Department of Homeland Security UNITED STATES SECRET SERVICE lli' 0 Emma Best MuckRoclt News 4 IA Highland Ave. Somem'lle. MA 02l4+25 6 Re: Freedom of lnforrnation Act Appeal - File Number 20 90 78 Dear Ms. Best: Reference is made to your recent email dated January 23. 2020. appealing the determination of Kevin Tyrrell. United States Secret Service (Secret Service) Freedom of Information Act Officer. regarding the above referenced file. Under my direction. a search for responsive records was conducted and responsive records were located. It has been determined that information from these records may be released to you under the Freedom of lnforrnation Act Copies of the pages containing this information are enclosed. However. some information is being withheld under the FOIA. The records in question contain information compiled for law enforcement purposes. Pursuant to Section 552 certain information is being withheld since the disclosure of this information could constitute an unwarranted invasion of privacy. Some information is being withheld under Section 552 since the disclosure of this information could disclose techniques and procedures for law enforcement investigations or disclose guidelines for law enforcement investigations or prosecutions which could risk circumvention of the law. Finally. some information is being withheld under Section 552 thS). as it includes inter- ageney or intra-agency material that would not be available by law to a party other than an agency in litigation with the Secret Service. Under federal law. we are required to advise you that any decision on appeal is subject to judicial review in the District Court in the district where the complainant resides. has a principal place of bminess. or in which the agency records are situated. or in the District of Columbia. Si ly. Leonza . ewsome Deputy Director Date: +97? EB emu-intent of alliance FOR IMMEDIATE RELEASE CRM THURSDAY. Jlfl.Y 20. 2017 (202) 5 1.00V TTY (866) 544-5309 ALP SHUT DOWV ?Dark .V'er' Slre Was Major Source of Fenranyl and Heroin. Linked to Overdose Deaths. and L'sed 8y Hundreds of Thousands of People to Buy and Sell Illegal Goods and Servlces Anonymously over the Internet WASHINGTON - The Justice Department today announced the seizure of the largest criminal marketplace on the lntemet. AlphaBay. which operated for over two years on the dark web and was used to sell deadly illegal drugs. stolen and fraudulent identification documents and access dey? ices. counterfeit goods. malware and other computer hacking tools. firearms. and toxic chemicals throughout the world. The international operation to seize AlphaBay's infrastructure was led by the United States and int. olved cooperation and efforts by law enforcement authorities in Thailand. the Netherlands. Lithuania. Canada. the United Kingdom. and France. as well as the European law enforcement agency Europol. On July 5. Alexandre azes aka AlphaOZ and Admin. 25. a Canadian citizen residing in Thailand. was arrested by Thai authorities on behalf of the United States for his role as the creator and administrator of .-\lpha8ay-. On July l2. azes apparently took his own life while in custody in Thailand. Cazes was charged in an indictment I filed in the Eastern District of California on June I. with one count of conspiracy to engage in racketeering. one count of conspiracy to distribute narcotics. six counts of distribution of narcotics. one count of conspiracy to commit identity theft. four counts of unlaw t?ul transfer of false identification documents. one count of conspiracy to commit access des ice fraud. one count of trafficking in des ice making equipment. and one count of money laundering conspiracy. Law- enforcement authorities in the Lnited States worked with numerous foreign partners to freeze and presene millions of dollars' worth ot'cry'ptocurrencies that were the subject of forfeiture counts in the indictment. and that represent the proceeds of the AlphaBay organization?s illegal activities. On July 19. the LS. Attomey's Otthe for the Eastern District of Califomia filed a civil forfeiture complaint against Alexandre ares and his wife's assets located throughout the world. including in Thailand. Cyprus. Lichtenstein. and Antigua Barbuda. azcs and his wife amassed numerous high yalue assets. including luxury \ehicles. residences and a hotel in Thailand. Cazes also possessed millions of dollars in cry'ptocurrency'. which has been seized by the FBI and the Drug Enforcement Administration (DEA). 1.. 