You are on page 1of 28

Case

AO 106 (Rev. 04/10) 3:18-mj-05776-RAM


Application for a Search Warrant Document 1 Filed 11/08/18 PageID.1 Page 1 of 28

UNITED STATES DISTRICT C


for the
Southern District of California

In the Matter of the Search of )


(Briefly describe the property to be searched )
or identi.fY the person by name and address) ) Case No.
brown and tan camouflage backpack )
)
)
18MJ5776
APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identi.fY the person or describe the
and give its location):

located in the Southern District of California , there is now concealed (identi.fY the
person or describe the property to be seized):
Attachment B

The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):
of a crime;
fruits of crime, or other items illegally possessed;
designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 U.S.C. § 1956(a)(3) laundering of monetary instruments
18 U.S.C. § 1960(a) operation of unlicensed money transmitting business
18 U.S.C. § 1343 wire fraud

The application is based on these facts:


See attached affidavit (incorporated by reference).

J Continued on the attached sheet.


0 Delayed notice of days (give exact ending date if more than 30 days: _ _ _ _ _ )is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Nick Jones, Special Agent, HSI


Printed name and title

Sworn to before me and signed in my presence.

Date: \\-
Judge's signature

City and state: San Diego, California Robert A. McQuaid, U.S. Magistrate Judge
Printed name and title
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.2 Page 2 of 28

Attachment A-3
1
2 LOCATION TO BE SEARCHED
3
The location to be searched is a brown and tan camouflage backpack, with black
4
patch, stating "Stealth Angel" belonging to Morgan Rockcoons that was detained on
5
October 28, 2018, and is currently in the possession of the Department of Homeland
6
Security, San Diego Cyber Crimes Group.
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.3 Page 3 of 28

ATTACHMENT B
1
2
3
The items to be seized include certain items, documents, and records relating to
4
violations of 18 U.S.C. § 1956(a)(3) (laundering of monetary instruments); 18 U.S.C. §
5
1960 (prohibition of unlicensed money transmitting business); and 18 U.S.C. § 1343
6
(wire fraud), including:
7
8
1. Proceeds of money laundering, operating an unlicensed money transmitting
9
business, and wire fraud, including: evidence of cash, bitcoin, other virtual
10
currencies, and including passwords for access to virtual currency storage and
11
accounts, such as digital wallets and electronic lock boxes;
12
13
2. Records relating to the operation of an unlicensed money transmitting business,
14
including: records of the exchange of currencies for virtual currencies, records
15
regarding customers of an unlicensed money transmitting business, advertising and
16
materials for unlicensed money transmitting business;
17
18
3. Financial records relating to virtual currency transactions, including: bank account
19
records, bitcoin address information, wire transfer or money transfers records,
20
records regarding the purchase or exchange of virtual currencies, records
21
regarding the use of pre-paid debit or credit card accounts, records or account
22
information regarding virtual currency exchange platforms and associated services;
23
24
4. Records relating to the website Localbitcoins.com, including profile information,
25
transactional records, and records regarding communications occurring via that
26
platform;
27
28
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.4 Page 4 of 28

5. Records of correspondence or communications conducted in the course of


1
operating an unlicensed money transmitting business; or regarding money
2
laundering transactions; or regarding real estate purchases, sales, and development
3
in Elko County, Nevada, including the recording or transfer of deeds.
4

5
6. Records relating to any co-conspirators or any individuals involved in or with
6
knowledge of the activities described herein;
7
8
7. Records tending to provide context to, or custody and control of, any responsive
9
communications, records, and attachments described above, such as electronic mail
10
sent or received in temporal proximity to a relevant communication or record and
11
any communication or record tending to identify the user(s) of the electronic
12
13 devices to be searched;

14
8. Records relating to the dominion and control of the seized electronic device(s);
15
16
Which are evidence of violations of 18 U.S.C. § 1956 (money laundering), 18 U.S.C. §
17
1960 (Prohibition of unlicensed money transmitting business), and 18 U.S.C. § 1343
18
(wire fraud). As used above, the term "records" includes all of the foregoing items of
19
evidence in whatever form and by whatever means they may have been created or stored
20
21 and any form of electronic or computer storage.

22
23
24
25
26
27
28
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.5 Page 5 of 28

AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANTS


1
I, Nick Jones, Special Agent with the Department of Homeland Security ("DHS"),
2
Homeland Security Investigations ("HSI"), being duly sworn, hereby depose and state as
3
follows:
4
INTRODUCTION
5
1. I make this affidavit in support of applications for issuance of search warrants,
6
pursuant to Rule 41 of the Federal Rules of Criminal Procedure, for:
7
a. Samsung tablet (serial number: R52JAOJ2KJN) belonging to Morgan
8
Rockcoons (further described in Attachment A-1);
9
b. black Google cellular telephone belonging to Morgan Rockcoons (further
10
described in Attachment A-2); and
11
c. brown and tan camouflage backpack belonging to Morgan Rockcoons
12
(further described in Attachment A-3).
13
2. The purpose of the search warrants is to seize items, more fully described in
14
Attachment B, that constitute evidence and fruits of federal crimes, including: 18 U.S.C.
15
§ 1343 (laundering of monetary instruments with the intent to conceal the nature, location,
16
source, ownership, or control of property believed to be the proceeds of specified unlawful
17
activity); 18 U.S.C. § 1960 (prohibition of unlicensed money transmitting business); and
18
18 U.S.C. § 1343 (wire fraud).
19
3. The facts set forth in this affidavit are based on my own personal knowledge;
20
knowledge obtained from other individuals during my participation in this investigation,
21
including other law enforcement officers; my review of documents and computer records
22
related to this investigation; communications with others who have personal knowledge
23
of the events and circumstances described herein; and information gained through my
24
training and experience. Because this affidavit is submitted for the limited purpose of
25
establishing probable cause in support of the applications for search warrants, it does not
26
27
AFFIDAVIT IN SUPPORT OF APPLICATIONS
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.6 Page 6 of 28

