Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 1 of 9 PageID 2
`
`I, PAUL COX, being duly sworn, declare and state as follows:
`
`AFFIDAVIT
`
`1.
`
`I am a Special Agent for the Food and Drug Administration-Office of Criminal
`
`Investigations ("FDA-OCI"). I am currently assigned to the Kansas City Field Office as a member
`
`of the Cybercrimes Investigation Unit. My current duties include investigating violations of the
`
`Federal Food Drug and Cosmetic Act and other violations of the United States Criminal Code. I
`
`have been employed as a Special Agent since November 2012. Through the course of my duties,
`
`I have conducted numerous investigations into the distribution of counterfeit, misbranded, and
`
`adulterated drugs and controlled substances via the darknet I and United States Postal Service, and
`
`personally executed more than seventy-five undercover purchases of drugs via the darknet in
`
`exchange for cryptocurrency.
`
`2.
`
`For the reasons set forth below, there is probable cause to believe that KEVIN
`
`OMBISI and ERIC RUSSELL, JR. did knowingly and willfully conspire with each other and
`
`others to distribute a mixture and substance containing a detectable amount of methamphetamine,
`
`a Schedule II controlled substance, in violation of Title 21, United States Code, Section 846
`
`(Conspiracy); and that KEVIN OMBISI did knowingly and willfully distribute a mixture and
`
`substance containing a detectable amount of methamphetamine, a Schedule II controlled
`
`substance, in violation of 21, United States Code, Section 841 (Unlawful Distribution of
`
`Controlled Substances).
`
`1 The darknet is a portion of the internet that is not indexed by search engines and requires special
`software that encrypts and anonymizes internet traffic for both those browsing and hosting
`websites on the darknet. Because these protocols limit the ability of governments and law
`enforcement to track the usage and hosting of the sites, the darknet includes a large quantity of
`websites that exist primarily as marketplaces for illicit substances and services.
`
`1
`
`

`

`Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 2 of 9 PageID 3
`
`3.
`
`The facts set forth in this affidavit are based upon my personal observations, my
`
`training and experience, and information obtained from various law enforcement personnel
`
`(collectively referred to as "Agents") and witnesses. This affidavit is intended to show merely that
`
`there is sufficient probable cause to support a criminal comp laint and does not purport to set forth
`
`all of my knowledge of or investigation into this matter. Unless specifically indicated otherwise,
`
`all conversations and statements described in this affidavit are related in substance and in part only.
`
`4.
`
`The FDA-OCI, and other law enforcement agencies, are investigating the illegal
`
`distribution of counterfeit Adderall2 by a vender sell ing controlled substances on the darknet and
`
`through encrypted messaging (referred to in this affidavit as "VENDOR-I "). Through the course
`
`of this investigation, Agents made a number of undercover purchases from VENDOR-I that were
`
`mailed from Texas to addresses in the Western District of Tennessee as well as to areas in Kansas
`
`and Missouri.
`
`5.
`
`In November 2019 VENDOR-I advertised " 100% AUTHENTIC Adderall Brand
`
`30mg USA to USA SUPER FAST SHIPPING *FREE EXTRA PILLS PROMO*" on the darknet
`
`marketplace Empire Market. 3 VENDOR' 1-s Empire Market sales page noted "Over 2000 5 Star
`
`Reviews," and indicated "3657 sold since Apri l 24, 2019." On three occasions, in November 2019,
`
`February 2020, and June 2020, agents from DEA made undercover purchases of purported
`
`2 Adderall is a brand name, Schedu le II amphetamine used to treat attention-deficit hyperactivity
`disorder, among other uses. See www.dea.gov/factsheet (last visited Feb. 4, 2021).
`
`3 Empire Market was a marketplace where one could find a variety of illicit drugs and services
`available for purchase from vendors throughout the world, but it ceased operations after August
`2020. From my train ing and experience, I know that darknet marketplaces, and the Empire
`Market in particular, resemble other legitimate e-commerce websites like Amazon or eBay in
`many respects. For example, customers who purchase items from vendors on the Empire Market
`can leave reviews for their transactions. These reviews and the good or bad reputation associated
`with them are one of the few metrics that allow potential customers of illicit goods or services to
`anticipate the likelihood that the anonymous seller will complete the transaction.
`
`2
`
`

