Opinion
2:21-cr-20011-MSN
04-22-2022
UNITED STATES OF AMERICA, Plaintiff, v. KEVIN OLANDO OMBISI, Defendant.
REPORT AND RECOMMENDATION ON DEFENDANT KEVIN OLANDO OMBISI'S MOTION TO SUPPRESS EVIDENCE OBTAINED PURSUANT TO SEARCH WARRANTS FOR APPLE iCLOUD RECORDS
CHARMIANE G. CLAXTON UNITED STATES MAGISTRATE JUDGE
Before the Court is Defendant Kevin Olando Ombisi's (“Ombisi”) Motion to Suppress Evidence Obtained Pursuant to Search Warrants for Apple iCloud Records. (D.E. #97). The instant motion has been referred to the United States Magistrate Judge for Report and Recommendation. (D.E. #122). For the reasons set forth herein, it is RECOMMENDED that Defendant's Motion to Suppress be DENIED.
Ombisi's Motion to Suppress relies upon certain arguments made by his co-defendant Russell in his Motion to Suppress Evidence Obtained Pursuant to Search Warrants for Apple iCloud Records (“Russell's Motion to Suppress”). (See D.E. #97 at PageID 941; D.E. #89 at PageID 808-09, 811-12; see also D.E. #91, #107).
I. Background
A. Indictment and Superseding Indictment
On February 2, 2021, a criminal complaint was issued charging Ombisi and Eric Bernard Russell, Jr. (“Russell”) drug-related offenses. (D.E. #1). On February 25, 2021, a grand jury of this Court returned a ten-count indictment (“Indictment”) against Ombisi and Russell. (D.E. #8, #9). On October 28, 2021, a grand jury of this Court returned a ten-count superseding indictment (“Superseding Indictment”) against Ombisi, Russell, and a third co-defendant- Winrose Wanjiru Ndichu, a/k/a “Rose,” a/k/a “Shiru,” a/k/a “Queen Shi” (“Ndichu”). (D.E. #53, #54, #56, #57).
The Superseding Indictment charges that Ombisi and Russell “participated in Darknet controlled substances trafficking activities using the moniker CARDINGMASTER.” (Id. ¶ 1). It alleges that, under CARDINGMASTER, Ombisi and Russell “conspired and attempted to, and did unlawfully distribute the Schedule II controlled substance methamphetamine, which was falsely represented to be Adderall, through the mail to be delivered by the Postal Service, in the Western District of Tennessee, and elsewhere, in exchange for Bitcoin cryptocurrency.” (Id.) It further alleges that Ombisi and Russell unlawfully enriched themselves through the unlawful distribution of controlled substances, shielded their identities through the use of the CARDINGMASTER moniker and other business entities, and concealed the receipt of proceeds through the use of pseudo-anonymous Bitcoin cryptocurrency, cash, and various business and personal accounts. (Id. ¶¶ 2-3).
The Superseding Indictment charges Ombisi with the following: conspiracy to distribute controlled substances in violation of 21 U.S.C. § 846 (Count 1); unlawful distribution of controlled substances in violation of 21 U.S.C. § 841 (Counts 2-4); attempted unlawful distribution of controlled substances in violation of 21 U.S.C. § 846 (Count 5); sale of counterfeit drugs in violation of 21 U.S.C. § 331(i)(3) and § 333(b)(8) (Count 6); conspiracy to commit money laundering in violation of 18 U.S.C. § 1956(a)(1) & (h) (Count 7); and, mail fraud in violation of 18 U.S.C. § 1341 (Counts 8-10). (Id. ¶¶ 15-30).
B. Search Warrant 20-SW-116
On April 8, 2020, an application for a search warrant and an Affidavit (“Affidavit 1”) in support thereof was presented to the issuing magistrate. (D.E. #97-1 at PageID 952-971). The place to be searched was an iCloud Account associated with Ombisi (“Ombisi's iCloud Account”). (Id. at PageID 952). A search warrant designated 20-SW-116 (the “First Search Warrant”) was subsequently issued by this Court on that same day. (Id. at PageID 943-951).
