PREMISES TO BE SEARCHED

The parcel located at 1850 Bradcliff Way, Palmdale,

California 93551, containing a single family, two-story

residence with light tan stucco walls with white trim. The

front door is dark in color and located underneath a small porch

curtilage, mailboxes, trash containers, debris boxes, storage

lockers, locked containers and safes, cabinets, rooms, parked

vehicles, motorhomes, sheds, and outbuildings associated with

the premises and shall extend into desks, cabinets, safes,

briefcases, backpacks, wallets, purses, trash receptacles,

digital devices, and any other storage locations within the

premises.

1. The items to be seized are evidence, contraband,

fruits, or instrumentalities of violations of 21 U.S.C.

§§ 841(a)(1) (Manufacturing, Distribution of, and Possession

with Intent to Distribute, a Controlled Substance), 846 (Attempt

b. Firearms, ammunition, silencers, and other

dangerous weapons;

c. Items and paraphernalia for the manufacturing,

distributing, packaging, sale, or weighing of controlled

substances, including scales and other weighing devices, plastic

baggies, food saver sealing devices, heat sealing devices,

balloons, packaging materials, containers, and money counters;

d. United States currency in excess of $2,000,

money orders, wire transfers, cashier’s checks and receipts,

passbooks, cash cards, gift cards, checkbooks, check registers,

securities, precious metals including gold, jewelry, antique or

modem automobiles, bank statements and other financial

instruments, including stocks or bonds in amounts indicative of

the proceeds of illicit narcotic trafficking;

e. Records, documents, programs, applications and

records, and documents noting price, quantities, and/or times

when drugs were bought, sold, or otherwise distributed, whether

contained in hard copy correspondence, notes, emails, text

messages, photographs, videos (including items stored on digital

devices), or otherwise;

f. Global Positioning System (“GPS”) coordinates and

other information or records identifying travel routes,

destinations, origination points, and other locations;

motel and hotel receipts, passports and visas, credit card

receipts, and telephone bills

i. Indicia of occupancy, residency, and/or ownership

of the previously described property, premises, or vehicles, and

any other property, premises, or vehicles, including utility and

telephone bills, canceled mail, deeds, leases, rental

2. With respect to any digital device containing evidence

falling within the scope of the foregoing categories of items to

be seized:

a. evidence of who used, owned, or controlled the

device at the time the things described in this warrant were

created, edited, or deleted, such as logs, registry entries,

configuration files, saved usernames and passwords, documents,

browsing history, user profiles, e-mail, e-mail contacts, chat

c. evidence of the attachment of other devices;

iii

d. evidence of counter-forensic programs (and

associated data) that are designed to eliminate data from the

device;

e. evidence of the times the device was used;

f. passwords, encryption keys, biometric keys, and

other access devices that may be necessary to access the device;

i. records of or information about the device’s

Internet activity, including firewall logs, caches, browser

history and cookies, “bookmarked” or “favorite” web pages,

search terms that the user entered into any Internet search

engine, and records of user-typed web addresses.

3. As used herein, the terms “records,” “documents,”

“programs,” “applications,” and “materials” include records,

documents, programs, applications, and materials created,

digital assistants; wireless communication devices, such as

telephone paging devices, beepers, mobile telephones, and smart

phones; digital cameras; gaming consoles (including Sony

PlayStations and Microsoft Xboxes); peripheral input/output

devices, such as keyboards, printers, scanners, plotters,

monitors, and drives intended for removable media; related

communications devices, such as modems, routers, cables, and

thereof), law enforcement personnel executing this search

warrant will employ the following procedure:

a. Law enforcement personnel or other individuals

assisting law enforcement personnel (the “search team”) will, in

their discretion, either search the digital device(s) on-site or

seize and transport the device(s) and/or forensic image(s)

thereof to an appropriate law enforcement laboratory or similar

facility to be searched at that location. The search team shall

b. The search team will conduct the search only by

using search protocols specifically chosen to identify only the

specific items to be seized under this warrant.

i. The search team may subject all of the data

contained in each digital device capable of containing any of

the items to be seized to the search protocols to determine

normal operating system files and standard third-party software

that do not need to be searched.

iii. The search team may use forensic examination

and searching tools, such as “EnCase” and “FTK” (Forensic Tool

Kit), which tools may use hashing and other sophisticated

techniques.

c. If the search team, while searching a digital

device, encounters immediately apparent contraband or other

d. If the search determines that a digital device

does not contain any data falling within the list of items to be

seized, the government will, as soon as is practicable, return

the device and delete or destroy all forensic copies thereof.

e. If the search determines that a digital device

does contain data falling within the list of items to be seized,

device, but may not access data falling outside the scope of the

other items to be seized (after the time for searching the

device has expired) absent further court order.

g. The government may also retain a digital device

if the government, prior to the end of the search period,

obtains an order from the Court authorizing retention of the

device (or while an application for such an order is pending),

including in circumstances where the government has not been

vii

DTO and after searching two residences used in furtherance of

the criminal scheme, seized approximately 120 pounds of

methamphetamine, 30,000 pills of suspected MDMA, and five

firearms. Based on further investigation from that search,

agents have identified BERMUDEZ as one of the sources of supply

of methamphetamine to the STEALTHGOD DTO. BERMUDEZ has resided

investigators, evidence of drug trafficking is expected to be

shut down Wall Street Market in 2019.

b. “Vendors” are the dark web’s sellers of goods and

services, often of an illicit nature, and they do so through the

creation and operation of “vendor accounts.”

c. The “Tor network,” or simply “Tor,” is a special

network of computers on the Internet, distributed around the

world, that is designed to conceal the true Internet Protocol

(“IP”) addresses of the computers accessing the network, and,

thereby, the locations and identities of the network’s users.