7 1? LIN 1.111 ?1 2131;. . us - 'sc? 11?; #1 111111 v.3: wag-r I. 1 I ?1 '15? 1'35? _111\1 1 ?1"11 c1 . 1- \11?1? 111.9?. 1 111.1 . ark?; .1:1.1 "In" \-I11r11tc' uuL. (HAL, uni 1 r? 1min; \1 Ru.1.1 1.1.13 xxcr? when -.-.. v: :111.1121 '11: L'k x2.? 11 '11: Ir.. 11.. .1 ~I:r1. 1.x 111m: In . cc '11. 11? 21; .- cu. 11111;? 1111 1111.11 :I'cj. 111 11' h: 1:411:11 '111': lefx -.-.. xx 1110?? 1111.1 wt. pl $11.1 1.11m - 1r 1 11!: 211. 111 ?11.1 12: 1111.?111y? 2132-1121; I \l 1: M141: 1 Lw; ur 111-: 't1.1l 11-1-1; -11:c .1 31': 11:1. I ?1.31.1; Y. 11 ~ T. rainy '.lx1} 211;! I) 1 11.x"; .1'111 .111 1 .rgk, .1r11.:1.c 1111? .11 mama-kw .1111 .1 1 ran. 111 71?; P. .l?L?m'I?il'x' uncut 1? .. 11'1. 111?3 111x ugrr'g' 1.1.1 c? ?:ch 111 1111' '31: 1.1~ xi; um? 1' Cu 11 1yl;;:r 1=rk - 1' 111?11?1; ?1111 a 1pm. '111?I;1c1. 11: "1 1-1' '11: 'nc 111' 1 1v; ?1 f? 11-1!) 11~ 1: 1-: 111x11111n-?a?x1 1":1x 11? 11'.1 321?: an 1. If; "11 '1 1.11" fl?J 1" H511 - enforcement's investigation of AlphaBay. authorities believe the site was also used to launder hundreds of millions of dollars deriv ing from illegal transactions on the website. An it? estigation conducted by FBI Atlanta and the LIS. Attomey?s Office in the Northern District of Georgia identified an AlphaBay staffer living in the United States. That investigation is ongoing. The investigation into AlphaBay revealed that numerous vendors sold fentanyl and heroin. and there have been multiple overdose deaths across the country attributed to purchases on the site. According to a complaint affidavit filed in the District of South Carolina against Theodore Vitality Khleborod and Ana Milena Barrero. an investigation into an overdose death on Feb. l6. 20l 7. in Portland. Oregon. involving ?47700. a opioid. revealed that the drugs were purchased on AlphaBay from Khelborod and Barrero. According to another complaint affidavit filed in the Middle District of Florida against Jeremy Achey. an investigation into a fentanyl overdose death in Orange County. Florida. on Feb. 27. 2017. revealed that the lethal substance was purchased on AlphaBay from Achey. Charges contained in an indictment and"or complaint are merely allegations. and the defendant is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law. This operation to seize the AlphaBay site coincides with efforts by Dutch law enforcement to investigate and take down the Hansa Market. another prominent dark web market. Like AlphaBay. Hansa Market was used to facilitate the sale of illegal drugs. toxic chemicals. malware. counterfeit identi?cation documents. and illegal services. The administrators of Hansa Market. along with its thousands of vendors and users. also attempted to mask their identities to avoid prosecution through the use of Tor and digital currency. Further infonnation on the operation against the Hansa Market can be obtained from Dutch authorities. The operation to seize AlphaBay"s servers was announced by Attorney General Jeff Sessions: Deputy Attorney General Rod Rosenstein: Acting Assistant Attorney General Kenneth A. Blanco of the Justice Department's Criminal Division: US. Attorney Phillip A. Talbert for the Eastern District of California; Acting Director Andrew G. McCabe of the FBI. Acting Administrator Chuck Rosenberg of the DEA and Europol Executive Director Robert Mark Wainwright. The case is being investigated by the FBI including FBI Sacramento Field Office and DEA. with substantial assistance from the US. Immigration and Customs Enforcement?s Homeland Security Investigations also assisted in the investigation. The case against Cazes was prosecuted by Assistant Attomeys Paul A. llemesath and Grant 8. Rabenn of the US. Anomey 's Office for the Eastern District ot?Califomia. and Trial Attorneys Louisa K. Marion and C. Alden Pelker of the Criminal Div ision's Computer Crime and Intellectual Property Section. Substantial assistance was provided by the Department of Justice's Office of lntemational Affairs and Special Operations Division. Additionally. the following foreign law enforcement agencies provided substantial assistance in the operation to seize AlphaBay?s infrastructure: Royal Thai Police. Dutch National Police. Lithuanian Criminal Police Bureau (LCPB). Royal Canadian Mounted Police. United Kingdom's National Crime Agency. Europol. and French National Police. 3? 8' 3 I7. 