Affidavit 1 refers to Ombisi's iCloud Account as the “Target iCloud Account”; however, because Ombisi has referred to it as his own (see D.E. #97 at PageID 941, ¶ 2), and as multiple iCloud accounts are discussed in the subsequent affidavit, (see also, infra, n.7), the Court will refer to it as his in this Report and Recommendation for purposes of clarity.
Affidavit 1 identifies the affiant as Special Agent Paul Cox of the Food and Drug Administration's Office of Criminal Investigations (“FDA-OCI”). (Id. at PageID 952). Special Agent Cox states that the facts in Affidavit 1 are based upon his personal observations, his training and experience, and information obtained from other agents and witnesses. (Id. at PageID 953, ¶ 3). He further states that the Drug Enforcement Administration (“DEA”), Homeland Security Investigations (“HSI”), and the United States Postal Inspection Service (“USPIS”) are involved in this investigation. (Id. at PageID 954, ¶ 6).
Affidavit 1 additionally details Special Agent Cox's duties, prior law enforcement experience, and training, none of which are contested here. (Id. at PageID 952-53, ¶ 2).
The investigation was initiated when law enforcement suspected that a seller or sellers with the moniker CARDINGMASTER were illegally distributing adulterated and counterfeit amphetamine-based prescription drugs on a Darknet Marketplace known as Empire Market and via the encrypted chat application Wickr. (Id. at PageID 954-55, ¶ 6). Investigators believed that the individual or individuals utilizing the CARDINGMASTER moniker had been operating on multiple Darknet Marketplaces since at least April 2019 and were responsible for more than 4,800 individual sales on Empire Market alone. (Id. at PageID 957, ¶ 11).
Affidavit 1 defines the “darknet” as “a portion of the internet that is not indexed by search engines and requires special software to access.” (Id. at PageID 956, ¶ 8). “This specialized software includes. protocols that encrypt and anonymize internet traffic for both those browsing and hosting websites on the darknet.” (Id.) “The use of these protocols limits the ability of governments and law enforcement to track the usage and hosting of the sites, and as a result the darknet includes a large quantity of websites that exist primarily as marketplaces for illicit substances and services, for example, narcotics and falsified identification.” (Id.) Affidavit 1 explains that the term “Darknet Marketplace” refers to “commercial websites that operate on darknets like Tor.” (Id. at PageID 955, n.1). It states that “Tor and other darknets are networks of computers that utilize some of the same architecture of the Internet, but which provide greater anonymity and the obfuscation of user identities.” (Id.) It further states that, “[b]ecause of this anonymity, Darknet Marketplaces are commonly used to facilitate illegal transactions involving, among other things, drugs.” (Id.) One example of a Darknet Marketplace is Empire Market, “on which one can find a variety of illicit drugs and services available for purchase from vendors throughout the world.” (Id.)
Affidavit 1 explains that “Wickr” is an “encrypted communication application that allows individuals to communicate via text and voice.” (Id. at PageID 955, n.2). It further states that “Wickr is used by individuals involved in the trafficking of counterfeit drugs because of the ability for senders of messages to set a self-destruct time for messages, as well as security features which notify senders of messages when parties to the conversation take a screenshot of messages.” (Id.)
Beginning in November 2019, undercover agents made six purchases of a product listed as Adderall, a Schedule II controlled substance under the Controlled Substances Act, 21 U.S.C. §§ 801, et seq. (“CSA”), from CARDINGMASTER without providing any prescriptions. (Id. at PageID 956-958, ¶¶ 9-12). Four of the purchases were made by contacting CARDINGMASTER using a Wickr screenname, and the remaining purchases were made on Empire Market. (Id. at PageID 957-58, ¶¶ 12, 14). All of the purchases were made in exchange for Bitcoin cryptocurrency and were shipped through the United States Postal Service's (“USPS”) Priority Mail service. (Id. at PageID 956-57, ¶¶ 11-12, 14).