1 set forth each and every fact that I or others have learned during the course of this
2 investigation.
3 4. I am a Special Agent employed by United States Immigration and Customs
4 Enforcement, Homeland Security Investigations (HSI) and have been so employed since
5 2004. I am currently assigned to HSI' s San Diego Cyber Crimes Group. My current
6 responsibilities include the investigation of cybercrimes, including virtual currency money
7 laundering and unlicensed money transmitting businesses specializing in the exchange of
8 virtual currencies. I have a Bachelor of Arts Degree in Political Science from the
9 University of California, Los Angeles. I am a graduate of the Criminal Investigator
1O Training Program and the Immigration and Customs Enforcement Special Agent Training
11 Program at the Federal Law Enforcement Training Center. I have completed Network+
12 and Global Information Assurance Certification Security Essentials Certification (GSEC)
13 training. Based on this training and experience, I am familiar with the manner in which
14 persons engaged in cybercrimes operate; the manner in which cybercrimes are perpetrated;
15 certain techniques, methods, or practices commonly used by persons engaged in
16 cybercrime activity; and indicia of cybercrime activity. This training and experience
17 forms the basis for opinions I express below.
18 STATEMENT OF PROBABLE CAUSE
19 Summary
20 5. Morgan Rockcoons operated a bitcoin exchange business in San Diego,
21 selling bitcoin to individuals that he met through the Internet. Rockcoons is not registered
22 to conduct this business as required by law. Accrodingly, on or about November 8, 2017,
23 a federal grand jury in San Diego, California, returned a two-count indictment against
24 Morgan Rockcoons (docket no. l 7-cr-3690-AJB), charging him with (i) laundering of

25 monetary instruments, in violation of 18 U.S.C. § 1956(a)(3); and (ii) operation of


26 unlicensed money transmitting business, in violation of 18 U.S.C. § 1960(a). Rockcoons
27 was arrested on these charges in February 2018 and was released on bond. While on

28 pretrial release, Rockcoons hatched a land fraud scheme, purporting to sell land in Elko
2
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.7 Page 7 of 28

1 County, Nevada that Rockcoons did not own. As a result, the grand jury returned a
2 superseding indictment adding four counts of wire fraud in violation of 18 U.S.C. § 1343.
3 Rockcoons was arrested on the new charges on October 28, 2018. At the time of his arrest,
4 Rockcoons was in possession of a Black, 16 GB, Samsung tablet (serial number:
5 R52JAOJ2KJN); a Black, Google cellular telephone; and a brown and tan camouflage
6 backpack, with black patch, stating "Stealth Angel." I seek authorization to search those
7 items.
8 Overview of Bitcoin
9 6. Based on my training and experience, I know that bitcoin is a digital, or
1O "virtual," currency that exists entirely on the Internet and not in any physical form. No
11 government, bank, or company generates bitcoin. Instead, computer software operating
12 on a decentralized "peer-to-peer" network generates and controls the digital currency. To
13 acquire bitcoin, a user typically must purchase the currency from a bitcoin exchanger.
14 Bitcoin exchangers generally accept payments of conventional currency and, in return for
15 a commission, transfer a corresponding number of bitcoin, based on a floating exchange
16 rate, to a bitcoin address designated by the customer. A bitcoin address is analogous to a
17 bank account number, designated by a complex string of letters and numbers. Further,
18 based on my training and experience, I know that persons operating as unlicensed money
19 transmitters, offering bitcoin exchange services, will facilitate their activities utilizing
20 computers, electronic tablets, and smart phones. Computers, tablets, and smart phones are
21 vital in conducting the transfer ofbitcoins from one person to another or from one address
22 to another, because, as noted, bitcoin exists entirely on a digital network.
23 Initiation of Investigation
24 7. In September 2015, I learned that San Diego-based bitcoin exchangers were

25 advertising their services on the website Localbitcoins.com. My review of persons listing

26 their services on this website revealed that the most prolific San Diego-based seller at the

27 time went by the nickname "Metaballo," and advertised his services as both a trader and

28 a seller of bitcoin. I reviewed Metaballo's Localbitcoins.com profile, discovering that it


3
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.8 Page 8 of 28

1 indicated that between January 2013 and September 2015, he had conducted more than
2 100 transactions on Localbitcoins.com and that he operated out of San Diego, Yuba City,
3 Upper Lake, and Sacramento, California. His profile listed a website, www.kinetics.cc.
4 8. Also in September 2015, I reviewed Metaballo's website and found Facebook
5 pages for Kinetics.cc and Metaballo. The Kinetics Facebook page included a post, dated
6 July 11, 2014, which read: "Dear bitcoin community, my name is Morgan Rockwell, I am
7 CEO of Bitcoin Kinetics Inc. I created the first Bitcoin operated service machine to allow
8 Bitcoin to be used in the real world in all machines and businesses. We are rapidly
9 expanding and growing into new territories, industries into a competitive and profitable
10 environment." Metaballo's Facebook page included posts identifying Morgan Rockwell
1
11 as Morgan Rockcoons. This Facebook page also contained a post, dated January 15,
12 2014, stating, "Metaballo on Localbitcoins.com buy and sell bitcoins with trader
13 Metaballo."
14 9. In April 2016, I again reviewed Rockcoons' s Localbitcoins.com profile,
15 which showed that he continued to advertise as a trader and seller of bitcoin in San Diego,
16 with his profile reflecting that he had engaged in more than 500 transactions and
17 describing him as a professional trader. In March 2017, Rockcoons's Localbitcoins.com
18 profile reflected that he was also offering bitcoin exchanging services in Las Vegas,
19 Nevada. In October 2017, I again reviewed ROCKCOON's LocalBitcons.com profile,
20 which showed that as of October 201 7, Rockcoons' s profile indicated that he conducted
21 more than 1,000 bitcoin trades with more than 644 people.
22 10. In September 2015, April 2016, and again in October 2017, I confirmed that
23 neither Rockcoons nor any of his companies were registered as a money services business
24 with the U.S. Department of Treasury as required under federal law.
25 II
26
At some point, Rockcoons decided to change his legal last name by merging his
27
father's last name, Rockwell, with his mother's last name, Coons. For much of his life,
28 however, he went by his given name of Morgan Rockwell.
4
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.9 Page 9 of 28