00 NOT REPLY TO THIS MESSAGE. IF YOU HAVE QUESTIONS. PLEASE USE THE CONTACTS IN THE MESSAGE 0R ALL THE OFF ICE OF PUBLIC AFFAIRS AT 202- Ski-2007. PRESS RELEASE 20 July 20 7 Underground Hausa Market talten over aad shut down As part of an estetnise international insestignion. the Netherlands Police and the Public Prosecution Senice have dismantled. seized control of. and shut down one of the biggest illegal market places on the internet today. It is Hansa Market. currently the most popular darlt market in the ?anonymous' part of the internet. the so-called darknet The insestiption in question is being carried out in close cooperation with the police and judicial authorities in Germany. Lithuania. and the United States. and also with Europol. This week. a Hausa top. seller was arrested in Krimpen an den Used. the Netherlands Accounts with a total of more than l.000 bitcoins. representing a value of some two million euros. were seized. The bitcoins were transferred to an account of the Public Prosecution Scm?oe. [Tademser operatloa The fall ol'HaasaMarLet isthe?aal stepot?an seined cot-col ofthe illegal maker place in lane ofthis yet. This ?as made possible by the arrest ofthe moadministmors otllaasa Market inGertnany. aged 30 and Since theiarrest. the two men. llom SiegerL ?Rhine-Westphalia. hast been kept in preotrial detention. and are only allowed to hase contact with the"! launcrs. Lithuania It emerged that the underground market place was hosted on servers in Lithuania. Immediately aher the arrest of the administrators. these seners and their corresponding infrastructure were seized and an exact copy of the market place was transferred to Dutch servers Buyers and sellers could still access the darknet site. but without realizing the police and the public prosecution sets-ice in the Netherlands had seized control of Name. Since the end ol?lune. the High Tech Crime Team and the Dailwieb Team ol'the police ad the Public Prosecuion Service MVC gained insight into large numbers of sellers and buyers. who traded chie?y in hard drugs. Theusernarnes and passwords were iraercepted.0nateraoe. l.0000rderspetday were placed in response to almost 40.000 adserttsements. l.ast year. liaise Market had l.76.? dill'erent sellers Since the authorities seized control of Hansa Market there hate been more than 50.000 trartsactions. mainly intolving so? drugs hm! drugs. Iatereepted orders In the past weeks. the police hase intercepted tens of thousands of messages between sellers They werealsoabletoidentify thedehser) address t?oralargemmberot?orders. Some 10.000 buyers werepassedon to Empol. Morethan 500 Ouch delisery addresses were reported to couriers and postal senices with the intention of stopping the deliseries. The makets enable large-scale trading in chie?y illegal goods. such as drugs. weapons. child pontowaphy. and ransom software. Well-known examples of such market places are Silk Road (taken down by the FBI in 20l 3) mid Alpha Bay (shut down within the framework of an international police operation earlier this monthl No weapons or child pornography were sold on Hansa Market. After the takedown of AlphaBay. Dutch authorities started to detect an increase in traffic towards Hausa. This operation was meant to lure discontent customers from AlphaBay to other Dark Web marketplaces like Hansa. Since AlphaBay was taken down. the average of less than I 000 vendors on Hansa per day. has risentomorethan8000perday'. Sale from deteetlon Sellers and buyers. and also administrators of illegal market places o?en believe they are safe from detection by the police and the judicial authorities. By carrying out criminal insestiptions into these criminals. and prosecuting them. it will become clear that the darkweb is not as anonymous as its users might think. The international cooperation between the Netherlands police. the Public Promion Service the FBI. Eutopol. and the authorities in Gennmy and Lithuania has seriously damaged the image of credibility and reliability of these market places. An important measure is the seizure of the servers on which the market places are hosted. A Public Prosecution Sem'ce seiaedcontrol within the frameworkqu undereoieroperation. A weak! of information will be studied in the coming weeks As horn today. people who sisit Hana Mallet see a splash page from the police that phes an explanation ol'dte crimital insesliylion. Europol Public Inlorrnatlon 7: 20/07/2017 PRESS RELEASE Massive blow to criminal Dark Web activities after globally coordinated operation Takedown of AlphaBay and l-lansa will lead to hundreds of new investigations in Europe the Hague, the Netherlands Months of preparation and coordination have resulted today, 20 July 2017, in the takedown