length of the door. The exterior appears to be a white or light tan stucco
with red brick comers. The brick exterior covers the comers of the garage from the
ground up, and covers a support column to the main entrance covered walkway.

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.33 Page 33 of 37

ATTACHMENT B
LIST OF ITEMS TO BE SEIZED AND SEARCHED
1.
All records or other information located on the premises or contained in computer
related equipment and electronic or digital storage devices which there is probable cause
to believe contain, or constitute evidence, fruits, or instrumentalities of, violations of 18
U.S.C. § 287, False Claims, 18 U.S.C. § 1001, False Statements, 18 U.S.C. § 1343,
Wire Fraud, and 18 U.S.C. § 1349, Conspiracy to Commit Wire Fraud, between April
1, 2018, and the present, including but not limited to any and all documents, logs, notes,
records, or other files (including prior versions and drafts of files, deleted files , and
fragments of files) containing or purporting to contain, or purporting to be:
a. Documents and/or correspondence between any representative of
Vizocom ICT LLC ("Vizocom") and any representative of the U.S.
Government;
b. Documents and/or correspondence between any representative of
Vizocom and any representative of Mastodon Design and/or CACI
International Inc.;
c. Documents and/or correspondence with Alpha Antenna or any other
third-parties related to the supply, purchase, or shipping of antennas to
the U.S. Government;
d. Documents and/or correspondence regarding the purchase, sale,
manufacture, or testing of antennas that were intended to be sold to the
U.S. Government or, alternatively, used to fulfill RFQ N0042119Q0303
and/or contract number N0042119P0467;
e. Documents and/or correspondence regarding the purchase, sale,
manufacture, or testing of antennas matching Mastodon Design Part
Number MD 1008-1710-01, and any payments related to the purchase,
manufacture, or inspection of antennas;
f. Documents and/or correspondence regarding the receipt of payment from
the U.S. Government related to RFQ N0042119Q0303, contract number
N0042119P0467, and/or the sale of Mastodon Design Part Number
MD 1008-1710-01, and any payments related to the purchase or
manufacture of antennas;
g. Vizocom internal documents and/or correspondence regarding any and
all of the above topics and/or subjects;

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.34 Page 34 of 37

h. Any and all documents relating to financial transactions executed by
Vizocom fulfilling RFQ N0042119Q0303 and/or contract number
N0042119P0467;
1.

Any and all business records showing the operation, financing,
administration, accounting, bookkeeping or management of Vizocom;
and

J. All appointment books, schedules, calendars, list of contacts, telephone
message slips, phone records, diaries, memos, and all other similar items
that appear to have been used by any representative of Vizocom.
2.
All images, messages, and communications regarding methods to avoid detection
by the U.S. Government and/or law enforcement;
3.
Any and all documents, records, or correspondence pertaining to occupancy,
ownership, or other connection to the TARGET PREMISES;
4.
Computer(s), computer hardware, software, related documentation, passwords,
data security devices (as described below), videotapes, and or video recording devices,
and data that may constitute instrumentalities of, or contain evidence related to, the
specified criminal offenses. The following definitions apply to the terms as set out in
the affidavit and attachment:
a.
Computer hardware: Computer hardware consists of all equipment which
can receive, capture, collect, analyze, create, display, convert, store, conceal, or
transmit electronic, magnetic, or similar computer impulses or data. Hardware
includes any data-processing devices (including but not limited to cellular telephones,
central processing units, laptops, tablets, eReaders, notes, iPads, and iPods; internal
and peripheral storage devices such as external hard drives, thumb drives, SD cards,
flash drives, USB storage devices, CDs and DVDs, and other memory storage
devices); peripheral input/output devices (including but not limited to keyboards,
printers, video display monitors, and related communications devices such as cables
and connections), as well as any devices, mechanisms, or parts that can be used to
restrict access to computer hardware (including but not limited to physical keys and
locks).
b.
Computer software is digital information, which can be interpreted by a
computer and any of its related components to direct the way they work. Software is
stored in electronic, magnetic, or other digital form. It commonly includes programs
to run operating systems, applications, and utilities.