`

`Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 3 of 9 PageID 4
`
`Adderall from VENDOR-I on Empire Market in exchange for bitcoin (hereafter "BTC")
`
`cryptocurrency. 4 In each instance, a package was delivered to the undercover address provided at
`
`the time of purchase, located in the Western District of Tennessee, and the contents of these
`
`purchases appeared consistent with what was advertised for sale on the Empire Market:
`
`amphetam ine-based prescription drug tablets, orange in color, bearing pill markings consistent
`
`with prescription amphetamine-based drugs, specifically Adderall ( collectively referred to as
`
`"Three Drug Parcels"). However, subsequent DEA laboratory testing revealed that the drugs
`
`received in the Three Drug Parcels did not contain amphetamine, the active pharmaceutical
`
`ingredient contained in Adderall, but in fact contained methamphetamine, a Schedule II controlled
`
`substance.
`
`6.
`
`The postage on the Three Drug Parcels was identified as pre-printed postage
`
`purchased through a United States Postage Reseller, 5 hereafter "Postage Reseller-I." Analysis of
`
`the information associated with the Postage Reseller- I account used to ship the Three Drug
`
`Parcels, including shipping activity and payment records, led Agents to identify OMBISI as the
`
`true account holder of the Postage Reseller-I account. In add ition, surveillance, GPS location data,
`
`and closed-circuit television place OMBISI at various post offices depositing packages using the
`
`Postage Reseller- I account.
`
`4 Bitcoin (BTC) is a type of cryptocurrency. Cryptocurrency is a virtual currency used as a
`substitute for fiat currency (i.e. government-issued money, such as the U.S. dollar) to buy goods
`or services or exchanged for fiat currency or other cryptocurrencies. Indiv iduals can acq uire BTC
`through exchanges, BTC A TMs, or directly from other people. BTC allows users to transfer
`funds more anonymously than is possible through traditional banking and financial systems.
`Although cryptocurrencies, such as BTC, have legitimate uses, cryptocurrency is also used by
`individuals and organizations for criminal purposes, such as money laundering, and to purchase
`illegal goods and services.
`
`5 Through a Postage Reseller, individuals can purchase and print official United States Postal
`Service stamps and shipping labels using an account that is often associated with a monthly
`subscription.
`
`3
`
`

`

`Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 4 of 9 PageID 5
`
`7.
`
`In addition to the three purchases made through Empire Market, Agents made ten
`
`(10) undercover purchases of purported Adderall from VENDOR-I through Wickr,6 an encrypted
`
`messaging application, in exchange for BTC cryptocurrency. Specifically, on December 10, 2020,
`
`Agents placed an order through Wickr for Adderall and provided an undercover address in the
`
`Western District of Tennessee. That same day, Agents observed OMBISI at the Almeda post
`
`office in Houston, Texas, carrying a weighted bag. Shortly thereafter, Agents intercepted a package
`
`at the same Texas post office that was destined for the undercover address in the Western District
`
`of Tennessee. Thereafter, on January 27, 2021 , after Agents placed another order through Wickr,
`
`providing an undercover address in Kansas, OMBISI was observed mailing packages at the
`
`Almeda post office in Houston, Texas; a package addressed to the undercover address was later
`
`retrieved from the same post office.
`
`8.
`
`During the course of this investigation, Agents conducted blockchain 7 analysis on
`
`seven (7) of the undercover Wickr purchases between January 22, 2020 and June 17, 2020. In the
`
`course of these purchases, Agents transferred a total of approximately 0.30461216 BTC
`
`cryptocurrency to seven (7) unique BTC wallet8 addresses provided by VENDOR-I for the
`
`purposes of completing the purchase. Based on the analysis:
`a.
`four ( 4) of these undercover purchases are a part of a cluster of
`
`6 VENDOR-I provided Agents with its Wickr username following the November 2019 Empire
`Market transaction. Wickr is an encrypted communication application that allows individuals to
`communicate via text and voice, and can be used on a cellular telephone. Wickr is used by
`individuals involved in the trafficking of counterfeit drugs because of the ability for senders of
`messages to set a self-destruct time for messages, as well as security features which notify senders
`of messages when parties to the conversation take a screenshot of messages.
`
`7 Blockchain is a publicly available ledger of cryptocurrency activity. Agents employ software to
`aid in tracing, clustering, and modeling data on the blockchain to obtain information regarding
`cryptocurrency transactions.
`
`8 A BTC wallet stores private and public keys used in BTC transactions. Private keys are used to
`make public keys, which can be converted to a BTC address. A BTC address is akin to a bank
`account number or email address that can be shown to receive payment. The owner of a private
`key has access to the funds stored on the corresponding BTC address. One person can have
`multiple BTC wallets and each wallet can store any number of private keys.
`
`4
`
`

