Case Document 1 Filed 12/14/17 Page 1 of 12 PHILLIP A. TALBERT United States Attorney RAJ GRANT B. RABENN PAUL A. HEMESATH Assistant United States Attorneys 2500 Tulare Street, Suite 4401 Fresno, CA 93721 Telephone: (559) 497-4000 Facsimile: (559) 497-4099 CLERK. U. .Dl TC OURT - EASTERN DIWIFOHNIA JOHN CRONAN BY Acting Assistant Attorney General Criminal Division, United States Justice Department LOUISA K. MARION Senior Counsel Computer Crime and Intellectual Property Section Washington, DC 20530 Telephone: (202) 514?1026 DEPUTY (XEFIK Attorneys for Plaintiff United States of America IN THE UNITED STATES DISTRICT COURT EASTERN DISTRICT OF CALIFORNIA . UNITED STATES OF AMERICA, CASE NO. . Plaintiff, VIOLATIONS: 18 U.S.C. 1962(d) Conspiracy to Engage in a V. Racketeer In?uenced Corrupt Organization; and 18 U.S.C. 1963(a)(1), Criminal BRYAN CONNOR HERRELL, Forfeiture. aka aka Defendant. I I M. 13. I GENERAL ALLEGATIONS At all relevant times herein: 1. Defendant BRYAN CONNOR HERRELL, aka aka (hereafter is a United States citizen by birth. He has resided 'in or around Aurora, Colorado. 2. aka aka (hereafter deceased as of July 2017, resided in or around Quebec, Canada, and Bangkok, i-Irb' n+4 NA Case Document 1 Filed 12/14/17 Page 2 Of 12 Thailand. 3. In or around July 2014, with other persons, known and unknown to the Grand Jury, created AlphaBay (also referred to as the ?AlphaBay Market?f), a dark-web marketplace designed to enable users to buy and sell illegal goods, including controlled substances, stolen and fraudulent identi?cation documents and access devices, counterfeit goods, malware and other computer hacking tools, ?rearms, and toxic chemicals. The site also allowed users to buy and sell? illegal services, such as money laundering. AlphaBay was used by thousands of vendors to distribute controlled substances and other illegal goods and services to buyers throughout the world, and to launder hundreds ofmillions of dollars deriving from these illegal transactions. AlphaBay also provided a - private, internal messaging service through-which staff, vendors, and buyers could communicate, as well as an associated web forum called the ?AlphaBay Market Forum.? 4. AlphaBay existed on the dark web, meaning it was accessible only through The Onion Router network, which anonymized the Internet Protocol addresses'of its underlying servers. The use of Tor also made it difficult to identify the true physicallocations of the website?s administrators, moderatOrs, and users. AlphaBay required its users to transact in digital currencies, including Bitcoin, Monero, and Ethereum. The site did not allow for transactions in of?cial, government-backed currencies. 5. Digital currencies are electronically sourced units of value that exist on the Internet and are not stored in a physical form. They are not issued by any government, but instead are generated and controlled through computer software operating on decentralized peer-to-peer networks. Users of digital currencies send units of value to and from ?addresses,? which are unique strings of numbers and letters functioning like a public account number. Digital currency transactions are recorded on a publicly available, distributed ledger, often referred to as a ?blockchainfi Because digital currencies are transferred peer-to-peer, users can avoid traditional, regulated financial institutions, which collect information about their customers and maintain anti-money laundering and fraud programs. AlphaBay and its users were able to bypass the traditional ?nancial systems by only accepting digital currencies. 6. . AlphaBay required its users, both vendors and buyers, to execute transactions through digital currency addresses hosted and ultimately controlled by the site. Before purchasing a good or INDICTMENT 2 '28 Case Document 1 Filed 12/14/17 Page 3 of 12 service, a buyer would load funds to an AlphaBay-controlled'digital currency address. Once loaded, AlphaBay credited the user?s account by that amount. A buyer could initiate a purchase by selecting an illegal good or service from a vendor and sending funds from their AlphaBay user account to an escrow account controlled and maintained by AlphaBay. Upon receipt of an illegal good or service, the buyer would notify AlphaBay that the transaction was completed. AlphaBay would then release the funds from the escrow account to the vendor?s AlphaBay account. From that point, a vendor could direct AlphaBay to transfer the ill-gotten funds to digital currency addresses outside of the AlphaBay platform and under the vendor?s control. Buyers could transfer funds from their AlphaBay accounts?in the same manner. For transactions leaving the site, AlphaBay provided ?tumbling? and ?mixing? services to attempt to obscure the historical trail of digital currency associated with the site and its users. AlphaBay also advertised other external mixing and tumbling services to its users. 