1 Undercover Investigation
2 11. In December 2016, I, acting in an undercover capacity as a person named
3 "Nima," left a voice message with Rockcoons (at (619) 721-3384, the number posted by
4 Rockcoons on his profile on Localbitcoins.com). I requested his service in exchanging
5 cash to bitcoin. In subsequent text message conversations, Rockcoons explained to me
6 that he was aware of and followed anti-money laundering and know your customer
7 requirements. Rockcoons also informed me of the currency transaction reporting
8 requirement, stating that if I engaged in a transaction in excess of $10,000 USD cash,
9 information about me would have to be obtained. In the course of this early exchange of
10 text messages, Rockcoons provided me with Rockcoons's full name as "Morgan
11 Rockwell," and further provided his legal name as "Morgan Rockcoons." Rockcoons also
12 provided me with his Localbitcoins.com profile as proof that Rockcoons exchanged
13 between 3 0 and 60 bitcoins per week.
14 12. In a text message, I informed Rockcoons in my undercover capacity that I was
15 engaged in the manufacture of butane hash oil (a Schedule I controlled substance). I
16 further informed Rockcoons that the $14,500 in cash that I wanted to exchange into bitcoin
17 were the proceeds of the manufacture of hash oil. I informed Rockcoons that the cash was
18 being exchanged to bitcoin to buy an extraction device, which would be used to increase
19 my hash oil manufacturing capacity. In text messages, Rockcoons made multiple

20 statements to me that indicated that Rockcoons was knowledgeable about butane hash oil.

21 Rockcoons also told me that he operated a business engaged in the sale of marijuana and

22 hash oil in San Francisco. Rockcoons offered to assist me in selling the hash oil that I

23 manufactured. Rockcoons wrote that he wanted to be the "Steve Jobs" of "Cannabis and

24 bitcoin," and that he had provided currency exchange services to other marijuana industry

25 individuals and entities.


26 13. Also in December 2016, in a text message, I told Rockcoons that, because I

27 was engaged in the manufacture and sale of hash oil, I did not want to provide any

28 identifying information in connection with my exchange of $14,500 cash for bitcoin.


5
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.10 Page 10 of 28

1 Rockcoons responded that he understood and suggested that I could break up the
2 transaction over two days, each transaction being less than $10,000 USD, to avoid the
3 currency transaction reporting requirement. Rockcoons later completely abandoned the
4 requirement of making me break up the transaction into two separate transactions,
5 accepting all $14,500 from me in one transaction, and not requiring any identifying
6 information from me. Rockcoons did not file a currency transaction report.
7 14. On December 30, 2016, as instructed by Rockcoons, I sent Rockcoons
8 $14,500 cash concealed in a FedEx package for the purpose ofRockcoons exchanging it
9 to bitcoin. On January 3, 2017, the package was delivered to Rockcoons, which
10 Rockcoons confirmed to me via text message.
11 15. On January 8, 2017, in exchange for the $14,500 in cash that I sent to him,
12 Rockcoons transferred 9 .998 bitcoins to a bitcoin address at my direction, with an
13 equivalent value of $9,208.62. Rockcoons charged a fee of $5,291.38 (more than thirty-
14 six percent) for conducting the exchange.
15 16. In June 2017, I introduced a second undercover persona to Rockcoons named
16 "Chris." At the time, Rockcoons was looking for people to invest in his marijuana
17 distribution business in Las Vegas. On June 15, 2017, I, posing as Chris, met with
18 Rockcoons at the Gold Spike, 217 Las Vegas Blvd North, Las Vegas, Nevada. I arrived
19 at the Gold Spike early and sat in the lobby. I then observed Rockcoons exit an elevator

20 within the Gold Spike. I recognized Rockcoons from his California Department of Motor

21 Vehicles photograph. The meeting was arranged by Rockcoons using the same phone

22 that he used to send the texts detailed in this affidavit. In the course of the meeting,

23 Rockcoons told me that he resided at the Gold Spike and that he had signed a one-year

24 lease to live there. Rockcoons also told me that he had been very busy the prior night

25 trading bitcoins into the late hours of the night. Also during the meeting and in subsequent

26 text messages, Rockcoons described his involvement in the exchanging of bitcoin as well

27 as his marijuana and marijuana concentrates activities. Rockcoons described his bitcoin

28 activities in a text message to me as, "I'm a professional money manager and mover of
6
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.11 Page 11 of 28