of two of the largest criminal Dark Web markets, and Hansa. Two major law enforcement operations, led by the Federal Bureau of Investigation the US Drug lnlorcernent Agency (DEA) and the Dutch National Police, with the support of Europol. have shut down the infrastructure of an undergrOund criminal economy responsible for the trading of over 350 000 illicit commodities including drugs, ?rearms and cybercrime maiware. The coordinated law enforcement action in Europe and the US ranks as one of the most sophisticated takedown operations ever seen in the fight against crirninai activities oniine. ?This is an outstanding success by authorities in Europe and the US, ltob Wainwright, the Executive Director of Europol. said today, while appearing alongside the US Attomey General, Acting F81 Director and Deputy Director of the US Drug Enforcement Administration (DEA), at a special press conference in Washington DC. "The capability of drug tran'ickers and other sen?ous criminals around the world has taken a serious hit today after a highly sophisticated )omt action in multiple countnes. 8y acting together on a global basis the law enforcement community has sent a clear message that we have the means to identify criminality and strike peek, even in areas of the Dark Web. There are more of these operations to come, he added. Dimitrla Avrarnopoulos, European Commissioner for Migration, Home Altair: and Citizenship, said: ?The Dark Web is growing into a haven of rampant criminality. rhis is a threat to our societies and our economies that we can only face together, on a global scale. The take-down of the two largest criminal Dark Web markets in the world by European and Amen?can law enforcement authorities shows the important and necessary result of international cooperation to right this criminality. congratulate the American and Dutch authon?ties for their successful work. as well as Europa! for centrally supporting this endeavour. Our ?ght against Criminal activities online and of?ine will cantinue and intensify. Julian King, EU Commissioner for the Security Union, said: This latest success demonstrates not just the growing threat posed by sophisticated criminal enterprises expiomhg the largely unregulated space OCCUpied by the internet but also the vital role of international cooperation among law enforcers. the private sector. national authorities and international organisations in making all of us safer from global. bordedess menaces. COMMUNICAYIONS Hausa man 1' . 5 sc?vae' as) '3 ?i ?i't'vla 32-21101 'nehetrwanos {rebirthulw?g Europol Public Information Popular Dark Web marketplaces was the largest criminal marketplace on the Dark Web. utilising a hidden service on the Tor network to effectively mask user identities and server locations. Prior to its takedown. reached over 200 000 users and 40 000 vendors. There were over 250 000 listings for illegal drugs and toxic chemicals on AlphaBay, and over 100 000 listings for stolen and fraudulent identi?cation documents and access devices, counterfeit goods. malware and other computer hacking tools, firearms, and fraudulent services. A conservative estimation of USD 1 billion was transacted in the market since its creation in 2014. Transactions were paid in Bitcoin and other Hansa was the third largest criminal marketplace on the Dark Web. trading similarly high volumes in illicit drugs and other commodities. The two markets were created to facilitate the expansion of a major underground criminal economy, which affected the lives of thousands of people around the world and was expressly designed to frustrate the ability of law enforcement to bring offenders to justice. The investigations Europoi has been supporting the investigation of criminal marketplaces on the Dark Web for a number of years. with the help of Bitdefender. an internet security company advising Europol's European Cybercrime Centre (6C3). Europol provided Dutch authorities with an investigation lead into Hansa in 2016. Subsequent enquiries located the Hansa market infrastructure in the Netherlands, with follow-up investigations by the Dutch police leading to the arrest of its two administrators in Germany and the seizure of servers in the Netherlands. Germany and Lithuania. Europol and partner agencies in those countries supported the Dutch National Police to take over the Hansa marketplace on 20 June 2017 under Dutch judicial authorisation. facilitating the covert monitoring of criminal activities on the platform until it was shut down today. 