7. AlphaBay?s user interface was configured like a conventional e-commerce website; Users could sign up for free and provide a screen name and password of their choosing. The site encouraged users to not include any information in their pro?le that could reveal their true identities. - AlphaBay provided a search tool allowing users to choose the type of illegal good or service they wanted to purchase. Users could also search by price ranges, popularity of items, vendors, origin or shipping country, and payment types. Further, AlphaBay?s homepage allowed users to browse categories of illegal goods,.with categories including: fraud, drugs and chemicals, counterfeit items, weapons, carded items, stolen credit card numbers and other access devices, services, software and malware. 8. To become a vendor, a user .was required to send a refundable vendor bond to the site. 33 46 AlphaBay allowed for users to leave ?positive, neutral,? and ?negative? feedback about vendors, which other users could use in choosing which vendors they would buy from. If a vendor or buyer disputed a transaction, AlphaBay provided dispute settlement services, and could permanently block vendors or buyers from carrying out future transactions on the site. AlphaBay designated and paid certain persons to perform these dispute settlement services, who were known as moderators. To sell illegal goods or services on AlphaBay, vendors could simply create listings on the site for buyers to see and then transact with buyers, as described above. INDICTMENT Case Document 1? Filed 12/14/17 Page 4 of 12 9. As agreed to by all vendors, AlphaBay took a percentage of the purchase price as a commission on the illegal transactions conducted through its website. with defendant HERRELL, and other operators and employees of the site, controlled and pro?ted from those commissiOns, which were worth at least tens of millions of dollars. I THE ENTERPRISE 10. Defendant HERRELL, and others known and unknown to the Grand Jury, were members and associates ofa criminal organization, hereafter, the whose members engaged in acts of: drug traf?cking; traf?cking in counterfeit and stolen identi?cation documents, counterfeit goods, unauthorized access devices, device-making equipment, and malware and other computer hacking tools; illegal ?rearms distribution; and money laundering, and whose members interfered with interstate and foreign commerce through acts of: drug traf?cking; traf?cking in counterfeit and stolen identi?cation documents, counterfeit goods, unauthorized access devices, and device-making equipment, and malware and other computer hacking tools; illegal ?rearms distributions; and money laundering. Members and associates of the ALPHABAY ORGANIZATION used AlphaBay to carry out transactions throughout the world, including in: Bangkok, Thailand; Aurora, Colorado, within the State and District of Colorado; and in the Counties of Fresno, Merced, Sacramento, and Placer, within the State and Eastern District of California. Members of the ALPHABAY ORGANIZATION caused to be transported into the State and Eastern District of California scheduled drugs, unauthorized access devices, false identi?cation documents, and other contraband, including but not limited to: heroin shipped to Fresno, California, on or about May 20, 2016; methamphetamine shipped to Fresno, California, on or about January 24, 2017; and false identi?cation documents shipped to Roseville, California, on or about June 11, 2015. ill 1. The ALPHABAY ORGANIZATION, including its leadership, members, and associates, constituted an ?enterprise,? as de?ned by Title 18, United States Code, Section 1961(4), that is, a group of individuals associated in fact, although not a legal entity. The enterprise constituted an ongoing organization whose members functioned as a continuing unit for a common purpose of achieving the objectives of the enterprise. The enterprise was engaged in, and its activities affected, interstate and foreign commerce. INDICTMENT Case Document 1 Filed 12/14/17 Page 5 of 12 12. 