1 funds without personal identification information attached to the funds or equity. This is
2 my speciality [sic]."
3 Interview of Rockcoons
4 17. Based on my ongoing undercover communications with Rockcoons, I knew
5 that Rockcoons planned to be at the Coffee Bean and Tea Leaf on West Broadway in San
6 Diego on August 30, 2017. Another HSI special agent and I approached Rockcoons at the
7 cafe, identified ourselves, and asked Rockcoons if he was willing to speak with us about
8 Rockcoons' s bitcoin business. Rockcoons agreed.
9 18. Rockcoons admitted that for the past nine years, his sole source of income has
1O been from fees charged for the buying and selling of bitcoin for different customers. He
11 estimated that he had conducted transactions with third parties totaling 10,000 bitcoin (as
12 of August 1, 201 7, one bitcoin traded for $4, 73 8). Rockcoons explained that he advertises
13 his bitcoin exchange business on Localbitcoins.com. He said that he meets people on this
14 website and then meets them in person to conduct the exchange. Rockcoons admitted that
15 he conducted thousands of bitcoin transactions with customers he met on
16 Localbitcoins.com. Rockcoons said that he charges his customers between 10 to 20
17 percent commission and that he conducts about 5 to 10 transactions per day.
18 19. Rockcoons acknowledged that his business constitutes a money services
19 business. He also admitted that when he conducts an exchange in which he receives more
20 than $10,000, he is required to fill out a currency transaction report (CTR). Rockcoons
21 said that he has never filed a CTR. He also said that he never asked for a customer's
22 identity, even though he knew that he should, because he did not want to risk losing
23 customers. He admitted that he should have had an anti-money laundering program and
24 that he should have followed know your customer practices but did not. Rockcoons told
25 me that he had various business records regarding his operation of his unlicensed money
26 transmitting business at his residence in Las Vegas.
27 II
28
7
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.12 Page 12 of 28

1 Indictment
2 20. On or about November 8, 2017, a federal grand jury sitting in San Diego,
3 California, returned a sealed two-count indictment against Rockcoons (docket no. 17-cr-
4 3690-AJB), charging him with (i) laundering of monetary instruments, in violation of 18
5 U.S.C. § 1956(a)(3); and (ii) operation of unlicensed money transmitting business, in
6 violation of 18 U.S.C. § 1960(a). Pursuantto 18 U.S.C. § 982, the indictment also includes
7 forfeiture allegations, seeking the forfeiture of any property involved in the charged
8 offenses, property traceable to such property, or property up to the value of property
9 subject to forfeiture.
1O First Arrest of Rockcoons/Conduct on Pre-Trial Release
11 21. On February 9, 2018, law enforcement arrested Rockcoons at the Palms Hotel
12 in Las Vegas, Nevada, where he was staying. Rockcoons was arraigned on the indictment
13 on February 22, 2018, and he was released on bond on about March 15, 2018.
14 22. While on pretrial release, Rockcoons has been committing land fraud,
15 purporting to sell parcels ofland in the Nevada desert as part of a development he is touting
16 as "Bitcointopia." As part of this scheme, Rockcoons has "sold" (that is, accepted payment
17 for) more land than he owns. In addition, Rockcoons has lulled a victim with false
18 statements to induce him to not seek a refund of his payment.
19 Bitcointopia
20 23. In spring 2018, Rockcoons began promoting Bitcointopia on the Internet at
21 www.bitcointopia.org, a website that was registered by Rockcoons. A purported real estate
22 development in the desert in Elko County, Nevada, Rockcoons touted Bitcointopia as a
23 place where bitcoin is "legal tender." Rockcoons described Bitcointopia as "the capital of
24 a newly formed nation run by Bitcoin appropriations, Blockchain voting & BIP based
25 laws." The website listed contact telephone number (619) 721-3384 (the same number
26 that Rockcoons used to communicate with me as an undercover agent conducting the
27 earlier money laundering investigation detailed above) and the contact email
28 land@bitcointopia.org.
8
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.13 Page 13 of 28

1 24. On the website, Rockcoons offered parcels of land for sale, claiming: "The
2 land is currently owned by Bitcointopia, Inc corporation" and that "500-1000 Acre plots
3 are for sale for 0.5 BTC per acre." As detailed below in paragraph 30, Bitcointopia, Inc.
4 owns only about 5 acres of land in Elko County, Nevada.
5 Victim 4
6 25. In June 2018, Victim 4, a San Diego resident, visited bitcointopia.org and
7 learned that he could purchase one acre of land for .5 bitcoin (one bitcoin is currently
8 worth about $6,400). Reviewing the website, Victim 4 learned that "[r]unning water is
9 provided by a brand new water pump" and that "500 Acres of Solar Panels are being
1O installed to build a local power grid."
11 26. Victim 4 wished to buy land as detailed on the website. Accordingly, on June
12 26, 2018, Victim 4 communicated with Rockcoons via Rockcoons' Twitter account
13 "nodefather". 2 Rockcoons wrote, "You let me know when your ready. Need: Legal Name
14 Name of property TXID of BTC payment Email to land@bitcointopia.org." ["TXID"
15 means transaction i.d. Rockcoons was explaining to Victim 4 that once he paid for the
16 land with bitcoin, he should send the transaction i.d. to land@bitcointopia.org to prove
17 that payment had been made.]
18 27. On June 27, 2018, Victim 4 visited the Bitcointopia website and pressed the
19 button "BUY LAND" to conduct the transaction. Pushing that button, Victim 4 arrived at
20 a screen that directed him to "Send BTC Payment Here to Verified Addresses" and listed
21 two addresses where payment could be sent. The same page stated, "Please provide 4-6
22 weeks for you land deed & city contract to arrive." Victim 4 sent .5 bitcoin to the listed
23 bitcoin address as directed. Victim 4 then sent an email to land@bitcointopia.org with his
24 legal name (for the deed) and the transaction identification confirming that he sent
25
26
2 Rockcoons has been established as the user of the nodefather Twitter account,
27
because (i) he uses his own photo for the profile, and (ii) he uses this account to
28 comment on the pending prosecution against him (17cr3690-AJB).
9
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.14 Page 14 of 28