Tor likewise enables websites to operate on the network in a way

individual is involved in drug trafficking or the distribution

of other illegal items. Individuals intending to purchase

illegal items on Wall Street Market-like websites need to

purchase or barter for Bitcoins.

e. When vendors receive orders for narcotics on the

darknet, the orders can come from anywhere in the world; vendors

are known to use U.S. mail and/or commercial carriers to

distribute narcotics.

f. Vendors operate akin to traditional drug

trafficking organizations, with sources of supply (who provide

monikers were affiliated with each other based on the

advertisements and comments on darknet forums. Agents conducted

undercover purchases of drugs, including methamphetamine, from

some of these vendor monikers. These vendors sent drugs hidden

in items such as puzzle boxes and health and wellness products.

12. In connection with this investigation, on February 10,

2020, the Honorable Jacqueline Chooljian, United States

Magistrate Judge, authorized search warrants for two locations

in the Central District of California associated with the

NRU539 and GMZ799.

d. 60 packaged and sealed USPS priority mail

envelopes addressed to various addresses, in over 35 states

across the country, that were later discovered to contain drugs,

including a crystalline like substance that yielded a

presumptive positive for the presence of methamphetamine, orange

triangle and square shaped pills that yielded a presumptive

positive for the presence of MDMA, Orange circle shaped pills

marked “AD30” that yielded a presumptive positive for the

presence of methamphetamine, a brown tar-like substance

transactions.

c. Between February 9 and 10, 2020, Chavez and the

BERMUDEZ phone exchanged the following messages:

Chavez: Hay buddy I need another 30

BERMUDEZ phone: Okay Let me see

Chavez: Can you try to get at 950 brother

BERMUDEZ phone: Yo what’s good mark , my boy just

Chavez: Yes I’ll be ready at 8

additional 40 pounds of methamphetamine (“I got another 40”). I

further believe, based on the context of this message, that this

was the approximately 40 pounds that investigators seized from

the Stoa residence on February 11, 2020.

20. On January 30, 2020, the Honorable Alexander F.

MacKinnon, United States Magistrate Judge, authorized a

continued warrant for the disclosure of prospective cell-site

and GPS information for the Chavez phone. On March 10, 2020,

obtained the drugs in connection with Melkom for sale on the

dark web.

h. It is common for drug traffickers to own multiple

phones of varying sophistication and cost as a method to

diversify communications between various customers and

suppliers. These phones range from sophisticated smart phones

using digital communications applications such as Blackberry

Messenger, WhatsApp, and the like, to cheap, simple, and often

prepaid flip phones, known colloquially as “drop phones,” for

actual voice communications.

i. When drug traffickers deal with significant

quantities of drugs, such as methamphetamine, they may also

as keyboards, printers, scanners, monitors, and drives; related

communications devices, such as modems, routers, cables, and

connections; storage media; and security devices.

remnants of such files months or even years after the files have

been downloaded, deleted, or viewed via the Internet. Normally,

when a person deletes a file on a computer, the data contained

in the file does not disappear; rather, the data remain on the

hard drive until overwritten by new data, which may only occur

after a long period of time. Similarly, files viewed on the

Internet are often automatically downloaded into a temporary

directory or cache that are only overwritten as they are

replaced with more recently downloaded or viewed content and may

also be recoverable months or years later.

software on a device may be necessary to rebut a claim that the

device was being controlled remotely by such software.

d. Digital device users can also attempt to conceal

data by using encryption, steganography, or by using misleading

filenames and extensions. Digital devices may also contain

“booby traps” that destroy or alter data if certain procedures

are not scrupulously followed. Law enforcement continuously

develops and acquires new methods of decryption, even for

devices or data that cannot currently be decrypted.

38. Based on my training, experience, and information from

average file size (300kb) Word documents, or 614 photos with an

average size of 1.5MB.

39. The search warrant requests authorization to use the

biometric unlock features of a device, based on the following,

which I know from my training, experience, and review of

publicly available materials:

a. Users may enable a biometric unlock function on

some digital devices. To use this function, a user generally

displays a physical feature, such as a fingerprint, face, or

eye, and the device will automatically unlock if that physical

law enforcement personnel to, with respect to any device that

appears to have a biometric sensor and falls within the scope of

the warrant: (1) depress BERMUDEZ’s thumb- and/or fingers on the

device(s); and (2) hold the device(s) in front of BERMUDEZ’s

face with his or her eyes open to activate the facial-, iris-,

and/or retina-recognition feature.

40. Other than what has been described herein, to my

knowledge, the United States has not attempted to obtain this

data by other means.