13. PURPOSES OF THE ENTERPRISE The purposes of the enterprise included, but were not limited to, the'following: A. to create, maintain, and control a dark-web marketplace for traf?cking in narcotics, counterfeit and stolen identi?cation documents, unauthorized access devices, counterfeit goods, device-making equipment, malware and other computer hacking tools, illegal ?rearms, and other illegal goods and services, and to launder the proceeds of such conduct; to enrich the leaders, members, and associates of the enterprise by taking a commission from each illegal transaction conducted through the dark-web marketplace created, maintained, and controlled by the enterprise; to promote and enhance the reputation and standing of the enterprise and its leaders, members, and associates; to preserve and protect the enterprise?s pro?ts and client base through acts of money laundering; and to protect the enterprise and its leaders, members, and associates from detection, apprehension, and prosecution by law enforcement, and from attacks by enemies, such as hackers and riVal dark?web marketplaces. MEANS AND METHODS or THE ENTERPRISE The means and methods by which defendant HERRELL, and other members and associates of the enterprise conducted and participated in the conduct of the affairs of the enterprise included, but were not limited to, the following: INDICTMENT A. Members and associates of the ALPHABAY ORGANIZATION distributed, and facilitated-the distribution of, controlled substances, including marijuana, herein, cocaine, fentanyl, and methamphetamine, through the AlphaBay website. The amount of drugs distributed by the ALPHABAY ORGANIZATION is unknown but is well in excess of 90 kilograms of heroin, 450 kilograms of cocaine, and 45 kilograms of methamphetamine. Members and aSsociateS of the ALPHABAY ORGANIZATION distributed, and 5 LAN OOKJQ Case Document ?1 Filed 12/14/17 Page 6 of 12 INDICTMENT facilitated the distribution of, counterfeit and stolen identi?cation documents, unauthorized,accessdevices, counterfeit goods, device-making equipment, and malware and other computer hacking tools. Members and associates of the ALPHABAY ORGANIZATION facilitated the provision of illegal services,including money laundering and ?swatting,? bomb threats and false reports to law enforcement. Members and associates of the ALPHABAY ORGANIZATION illegally sold, and facilitated the illegal sale of, ?rearms and firearm parts. Members and associates of the ALPHABAY ORGANIZATION laundered money through the AlphaBay website by maintaining and controlling digital currency addresses through which customers paid vendors on the AlphaBay website, and providing mixing and tumbling services for digital currency transactions from the AlphaBay-hosted digital currency addresses to addresses outside of the AlphaBay website. Members and associates of the ALPHABAY ORGANIZATION also laundered money by taking a percentage of all illegal transactions as a commission, and sending those commissions to members and associates of the ALPHABAY ORGANIZATION as salary payments. Further, members and associates of the ALPHABAY ORGANIZATION laundered money by sending their proceeds from administering the AlphaBay website to digital currency exchangers, Where the funds were converted into official, fiat currency and spent on personal goods and services. Members and associates of the ALPHABAY ORGANIZATION used various means .ofcommunication designed to protect the membership?s anonymity and to provide security for the criminal organization from attack by hackers, other criminal organizations, and from law enforcement, including but not limited to: i. An internally hosted messaging service on the AlphaBay website, which was controlled by the ALPHABAY ii. An internally hosted forum called the ?AlphaBay Market Forum,? which 10 ll 12x. l3 14 15 16Case Document 1 Filed 12/14/17 Page 7 of 12 iv. vi. vii. was controlled by the ALPHABAY Private instant messaging and multi?user conferencing technology; ?Pretty Good Privacy? which was required for all vendor communications and encouraged for all other users; Proxies, which bounced network traf?c from one computer to another to hide a member?s true originating IP address, including through the Tor network; Multiple contingency Uniform Resource Locators on the Tor network for redundancy in case of seizure by law enforcement or attack by enemies, such as through a distributed denial of service attack; Virtual Private Networks which are similar to proxies, but with the addition of creating an tunnel; and Public websites, including Reddit (at G. Members and associates of the ALPHABAY ORGANIZATION used digital currencies, including Bitcoin, to facilitate illegal transactions on the website, to protect the membership?s anonymity, and to facilitate the laundering of the membership?s ill-gotten gains. Members and associates of the enterprise also provided mixing and tumbling services for the website?s users, which assisted them in attempting to obscure the historical trail of digital currencies transferred from user accounts on the website to privately held digital currency addresses outside of the site?s purview. ROLE OF THE DEFENDANTS AND 14. Leaders, members, and associates of the ALPHABAY ORGANIZATION had de?ned roles in the enterprise. At all times relevant to this Indictment, defendant HERRELL, . and other persons, known and unknown to the Grand Jury, participated in the operation and management of the enterprise as follows: IN DICTMENT Case Document 1 Filed 12/14/17 Page 8 of 12 I Administrator: . 