20 July 2017. in the past few weeks. the Dutch Police Cpllected valuable information on high value targets and delivery addresses for a large number of orders. Some 10 000 foreign addresses of Hansa market buyers were passed on to Europol. in the meantime. an FBI and DEA-led operation. called Bayonet. was able to identify the creator and administrator of AlphaBay. a Canadian Citizen living a luxurious life in Thailand. On 5 July 2017, the main suspect was arrested in Thailand and the site taken down. Millions of dollars worth of were frozen and seized. Servers were also seized in Canada and the Netherlands. Law enforcement strategy in shutting down two of the three largest criminal marketplaces on the Dark Web. a major element of the infrastructure of the underground criminal economy has been taken offline. It has severely disrupted criminal enterprises around the world. has led to the arrest of key figures involved in onllne criminal activity. and yielded huge amounts of intelligence that will lead to further investigations. But what made this operation really special was the strategy developed by the FBI, DEA. the Dutch Police and Europol to magnify the disruptive impact of the Joint action to take out AlphaBay and Hausa. This involved taking covert control of Hansa under Dutch Judicial authority a month ago. which allowed Dutch police to monitor the activity of users without their knowledge. and then shutting down during the same period. it meant the Dutch police could identify and disrupt the regular criminal activity on Hansa but then also sweep up all those new users displaced from AlphaBay who were looking for a new trading platform. in fact they ?ocked to Hansa in their droves. with an eight-fold increase in the number of new members of Home recorded immediately following the shutdown of Alpha". As a law enforcement strategy. leveraging the combined operational and technical of multiple agencies in the US and Europe. it has been an extraordinary success and a stark illustration of the collective power the global law enforcement community can bring to disrupt major criminal activity. EUROPOL CORPOMYE COMMUNICATIONS prestE-?es?xc euicce eu iser?hriwe'laan 71 0 Sta Si) bled .i man: 302 $0 01 Treiiag-e '51l0I303453895 ?(Netherlands 'he Netherlands Europol Public Information luropol as a central hub Europol has played a coordinating and de-conflicting role in both investigations. from the outset, Europol's European Cybercrime Centre (EC3) provided technical and forensic support to the Hansa marketplace investigation. In addition Europoi?s technical expertise was made available to the Dutch investigators lf'l clouding on-the-spot deployment, as they gained control of Hansa. Subsequently to this, Intelligence packages were prepared and sent out to law enforcement partners across 37 countries, spawning many follow-up investigations across Europe and beyond. Some of the intelligence extracted contains relevant information regarding the destination of drugs and is meant to inform the relevant countries about planned shipments of drugs. Overall more than 38 000 transactions have been identi?ed and Europol sent more than 600 communications. To ensure smooth coordination between the two investigations into and i-iansa. Europoi hosted a coordination meeting with leading law enforcement partners. Overall, 12 different agencies sat down together and collectively mapped out and agreed the overall strategy for the two operations. in early July. Europol hosted a command post staffed with representatives from the US FBI. DEA and Department of Justice, working alongside specialist staff from EC3. This command post was the central hub for information exchange during the AlphaBay operation. Europol?s secure communication channels were used to exchange information between and receive data contributions from partners. Europol continues to support the FBI. DEA. the Dutch National Police and other partners on the forensic work that needs to be performed on huge amounts of seized material. EUROPOL COMMUNICATIONS :'ess@europo swap; in E-ter'iorae'laan .73 3 it) 30- 9l)3 3'3 Media tiliDZ'm 302 50 UI 2517KK fire-lame 2509 lW The Nagse ?ax; 345 53 96 the-Netherlands "it ?letfe' ands Yn{slits-1? summed HQ ?m 4:2. \cm th-L. \m.c La: 2.: u- . we an- H-vu-c ?13:1: Axe Du:- j-?q-l 311' me Inca 1:3! 3?1 \czs? 2: u. 3-1?le Hm .me LtMun: Aucr.? 3mm \?cu 'z'n-Ik 3 1c; I Hint 10:23Sent: ?my Mn- 23 kll? :1 SA N4 i049? _1 {Flu-5 .of cc! . - 4-- .3 .3. .war?r/C I Wruh FLU p7 r; .6 EFE CE. uFKr In{5.3.x 1.. I A .. . I