`

`Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 5 of 9 PageID 6
`
`approximately one thousand one hundred and forty-nine (1 ,149) BTC wallet addresses, CM
`
`Wallet-I hereafter; and
`
`b.
`
`three (3) of the undercover purchases are a part of a cluster of approximately
`
`one thousand four hundred and eighty (1 ,480) BTC wallet addresses, CM Wallet-2 hereafter.
`
`9.
`
`Agents conducted further blockchain analysis of the above-referenced seven
`
`transactions and examined business records associated with a peer-to-peer cryptocurrency
`
`exchanging service located in the European Union, P2P Exchanger-I hereafter. They found the
`
`following:
`
`a.
`
`An account registered in the name of "KEVIN OMBISI" received
`
`10.36513383 BTC from CM Wallet-I , between October 04, 2019 and October 12, 2019; and
`
`b.
`
`A second account registered to "KEVIN OLANDO OMBISI" received
`
`approximately 113.54868227 BTC, through approximately one hundred and seventy-four (174)
`
`transactions, between October 16, 2019 and April 20, 2020, from CM Wallet-I , and approximately
`
`75.86273833 BTC, through approximately one hundred and five (105) transactions, between
`
`March 12, 2020 and June 01 , 2020, from CM Wallet-2.
`
`10.
`
`On approximately three (3) distinct occasions on December 4, 2019, and
`
`approximately two (2) distinct occasions on April 2, 2020, P2P Exchanger-I business records
`
`indicate that the account registered to "KEVIN OLANDO OMBISI" was accessed by a computer
`
`assigned an IP address tied to RUSSELL. Specifically, the same IP address accessed an iCloud
`
`Account registered to "Eric Russell" on approximately nine thousand six hundred and forty-four
`
`(9,644) distinct occasions between August 02, 2019 and December 18, 2020, and internet company
`
`Comcast Communications business records indicate the IP address serviced RUSSELL'S
`
`residence as early as November 24, 2019 and at least as recently as May 12, 2020. P2P
`
`5
`
`

`

`Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 6 of 9 PageID 7
`
`Exchanger- I business records further indicate that the account assigned to "KEVIN OMBISI"
`
`was accessed by a computer assigned the IP address associated with RUSSELL on one (1) distinct
`
`occasion October 09, 2019.
`
`11.
`
`On April 8, 2020, the Honorable Tu M. Pham, United States Magistrate Judge in
`
`the Western District of Tennessee authorized a search of the iCloud account associated with a
`
`telephone number believed to be used by OMBISI. The iCloud stores data associated with App le
`
`devices. Business records produced by Apple, Inc. indicated that the iCloud Account was
`
`registered to "Kevin Ombisi." Upon searching this account, agents discovered a photo which
`
`appeared to be a screenshot of a chat communication, believed to have been captured on or about
`
`March 21 , 2020 based on metadata, with an individual stored within OMBISl's iCloud Account
`
`under the contact name "Yoyo." The user of OMBISl's iCloud Account and Yoyo appear to be
`
`discussing the acquisition of shipping supplies, the creation of United States Postal Service
`
`("USPS") shipping accounts in the name of fictitious business account holders, and coordinating
`
`afterhours times to visit USPS faci lities. Specifically, the communication depicted in the photo
`
`consists of the following messages:
`
`Sender
`
`Message
`
`Ombisi's iCloud Account
`
`need to have enough boxes on hand for 100+
`
`Yoyo
`
`Yoyo
`
`orders
`
`Go ahead and create a new login for usps. Make up
`
`a business name and I'll walk you through it. Give
`
`me a few business names and I'll tell you if it's
`
`good ...
`
`You need to hit up post offices at night cuz you
`
`know it takes damn near 2 weeks for boxes
`
`Ombisi's iCloud Account
`
`Ok bet let me get to the house rn.
`
`6
`
`