15. created and founded the ALPHABAY ORGANIZATION and its online platform, which included the AlphaBaylMarket and the AlphaBay Market Ferum. CO- began creating the AlphaBay online platform in or around July 2014, and, with other persons known and unknown to the Grand Jury, publicly launched the site in or around December 2014. served as the leader of the managers and operators of the criminal organization, who collectively controlled the destiny of the enterprise. 16. had ultimate control of the ALPHABAY ORGANIZATION, including its membership. had ?nal authority to delete the accounts of - moderators, vendors, and buyers on the website and forum. also had ?nal authority in settling disputes among moderators, vendors, and other users of the website. CO- was ultimately responsible for the website?s operational security and technology updates. controlled the ALPHABAY earnings, which derived primarily from a commission it made on every transaction occurring through the website. He also had ?nal control over salary payments to the staff members in the ALPHABAY ORGANIZATION, which were made in digital currencies, such as Bitcoin. Security Administrator: 17. The ALPHABAY ORGANIZATION employed a ?security administrator? responsible for administering the AlphaBay online platform with The security administrator had high?level access to the website and, With was responsible for the website?s Operational security andtechnology updates. The security administrator also had partial control of moderator, vendor, and other users? accounts on the AlphaBay online platform. W: 18. The ALPHABAY ORGANIZATION employed moderators to review and moderate disputes among vendors and buyers on the website. Moderators had access to portions of the AlphaBay platform that were not available to the general public. Moderators had the authority to refund payments from buyers on the website, to restore a user?s access to the site, to engage in staff-only discussions and meetings, and to view the amount ofdigital currency available to other members of the ALPHABAY INDICTMENT 8 Case Document 1 Filed 12/14/17 Page 9 of 12 ORGANIZATION. Moderators were paid based in part on the amount of work they performed for the ALPHABAY ORGANIZATION. 19. From on or about May 2016 through on or about July 2017, defendant HERRELL was a moderator on AlphaBay. In this role, defendant HERRELL moderated disputes between buyers and vendors, as described above, for which he was paid in Bitcoin. Defendant HERRELL used the moniker to moderate these disputes. Scam Watch: 20. The ALPHABAY ORGANIZATION employed ?scam watchers? responsible for monitoring and quashing phishing attempts and other scams being carried out on the AlphaBay online platform. - 21. From on or about August 2015 through on or about December 2015, defendant HERRELL served as a scam watcher, as described above, for which he was paid in BitcOin. Defendant HERRELL used the moniker to conduct this activity. Public Relations Manager: I 22. The ALPHABAY ORGANIZATION employed a public relations manager responsible for outreach to the website?s users and the broader dark?web community. The public relations manager posted updates about the website on the internally hosted AlphaBay Market Forum, and on public websites, such as Reddit. The public relations manager also assisted the website?s users with issues they had with the website, such as dispute settlement. Vendors: 23. The ALPHABAY ORGANIZATION facilitated the sale of illegal goods and services on its website. Those sales were made by vendors. Vendors were users who had paid a refundable vendor bond and-were thus given permission to create listings for the sale of illegal goods and services. Vendors were assigned f?trust levels? by the AlphaBay website based on several factors, including the amount of goods sold and reviews from customers. As alleged above, vendors received payments from customers through digital currency addresses hosted by the AlphaBay website. A percentage of all payments were kept by the ALPHABAY ORGANIZATION. Further, vendors communicated with their customers through an internal messaging service hosted by the AlphaBay website. In 9 '28 Case Document 1 Filed 12/14/17 Page 10 of 12 addition, vendors used AlphaBay moderators and other employees to assist in settling disputes with customers. THE CONSPIRACY [18 U.S.C. 1962(d) Conspiracy to Engage in a Racketeer In?uenced Corrupt Organization} The Grand Jury charges: BRYAN CONNOR HERRELL, aka aka defendant herein, as follows: 24. Paragraphs 1 through 23 are incorporated by reference as fully set forth herein. 