Following each order, a Priority Mail Small Flat Rate Box was delivered to the undercover agents at the address provided at the time of purchase. (Id. at PageID 957-58 ¶¶ 12, 14). The contents of these purchases appeared consistent with what was advertised for sale on the Empire Market; however, it was later determined by laboratory testing that, instead of containing the active pharmaceutical ingredient in Adderall, they contained methamphetamine, which is also a Schedule II controlled substance. (Id. at PageID 957-58, ¶¶ 12-14).
A review of the pre-printed postage found on all of the undercover purchases shows that they were purchased through a postage reseller (“Postage Reseller 1”) operating under contract with USPS. (Id. at PageID 958, ¶ 15). A review of records obtained from Postage Reseller 1 showed that the account was under the name Frederick Bailey, that the email addresses listed were DNBACCESSORIESS@GMAIL.COM and DNBACCESSORIES@OUTLOOK.COM, and that the addresses listed were in Katy, Texas and San Antonio, Texas. (Id. at PageID 958, ¶ 16).
A review of records associated with Postage Reseller 1 showed that approximately 3,001 mailings had been sent using its postage. (Id. at PageID 959, ¶ 17). Twenty-two of these mailings were sent using postage for a Priority Mail Medium Flat Rate Box. (Id. ¶ 17a). Twenty of these contained the return address of D&B Accessories, LLC, 20501 Katy Fwy., 1st Floor, Suite 100E, Katy, Texas, 77449 (the “D&B Accessories Address”). (Id. ¶ 18). Of these twenty, twelve were addressed to Ombisi at a P.O. Box leased to him at the North Broadway Post Office in San Antonio, Texas (the “P.O. Box”), and eight were addressed to Ombisi at a mailbox at UPS Store # 343 in San Antonio, Texas. (Id. at PageID 959-60, ¶¶ 18, 21-24). USPS business records showed that an Application for Delivery of Mail Through Agent was also made by Ombisi at UPS Store # 343. (Id. at PageID 960, ¶ 24).
Special Agent Cox summarizes that “this evidence demonstrates that the vast majority of the larger shipments are being sent from D&B Accessories, LLC in Katy, Texas to Kevin Ombisi in San Antonio, Texas.” (Id. at PageID 959, ¶ 19). He also reiterates that this connects Ombisi as being the recipient of at least twenty pieces of mail bearing USPS postage purchased by an account known to be used to purchase postage for the distribution of illegal drugs, some of which were delivered to Special Agent Cox as part of the undercover investigation. (Id. at PageID 960, ¶ 25).
The remaining 2,979 mailings traced to Postage Reseller 1 were sent using postage for Priority Mail Small Flat Rate Boxes and Priority Mail Legal Flat Rate Envelopes. (Id. at PageID 959-60, ¶¶ 17b, 20). Special Agent Cox explains that this appears to show that “whomever receives the packages in San Antonio may be dividing the larger Medium Box shipments into smaller packages to send to the purchasers.” (Id. at PageID 959, ¶ 20).
USPS business records further discovered a critical detail that led to the application for this search warrant-namely, that both the P.O. Box and the UPS mailbox associated with Ombisi were also associated with a telephone number ending in -5180. (Id. at PageID 960, ¶¶ 22, 24). Business records from T-Mobile confirmed that this phone number is registered to Ombisi. (Id. at PageID 960-61, ¶ 26). Additionally, a review of open-source information and information available to law enforcement showed that this phone number is associated with an Apple iPhone 8. (Id. at PageID 961, ¶ 27). Special Agent Cox states that “Apple iPhone users are encouraged to configure an iCloud account, which allows full access to Apple services, and also serves as a backup for the data contained on an iPhone”; thus, it was presumed that Ombisi maintained such an iCloud account. (Id.)