1 payment. Rockcoons confirmed via Twitter direct message (from his node father account)
2 that he received this email and the payment.
3 28. On June 28, 2018, Victim 4 received an email from land@bitcointopia.org.
4 The email was from: "Bitcointopia Inc Founder - Morgan Rockwell 4160 South Pecos
5 Road, Las Vegas NV 89121 6504279098 land@bitcointopia.org." Rockcoons wrote:
6
thank for your purchase of land! Your payment, once confirmed will be logged
7 with your information, including your name, the name of your property & your
TXID on the Bitcoin Blockchain to record your payment. The information is
8
transferred to the county recorder and put into public records within 2 months or
9 less.
10
Please allow for 4-6 weeks for the deed to be filed and mailed out with the
11 accompanying City Plan Contract. This contract states that Bitcointopia Inc will
pay the first 5 years of annual land taxes, then those taxes become your
12
responsibility after 5 years. City Services are provided on the contingency of this
13 contract being agreed to & signed by your Bitcoin
14 transaction and signature on paper.

15 You will then be able to come do what you want with your land, such as camp,
bring an RV, build a home or start a business. We will be building the city grid
16
around all these plots to bring city services to your land, city services will be
17 protected to be available by late 2019.
18
We want to thank you for your support of the Bitcointopia Expansion Project and
19 helping start the Bitcointopia City. Your purchase of land helps fund the
construction of the city and the development of Bitcointopia into the future. If
20
you have any questions or want to come to see the land at any time, just message
21 us and we will accommodate you.
22 Thank you for your support & purchase.
23 29. Thereafter, Victim 4 continued to communicate with Rockcoons via Twitter,
24 email, and a messaging platform called Telegram. On July 20, 2018, Victim 4 asked
25 Rockcoons via Telegram about the status of the deed for the property he purchased on
26 June 27, 2018: "Any timeline for deeds?" Rockcoons replied, "will be sometime in Aug
27 for deed, submitted it June 29, so takes minimum of 6-8 weeks for county to record."
28
10
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.15 Page 15 of 28

1 Later on the same day, Rockcoons wrote to Victim 4, "I know you purchased land and
2 you might have trust issues like all Bitcoin users do especially with me."
3 30. By early August 2018, Victim 4 still had not received his deed, and he
4 participated in online forums that discussed Rockcoons and shared derogatory information
5 about him. On August 2, 2018, Rockcoons messaged Victim 4 from his nodefather
6 Twitter account and wrote that he had "no problem giving you refund if you don't want
7 to participate in our new city." Victim 4 replied on the same day, "If I wanted a refund,
8 when would that be processed?" Rockcoons asked, "Is that what you want?" and Victim
9 4 replied, "I'm simply asking what that process would look like." Rockcoons wrote, "I
10 did submit your deed to the county, so I'd have to pay the taxes and transfer title to
11 company name and then once that title has Bitcointopia name on the deed I'd just send
12 BTC back, it's not very fast takes about 3 weeks to get a response from the county, it's
13 like selling the land all over again." As detailed below in paragraph 31, this statement
14 was false, as Rockcoons never filed a deed on behalf Victim 4. Based on my training and
15 experience and my involvement in this investigation, I believe that Rockcoons made this
16 false representation to lull Victim 4 into not seeking a refund for his land purchase and to
17 dissuade Victim 4 from contacting law enforcement.
18 Elko County Records Office
19 31. Investigation at the Elko County, Nevada Records Office established that
20 Bitcointopia Inc. owns two parcels of land. 3 Specifically, on May 22, 2018, Bitcointopia
21 Inc. bought parcel 024-001-001 (2.9 acres) for $2,300 and parcel 024-032-004 (2.070
22 acres) for $1,999. The parcels are not contiguous. There is no record that any other name
23 or entity associated with Rockcoons owns any land in Elko County.
24 32. Records checks confirmed that other than the two parcels noted above, there
25 have been no deeds of sale or transfer, or requests to transfer or sell any land by Rockcoons
26 or any other name or entity associated with him.
27
The deeds for Bitcointopia Inc.' s two parcels of land list Rockcoons' telephone
3

28 number wallet(619) 721-3384 as contact information.


11
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.16 Page 16 of 28

1 Victims 1-3
2 33. As noted above in paragraph 26, on the Bitcointopia.org land purchase page,
3 land purchasers are directed to send payment to one of two wallet addresses. Analysis of
4 the blockchain for those wallets indicates that from May 5, 2018, through July 28, 2018,
5 the wallets received about 36 transfers for a combined total of more than 12 bitcoins with
6 an approximate value of $95,856. Of these transfers, 12 transfers were .5 bitcoin
7 (consistent with the sale of 1 acre of land) and 13 transfers were .1 bitcoin (at one point,
8 Rockcoons was offering 1,4 acre in Bitcointopia for .1 bitcoin).
9 34. Investigation has identified three other victims of Rockcoons' land-fraud
1O scheme who were willing to speak with agents:
11 a. On May 18, 2018, Victim 1, relying on the representations on
12 bitcointopia.org, paid 1.6 bitcoin for a 3 acre parcel in Bitcointopia. As of November
13 7, 2018, Victim 1 still had not received a deed for the purchased land.
14 b. On June 1, 2018, Victim 2, relying on the representations on
15 bitcointopia.org, paid .2 bitcoin for a .5 acre parcel in Bitcointopia. As ofNovember 7,
16 2018, Victim 2 still had not received a deed for the purchased land.
17 c. On June 17, 2018, Victim 3, relying on the representations on
18 bitcointopia.org, paid 1.6 bitcoin for a 3.25 acre parcel in Bitcointopia As of November
19 7, 2018, Victim 3 still had not received a deed for the purchased land.
20 35. The land purchased by Victims 1-3 between May 2018 and June 17, 2018,
21 totaled 6. 75 acres ofland. Bitcointopia Inc only owns about 5 acres ofland in Elko County,
22 Nevada. When the San Diego victim purchased 1 acre of land on June 27, 2018,
23 Bitcointopia had no more land to sell.
24
Superseding Indictment/Arrest of Rockcoons/Detention of Laptop, Cell Phone, and
25
Portable Drive
26
27 36. On October 24, 2018, a Grand Jury in the Southern District of California