25. Beginning no later than. in or around July 2014 and continuing to in or around June 2017, in the Counties of Fresno, Merced, Sacramento, and Placer, in the State and Eastern District of California and elsewhere, defendant BRYAN CONNOR HERRELL, aka aka with aka aka and other persons, known 16- and unknown to the Grand Jury, being persons employed by and associated with the ALPHABAY ORGANIZATION, an enterprise, which engaged in, and the activities of which affected, interstate and foreign commerce, knowingly and intentionally conspired to violate Title 18, United States Code, Section 1962(c), that is, to conduct and participate, directly and indirectly, in the conduct of the affairs of that enterprise through a pattern of racketeering activity, as that term is de?ned in Title 18, United States Code, Sections 1961(1) and (5), consisting of multiple acts indictable under 18 United States Code, Section 1028 (fraud in connection with identi?cation documents), 18 United States Code, Section 1029 (fraud in connection with access devices), and 18 United States Code, Sections 1956, 1957 (money laundering); and multiple offenses involving narcotics trafficking, in violation of 21 United States Code, Sections 841, 843, and 846(drug trafficking, use of a communication facility, and conspiracy). 26. It was a part of the conspiracy that defendant BRYAN CONNOR HERRELL, aka INDICTMENT 1 1 0 Case Document 1 Filed 12/14/17 Page 11 of 12 aka and aka aka and other persons, known and unknown to the Grand Jury, agreed that at least two acts of racketeering activity would be committed by a conspirator in the conduct of the affairs of the enterprise. All in violation of Title 18, United States Code, Section 1962(d). ORF EITURE ALLEGATION: [18 U.S.C. 1963(a)(1), Criminal Forfeiture] 27. Upon conviction of the offense alleged. in this Indictment, defendant BRYAN CONNOR HERRELL, aka aka shall forfeit to the United States pursuant to Title 18, United States Code, Sections 1963(a)(1), 1963(a)(2), and 1963(a)(3), any interest the defendant acquired or maintained in violation of Title 18, United States Code, Section 1962; any interest in, security of, claim against, or property or contractual right of any kind affording a source of in?uence over any enterprise which the defendant established, operated, controlled, conducted, or participated in the conduct of, in violation of Title 18, United States Code, Section 1962, as a result of this offense; and any property?constituting, or derived from, any proceeds which the defendant obtained, directly or indirectly, from racketeering activity in violation of Title 18, United States Code, Section 1962; including but not limited to: a. One wallet containing approximately one Bitcoin, b. An assortment of ?Magic: The Gathering? collectible cards, c. $745 in US. currency, d. 28 sports trading cards, e. 139 gold coins, one ounce each, f. 8 silver dollar coins, one ounce each, g. One $1,000 bill encased in hard plastic, and h. One German August Schwer Cuckoo Clock. .28. If any property subject to forfeiture, as a result of the offense alleged this Indictment, for which defendant is convicted: INDICTMENT 1 1 16f Case Document 1 Filed 12/14/17 Page 12 of 12 a. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third party; 0. has been placed beyond the jurisdiction of the Court; d. has been substantially diminished in value; or 6. has been commingled with other property which cannot be divided without dif?culty; it is the intent of the United States, pursuant to Title 18, United States Code, Sections 982(b)(1), and 1963 incorporating Title 21, United States Code, Section 853(p), to seek forfeiture of any other property of defendant, up to the value of the property subject to forfeiture. PHILLIP A. TALBERT United States Attorney KIRK E. A TRUE BILL. Slgnature on??la KIRK E. SHERRIFF Assistant United States Attorney Chief, Fresno Division INDICTMENT FOREPERS ON JOHN CRONAN Acting Assistant Attorney General, Criminal Division JOHN T. JR. Chief, Computer Crime Intellectual Property Section I wu??f By: LOUISA K. MARION Seni'or Counsel Computer Crime Intellectual Property Section United States Department of Justice 12'