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.35 Page 35 of 37

c.
Documentation: Computer-related documentation consists of written,
recorded, printed, or electronically stored material, which explains or illustrates how
to configure or use computer hardware, software, or other related items.
d.
Passwords and Data Security Devices: Computer passwords and other
data security devices are designed to restrict access to or hide computer software,
documentation, or data. Data security devices may consist of hardware, software or
other programming code. A password (a string of alpha-numeric characters) usually
operates a sort of digital key to "unlock" particular data security devices. Data
security hardware may include encryption devices, chips, and circuit boards. Data
security software or digital code may include programming code that creates "test"
keys or "hot" keys, which perform certain pre-set security functions when touched.
Data security software or code may also encrypt, compress, hide, or "booby-trap"
protected data to make it inaccessible or unusable, as well as reverse the progress to
restore it.
As used above, the term "records, documents, messages, correspondence, data, and
materials" includes records, documents, messages, correspondence, data, and
materials, created, modified or stored in any form, including electronic or digital form,
and by whatever means they may have been created and/or stored. This includes any
handmade, photographic, mechanical, electrical, electronic, and/or magnetic forms. It
also includes items in the form of computer hardware, software, documentation,
passwords, and/or data security devices.
5.
For any computer, computer hard drive, or other physical object upon which
computer data can be recorded (hereinafter, "COMPUTER") that is called for by this
warrant, or that might contain things otherwise called for by this warrant:
a. evidence of who used, owned, or controlled the COMPUTER at the time
the things described in this warrant were created, edited, or deleted, such
as logs, registry entries, configuration files, saved usemames and
passwords, documents, browsing history, user profiles, email, email
contacts, "chat," instant messaging logs, photographs, and
correspondence;
b. evidence of software that would allow others to control the COMPUTER,
such as viruses, Trojan horses, and other forms of malicious software, as
well as evidence of the presence or absence of security software designed
to detect malicious software;
c. evidence of the lack of such malicious software;

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.36 Page 36 of 37

d. evidence of the attachment to the COMPUTER of other storage devices or
similar containers for electronic evidence;
e. evidence of counter-forensic programs (and associated data) that are
designed to eliminate data from the COMPUTER;
f. evidence of the times the COMPUTER was used;
g. passwords, encryption keys, and other access devices that may be
necessary to access the COMPUTER;
h. documentation and manuals that may be necessary to access the
COMPUTER or to conduct a forensic examination of the COMPUTER;
1.

contextual information necessary to understand the evidence described in
this attachment.

6.
With respect to the search of any of the items described above which are stored
in the form of magnetic or electronic coding on computer media or on media capable of
being read by a computer with the aid of computer-related equipment (including CDs,
DVDs, thumb drives, flash drives, hard disk drives, or removable digital storage media,
software, or memory in any form), the search procedure may include the following
techniques (the following is a non-exclusive list, and the government may use other
procedures that, like those listed below, minimize the review of information not within
the list of items to be seized as set forth herein, while permitting government
examination of all the data necessary to determine whether that data falls within the
items to be seized):
a. surveying various file "directories" and the individual files they contain
(analogous to looking at the outside of a file cabinet for markings it
contains and opening a drawer believed to contain pertinent files);
b. "opening" or cursorily reading the first few "pages" of such files in order
to determine their precise contents;
c. "scanning" storage areas to discover and possibly recover recently deleted
files;
d. "scanning" storage areas for deliberately hidden files; or
e. performing key word searches or other search and retrieval searches
through all electronic storage areas to determine whether occurrences of

 Case 3:19-mj-05592-MSB Document 1 Filed 12/16/19 PageID.37 Page 37 of 37

language contained in such storage areas exist that are intimately related
to the subject matter of the investigation.
If after performing these procedures, the directories, files or storage areas do not
reveal evidence of the specified criminal activity, the further search of that particular
directory, file, or storage area, shall cease.