Affidavit 1 then sets forth why it is believed that there is probable cause that Ombisi's iCloud Account contains evidence of the crimes set forth therein. Special Agent Cox first notes that, based upon his training and experience, individuals involved in the trafficking of counterfeit drugs use cellular phones to communicate regarding the distribution of illegal substances. (Id. at PageID 961, ¶ 28). He states that this may take the form of messaging applications such as Wickr, text messages, emails, phone calls, and photos and videos of the illegal substances. (Id.) He states that it is also common for cryptocurrency exchanges to utilize telephones for account creation, account access, transaction verification, and two-factor authentication. (Id. ¶ 30). He states that, in particular, his training and experience shows that individuals involved in illegal transactions on the dark web generally use Coinbase, which is a cryptocurrency exchange, or other cryptocurrency exchanges “to maintain wallets holding drug proceeds in the form of cryptocurrencies, to transfer those proceeds to other wallets, and/or to convert those cryptocurrency proceeds into fiat currencies as a part of laundering and concealing the source of the illicit proceeds.” (Id. at PageID 961-62, ¶ 31).
Special Agent Cox states that, between December 22, 2019 and January 21, 2020, the telephone number ending in -5180 made and received approximately 667 calls. (Id. at PageID 961, ¶ 29). Special Agent Cox also determined that eight Coinbase accounts were associated with Ombisi himself or with other contact information associated with him. (Id. at PageID 962, ¶¶ 32-33). Further, two of the Coinbase accounts were associated with the telephone number of Ombisi's iCloud Account, which was also affiliated with Postage Reseller 1. (Id. at PageID 962, ¶ 32). Special Agent Cox states that a review of the logs associated with seven of the Coinbase accounts show that it has been accessed by the operating system that supports, or previously supported, the Apple iPhone 8. (Id. at PageID 962, ¶¶ 34-35). He further explains that technical data relating to internet browsers “indicates that the telephone number associated with [Ombisi's iCloud Account] . . . was used to access the Coinbase cryptocurrency accounts registered to Ombisi . . . in a way that is consistent with access from a cellular phone.” (Id. at PageID 963, ¶¶ 36-41).
Affidavit 1 further sets forth additional evidence that would be available from iCloud accounts in general, including Ombisi's iCloud Account. (Id. ¶¶ 42-55).
C. Search Warrant 20-SW-273
On September 30, 2020, an application for a search warrant and an Affidavit (“Affidavit 2”) in support thereof was presented to the issuing magistrate. (D.E. #97-2 at PageID 981-1003). Affidavit 2 identifies the affiant as Special Agent Cox. (Id. at PageID 981). Along with other proposed searches of other iCloud accounts, this application sought to search Ombisi's iCloud Account for a second time. (Id. ¶ 1). A search warrant designated 20-SW-273 (the “Second Search Warrant”) was issued by this Court on that same day. (Id. at PageID 972-80).
Ombisi's iCloud Account is designated as “Target iCloud Account-1” in Affidavit 2 (Id. at PageID 981 ¶ 1); however, the Court will continue to refer to it as “Ombisi's iCloud Account” for purposes of clarity in this Report and Recommendation, see supra, n.2.
In addition to restating certain evidence and information contained in Affidavit 1, Affidavit 2 sets forth evidence that Special Agent Cox contended would show the continued use of the cellular phone associated with Ombisi's iCloud Account in the distribution of illegal drugs. (Id. PageID 994-996, Sections III.H-III.K). Specifically, on August 12, 2020, a warrant was issued authorizing the placement of a GPS tracking device on a Volkswagen Jetta known to be used by Ombisi “for the distribution of illegal substances using the USPS.” (“Ombisi's Jetta”). (Id. at PageID 994 ¶ 1). A review of the GPS tracking data showed that Ombisi's Jetta was in the vicinity of a post office in Katy, Texas (the “Katy Post Office”) on August 21, 2020 and August 29, 2020 and in the vicinity of the Fleetwood Post Office in Houston, Texas (the “Fleetwood Post Office”) on August 28, 2020. (Id. at PageID 994-95 ¶¶ 2, 4, 6). A subsequent review of surveillance footage from the minutes after Ombisi's Jetta arrived at each location show him enter the post offices, walk to the parcel drop, and place USPS Priority Mail Small Flat Rate boxes into the bins. (Id. ¶¶ 3, 5, 7). These boxes are consistent with the packaging Ombisi was “known to use to distribute counterfeit Adderall tablets.” (Id.) On the August 29 visit to the Katy Post Office, Ombisi deposited the box while using what appeared to be a cellular phone. (Id. ¶ 7).