28 returned a Superseding Indictment in case no. 17cr3690-AJB adding four counts of wire
12
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.17 Page 17 of 28

1 fraud in violation of 18 U.S.C. § 1343 against Rockcoons in connection with his


2 Bitcointopia scheme described above. The Court issued an arrest warrant.
3 37. On October 28, 2018, Rockcoons was arrested in Chula Vista, California. At
4 the time of his arrest, Rockcoons had the following items in his possession: a Black, 16
5 GB, Samsung tablet (serial number: R52JAOJ2KJN); a Black, Google cellular telephone;
6 and a brown and tan camouflage backpack, with black patch, stating "Stealth Angel."
7 Before taking the backpack into custody, and with Rockcoons' consent, I asked
8 Rockcoons if there was anything of value in the backpack. Rockcoons identified the
9 Samsung tablet and a "pearl" and a "ruby". The two stones were put in an evidence bag,
10 and the tablet was taken into custody. I also verified that there were no weapons in the
11 backpack. During this process, I observed that there were documents in the backpack,
12 which I did not review.
13 Training and Experience Regarding Transactional Records and Computer
14 Evidence

15 38. In my experience and training, individuals involved in operating unlicensed


16 money transmitting businesses and real estate development schemes maintain
17 transactional records on electronic media, such as laptop computers, desktop computers,
18 electronic tablets, mobile phones, and portable drives for long periods of time. Based on
19 the investigation to date, the unlicensed money transmitting, money laundering , and wire
20 fraud activities, as outlined above, were facilitated by utilizing a computer and/or other
21 electronic devices, including telephones.
22
39. With today's advanced technology, which includes cloud-based computing,
23
large storage devices, and automated backup systems, electronic evidence can persist for
24
long periods of time with or without the user's knowledge. The nature of some storage
25
devices, such as hard disk drives, allows recovery of data that have been deleted by the
26
user. As storage devices increase in size, the chances of successful recovery also tends to
27
increase, because the odds that deleted data being overwritten by fresh data diminishes.
28
13
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.18 Page 18 of 28

1 40. Computer evidence can also persist if a user switches to a different computing

2 device. One example is the use of a service provided by Apple called "iCloud," which
3 syncs data across multiple user devices. With this technology, a file created or modified
4 on one particular device will be synchronized to appear on all the user's devices. Many
5 users employ iCloud or similar services to move data from an old device to a new device
6 (sometimes called data "migration").
7
41. Based on my communications with Rockcoons, I know that he is very
8
knowledgeable about computers, even authoring computer code. Sophisticated computer
9
users often maintain computer backups called "images" of their computer(s) and device(s)
10
in an effort to preserve data and quickly replicate time-consuming settings and
11
configurations in the event of a system crash, loss of device, or migration to a new
12
device. The use of these images mean that evidence on a particular individual's
13
computer(s) or device(s) can persist over time as they are moved from device to device.
14
In my opinion, Rockcoons, would be likely to employ such a methodology.
15
16 PROCEDURES FOR ELECTRONICALLY STORED INFORMATION
17 42. With the approval of the Court in signing these warrants, agents executing

18 these search warrants will employ the following procedures regarding computers and other

19 electronic storage devices, including electronic storage media, that may contain data
20 subject to seizure pursuant to the warrants:

21 Forensic Imaging
22 a. A forensic image is an exact physical copy of the hard drive or other
23 media. A forensic image captures all the data on the hard drive or other media without the
24 data being viewed and without changing the data. Absent unusual circumstances, it is
25 essential that a forensic image be obtained prior to conducting any search of the data for
26 information subject to seizure pursuant to these warrants.
27
28
14
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.19 Page 19 of 28

1 b. After verified images have been obtained, the owner of the devices will
2 be notified and the original devices returned within forty-five (45) days of seizure absent
3 further application to this court.
4 Identification and Extraction of Relevant Data
5 c. After obtaining a forensic image, the data will be analyzed to identify
6 and extract data subject to seizure pursuant to the warrants. Analysis of the data following
7 the creation of the forensic image can be a highly technical process requiring specific
8 expertise, equipment and software. There are thousands of different hardware items and
9 software programs, and different versions of the same programs, that can be commercially
1O purchased, installed, and custom-configured on a user's computer system. Computers are
11 easily customized by their users. Even apparently identical computers in an office or home
12 environment can be different with respect to configuration, including permissions and
13 access rights, passwords, data storage, and security. It is not unusual for a computer
14 forensic examiner to have to obtain specialized hardware or software, and train with it, in
15 order to view and analyze imaged data.
16 d. Analyzing the contents of a computer or other electronic storage device,
17 even without significant technical challenges, can be very challenging. Searching by
18 keywords, for example, often yields many thousands of hits, each of which must be
19 reviewed in its context by the examiner to determine whether the data is within the scope
20 of the warrants. Merely finding a relevant hit does not end the review process for several
21 reasons. The computer may have stored metadata and other information about a relevant
22 electronic record - e.g., who created it, when and how it was created or downloaded or
23 copied, when it was last accessed, when it was last modified, when it was last printed, and
24 when it was deleted. Keyword searches may also fail to discover relevant electronic
25 records, depending on how the records were created, stored, or used. For example,
26 keywords search text, but many common electronic mail, database, and spreadsheet
27 applications do not store data as searchable text. Instead, the data is saved in a proprietary
28 non-text format. Documents printed by the computer, even if the document was never
15
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.20 Page 20 of 28