`

`Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 7 of 9 PageID 8
`
`12.
`
`A review of the contact files stored within OMBISl's iCloud Account and a review
`
`of AT&T business records indicate that most recently the telephone number associated with
`
`"Yoyo" is registered to "Eric B. Russell, Jr."
`
`13.
`
`On May 27, 2020, the Honorable Charmiane G. Claxton, United States Magistrate
`
`Judge in the Western District of Tennessee, authorized a search of the iCloud account registered
`
`in the name "Eric Russell." Upon searching the account, Agents discovered a photo of a computer
`
`screen displaying an Empire Market security mnemonic phrase, which is a nine (9) word phrase
`
`needed to regain access to an Empire Market account in the event that a user cannot remember the
`
`account password and/or the private keys necessary to access the account. The photo depicts the
`
`phrase "2019 Empire Market" in the lower left corner. Empire Market was the marketplace on the
`
`darknet used by VENDOR-I to sell purported Adderall to undercover agents on three occasions,
`
`in November 2019, February 2020, and June 2020, in exchange for BTC.
`
`14.
`
`In addition, RUSSELL and OMBISI communicated about BTC, the currency used
`
`by undercover agents to purchase purported Adderall from VENDOR-I. On September 30, 2020,
`
`the Honorable Charmiane G. Claxton, United States Magistrate Judge in the Western District of
`
`Tennessee authorized a second search of the iCloud Account associated with "Kevin Ombisi."
`
`Agents discovered within OMBISl's iCloud Account a photo that appeared to be a screenshot of
`
`a chat communication with an individual stored within OMBISl's iCloud Account under the
`
`contact name "Big Bro." A review of the visible portion of this photo, believed to have been
`
`captured on or around September 18, 2020 based on metadata, appears to depict a computer task
`
`bar with icons that agents recognize as associated with the software for NordVPN 9 and Wickr.
`
`The subsequent text communication depicted appears to be from "Big Bro" discussing the creation
`
`of a new account for the conversion of cryptocurrency to fiat currency Specifically, the
`
`communication depicted in the photo consists of the following messages:
`
`9 NordVPN is a virtual private network (VPN) provider. VPNs encrypt and anonymize data on
`the internet, and can mask Internet Protocol (IP) addresses.
`
`7
`
`

`

`Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 8 of 9 PageID 9
`
`Big Bro
`
`Big Bro
`
`Big Bro
`
`Sender
`
`Message
`
`3rd floor appt 15320
`
`He said he need you to create a new local Bitcoin
`
`account
`
`He lost the trader that' s why he hasn 't been able to
`
`do deposits but he said he need them and he ' s
`
`weeks ...
`
`15.
`
`A review of the contact files stored within OMBISI's iCloud Account revealed a
`
`contact stored under the name Big Bro which is associated with the telephone number affiliated
`
`with "Eric B. Russell, Jr."
`
`16.
`
`Based on the above, I submit there is probable cause to believe that from on or
`
`about April 2019 until or around February 2021, KEVIN OMBISI and ERIC RUSSELL, JR.
`
`conspired to distribute methamphetamine, in violation of Title 21 , United States Code, Section
`
`846; and that KEVIN OMBISI unlawfully distributed methamphetamine, in violation of Title 21 ,
`
`United States Code, Section 841.
`
`WHEREFORE, deponent respectfully requests that a warrant be issued for the arrest of
`
`KEVIN OMBISI and ERIC RUSSELL, JR., the defendants, and that they be imprisoned or
`
`ba iled, as the case may be.
`
`PAUL W. COX, Special Agent
`Food and Drug Administration
`Office of Criminal Investigations
`
`Pursuant to Federal Rule of Criminal Procedure 41 ( d)(3), the undersigned judicial officer has on
`this date ?l,idered information communicated by [] telephone or [ ] other reliable electronic
`means or '/{oth, in reviewing and deciding whether to issue a search warrant. In doing so, this
`
`8
`
`

`

`Case 2:21-cr-20011-MSN Document 1-1 Filed 02/09/21 Page 9 of 9 PageID 10
`
`judicial officer has placedi ] fhe ffiant under oath and has confirmed by speaking personally with
`that the signatures on the search warrant application and affidavit
`the affiant on the telephone
`tH t the affiant has authorized the placement of the affiant' s
`are those of the affiant or
`signatures on the application and affidavit, the documents received by the judicial officer are a
`correct and comp lete copy of the documents submitted by the affiant, and the information
`contained in the search warrant application and affidavit are true and correct to the best of the
`affiant's knowledge.
`
`Sworn to and subscribed before me by telephone this !i_ day of February, 2021.
`/ )
`
`s/Tu M. Pham
`HONef md:Pru M. PHAM
`UNITED STATES MAGISTRATE JUDGE
`
`9
`
`