1 saved to the hard drive, are recoverable by forensic programs because the printed document
2 is stored as a graphic image. Graphic images, unlike text, are not subject to keyword
3 searches. Similarly, faxes sent to the computer are stored as graphic images and not as
4 text. In addition, a particular relevant piece of data does not exist in a vacuum. To
5 determine who created, modified, copied, downloaded, transferred, communicated about,
6 deleted, or printed the data requires a search of other events that occurred on the computer
7 in the time periods surrounding activity regarding the relevant data. Information about
8 which user had logged in, whether users share passwords, whether the computer was
9 connected to other computers or networks, and whether the user accessed or used other
1O programs or services in the time period surrounding events with the relevant data can help
11 determine who was sitting at the keyboard.
12 e. It is often difficult or impossible to determine the identity of the person
13 using the computer when incriminating data has been created, modified, accessed, deleted,
14 printed, copied, uploaded, or downloaded solely by reviewing the incriminating data.
15 Computers generate substantial information about data and about users that generally is
16 not visible to users. Computer-generated data, including registry information, computer
17 logs, user profiles and passwords, web-browsing history, cookies and application and
18 operating system metadata, often provides evidence of who was using the computer at a
19 relevant time. In addition, evidence such as electronic mail, chat sessions, photographs
20 and videos, calendars and address books stored on the computer may identify the user at a
21 particular, relevant time. The manner in which the user has structured and named files, run
22 or accessed particular applications, and created or accessed other, non-incriminating files
23 or documents, may serve to identify a particular user. For example, if an incriminating
24 document is found on the computer but attribution is an issue, other documents or files
25 created around that same time may provide circumstantial evidence of the identity of the
26 user that created the incriminating document.
27 f. Analyzing data has become increasingly time-consuming as the volume
28 of data stored on a typical computer system and available storage devices has become
16
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.21 Page 21 of 28

1 mind-boggling. For example, a single megabyte of storage space is roughly equivalent of


2 500 double-spaced pages of text. A single gigabyte of storage space, or 1,000 megabytes,
3 is roughly equivalent of 500,000 double-spaced pages of text. Computer hard drives are
4 now being sold for personal computers capable of storing up to 2 terabytes (2,000
5 gigabytes) of data. And, this data may be stored in a variety of formats or encrypted
6 (several new commercially available operating systems provide for automatic encryption
7 of data upon shutdown of the computer). The sheer volume of data also has extended the
8 time that it takes to analyze data. Running keyword searches takes longer and results in
9 more hits that must be individually examined for relevance. Once reviewed, relevant data
1O leads to new keywords and new avenues for identifying data subject to seizure pursuant to
11 the warrant.
12 g. Based on the foregoing, identifying and extracting data subject to
13 seizure pursuant to the warrants may require a range of data analysis techniques, including
14 hashing tools to identify data subject to seizure pursuant to the warrants, and to exclude
15 certain data from analysis, such as known operating system and application files. The
16 identification and extraction process, accordingly, may take weeks or months. The
17 personnel conducting the identification and extraction of data will complete the analysis
18 within ninety (90) days of the warrants, absent further application to this court.
19 h. All forensic analysis of the imaged data will employ search protocols
20 directed exclusively to the identification and extraction of data within the scope of this
21 warrant.
22 Procedures For Electronically Stored Information on Cellular Phone

23 1. It is not possible to determine, merely by knowing the cellular


24 telephone's make, model and serial number, the nature and types of services to which the
25 device is subscribed and the nature of the data stored on the device. Cellular devices today
26 can be simple cellular telephones and text message devices, can include cameras, can serve
27 as personal digital assistants and have functions such as calendars and full address books
28 and can be mini-computers allowing for electronic mail services, web services and
17
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.22 Page 22 of 28

1 rudimentary word processing. An increasing number of cellular service providers now


2 allow for their subscribers to access their device over the internet and remotely destroy all
3 of the data contained on the device. For that reason, the device may only be powered in a
4 secure environment or, if possible, started in "flight mode" which disables access to the
5 network. Unlike typical computers, many cellular telephones do not have hard drives or
6 hard drive equivalents and store information in volatile memory within the device or in
7 memory cards inserted into the device. Current technology provides some solutions for
8 acquiring some of the data stored in some cellular telephone models using forensic
9 hardware and software. Even if some of the stored information on the device may be
10 acquired forensically, not all of the data subject to seizure may be so acquired. For devices
11 that are not subject to forensic data acquisition or that have potentially relevant data stored
12 that is not subject to such acquisition, the examiner must inspect the device manually and
13 record the process and the results using digital photography. This process is time and labor
14 intensive and may take weeks or longer.
15 J. Following the issuance of this warrant, I will collect the subject cellular
16 telephone and subject it to analysis. All forensic analysis of the data contained within the
17 telephone and its memory cards will employ search protocols directed exclusively to the
18 identification and extraction of data within the scope of this warrant.
19 k. Based on the foregoing, identifying and extracting data subject to
20 seizure pursuant to this warrant may require a range of data analysis techniques, including
21 manual review, and, consequently, may take weeks or months. The personnel conducting
22 the identification and extraction of data will complete the analysis within ninety (90) days
23 of the date the warrant is signed, absent further application to this court.
24 GENUINE RISKS OF DESTRUCTION OF EVIDENCE

25 43. Based upon my experience and training, and the experience and training of

26 other agents with whom I have communicated, electronically stored data can be

27 permanently deleted or modified by users possessing basic computer skills. In this case,

28 Rockcoons is believed to have more than basic computer skills. If Rockcoons received
18
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.23 Page 23 of 28

1 advance warning of the execution of the warrants, there is likely to be a genuine risk of
2 destruction of evidence.
3
PRIOR ATTEMPTS TO OBTAIN THIS EVIDENCE
4
44. Other than as described above, the United States has not attempted to obtain
5
this data by other means.
6
7 CONCLUSION

8 45. Based on the foregoing, there is probable cause to believe that the items

9 identified in Attachment B are evidence of a crime, contraband, fruits of a crime or other

10 items illegally possessed, or were designed for use, intended for use, or used in committing

11 a crime in violation of 18 U.S.C. § 1956(a)(3) (laundering of monetary instruments with

12 the intent to conceal the nature, location, source, ownership, or control of property

13 believed to be the proceeds of specified unlawful activity); 18 U.S.C. § 1960 (prohibition

14 of unlicensed money transmitting business); and 18 U.S.C. § 1343 (wire fraud) and will
be found in the locations to be searched as provided in Attachments A-1. A-2, and A-3.
15
16
17 NICK JONE
Special Agent,
18 Homeland Security Investigations
19
2 o Subscribed and sworn to before me day ofNovembe

21
22
23
24
25
26
27
28
19
AFFIDAVIT IN SUPPORT OF APPLICATION
FOR SEARCH WARRANTS
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.24 Page 24 of 28

1
Attachment A-1
2
LOCATION TO BE SEARCHED
3
4 The location to be searched is a Samsung tablet (serial number: R52JAOJ2KJN)
5 belonging to Morgan Rockcoons that was detained on October 28, 2018, and is currently
6 in the possession of the Department of Homeland Security, San Diego Cyber Crimes
7 Group.
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.25 Page 25 of 28

Attachment A-2
1
2 LOCATION TO BE SEARCHED
3
The location to be searched is a black Google cellular telephone belonging to
4
Morgan Rockcoons that was detained on October 28, 2018, and is currently in the
5
possession of the Department of Homeland Security, San Diego Cyber Crimes Group.
6
7
8

9
10
11

12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.26 Page 26 of 28

Attachment A-3
1
2 LOCATION TO BE SEARCHED
3
The location to be searched is a brown and tan camouflage backpack, with black
4
patch, stating "Stealth Angel" belonging to Morgan Rockcoons that was detained on
5
October 28, 2018, and is currently in the possession of the Department of Homeland
6
Security, San Diego Cyber Crimes Group.
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.27 Page 27 of 28

ATTACHMENT B
1
2
3
The items to be seized include certain items, documents, and records relating to
4
violations of 18 U.S.C. § 1956(a)(3) (laundering of monetary instruments); 18 U.S.C. §
5
1960 (prohibition of unlicensed money transmitting business); and 18 U.S.C. § 1343
6
(wire fraud), including:
7
8 1. Proceeds of money laundering, operating an unlicensed money transmitting
9 business, and wire fraud, including: evidence of cash, bitcoin, other virtual
10 currencies, and including passwords for access to virtual currency storage and
11 accounts, such as digital wallets and electronic lock boxes;
12
13 2. Records relating to the operation of an unlicensed money transmitting business,
14 including: records of the exchange of currencies for virtual currencies, records
15 regarding customers of an unlicensed money transmitting business, advertising and
16 materials for unlicensed money transmitting business;
17
18 3. Financial records relating to virtual currency transactions, including: bank account
19
records, bitcoin address information, wire transfer or money transfers records,
20 records regarding the purchase or exchange of virtual currencies, records
21 regarding the use of pre-paid debit or credit card accounts, records or account
22 information regarding virtual currency exchange platforms and associated services;
23
24
4. Records relating to the website Localbitcoins.com, including profile information,
25
transactional records, and records regarding communications occurring via that
26
platform;
27
28
Case 3:18-mj-05776-RAM Document 1 Filed 11/08/18 PageID.28 Page 28 of 28

5. Records of correspondence or communications conducted in the course of


1
operating an unlicensed money transmitting business; or regarding money
2
laundering transactions; or regarding real estate purchases, sales, and development
3
in Elko County, Nevada, including the recording or transfer of deeds.
4

5
6. Records relating to any co-conspirators or any individuals involved in or with
6
knowledge of the activities described herein;
7
8
7. Records tending to provide context to, or custody and control of, any responsive
9
communications, records, and attachments described above, such as electronic mail
10
sent or received in temporal proximity to a relevant communication or record and
11
any communication or record tending to identify the user( s) of the electronic
12
13 devices to be searched;

14
8. Records relating to the dominion and control of the seized electronic device(s);
15
16
Which are evidence of violations of 18 U.S.C. § 1956 (money laundering), 18 U.S.C. §
17
18 1960 (Prohibition of unlicensed money transmitting business), and 18 U.S.C. § 1343
19 (wire fraud). As used above, the term "records" includes all of the foregoing items of
evidence in whatever form and by whatever means they may have been created or stored
20
21 and any form of electronic or computer storage.

22
23
24
25
26
27
28

You might also like