II. Analysis
The Fourth Amendment guarantees that the “right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” U.S. Const., amend. IV. When presented with an application for a search warrant, the “task of the issuing magistrate is simply to make a practical, common-sense decision whether, given all the circumstances set forth in the affidavit . . ., there is a fair probability that contraband or evidence of a crime will be found in a particular place.” Illinois v. Gates, 462 U.S. 213, 238 (1983) (internal quotation marks omitted); see also United States v. Jackson, 470 F.3d 299, 306 (6th Cir. 2006) (citation omitted) (explaining that “[s]earch warrant affidavits must be judged based on the totality of the circumstances, rather than line-by-line scrutiny”).
“The critical element of a reasonable search is . . . that there is reasonable cause to believe that the specific things to be searched for and seized are located on the property to which entry is sought.” Zurcher v. The Stanford Daily, 436 U.S. 547, 556 (1978) (internal quotation marks omitted). This is typically referred to as the “nexus” between the place to be searched and the evidence desired to be found. United States v. Carpenter, 360 F.3d 591, 594 (6th Cir. 2003).
Although reasonable minds may frequently differ on the question of whether the affidavit establishes probable cause, reviewing courts should afford the issuing magistrate's determination “great deference,” United States v. Leon, 468 U.S. 897, 914 (1984) (citation omitted), and “an issuing magistrate's decision should only be reversed if it was arbitrarily exercised,” United States v. Allen, 211 F.3d 970, 973 (6th Cir. 2000) (citing United States v. Swihart, 554 F.2d 264, 270 (6th Cir. 1977)).
Ombisi's motion begins by stating that he seeks to rely upon Russell's arguments “as to the overbreadth, lack of nexus, and necessity of severance of overbroad portions of the affidavit.” (See D.E. #97 at PageID 941; D.E. #89 at PageID 808-09, 811-12). Specifically, to challenge both warrants, Ombisi relies upon Riley v. California, 573 U.S. 373 (2014), which acknowledges the volume of sensitive, private, and distinct types of information stored not only on cellular phones but also by means of “cloud computing.” Id. at 393-98. Yet the Riley court considered warrantless searches of cellular phones, which is not an issue before this Court. Thus, despite its general discussion of the modern usage of cellular phones, Riley does not weigh upon the question of whether Affidavits 1 and 2 were supported by probable cause. Thus, absent any further argument as to whether probable cause supported the First Search Warrant, it is RECOMMENDED that it did, that the First Search Warrant was not arbitrarily issued, and that the evidence obtained by the execution of the warrant should not be suppressed.
Ombisi also states that there is no evidence that the Coinbase cryptocurrency accounts were linked to illegal activity and that “there is nothing illegal about using the U.S. Mail to ship orders” and nothing “illegal about discussing shipment logistics with another party.” (See D.E. # 97 at PageID 941; D.E. #89 at PageID 809). While this is true, Ombisi has not further developed an argument or cited any other authority that the entirety of Affidavit 1, which sets forth significant additional information about Ombisi's suspected ties to illegal drug distribution, is not supported by probable cause.
To challenge the Second Search Warrant, it appears that Ombisi seeks to join in Russell's argument under United States v. Jenkins, 396 F.3d 751 (6th Cir. 2005) and United States v. Lazar, 604 F.3d 230, 238 (6th Cir. 2010) that, if a subsequent warrant is based upon information obtained through an unlawful search, the reviewing court must consider whether probable cause existed to issue the subsequent warrant after striking the illegally obtained information. Russell's Motion to Suppress precisely identifies the information that he believes to have been unlawfully obtained as a result of a previous search of his iCloud Account that was then included in Affidavit 2 in an attempt to search his iCloud Account for a second time. (See D.E. #89 at PageID 810-812; D.E. #90-1, PageID 865-66, ¶¶ 36-37). While this information was contained in the same affidavit as was being presented to search Ombisi's iCloud Account for the second time, this information in no way pertains to either Ombisi or the proposed search of Ombisi's iCloud Account. (See id.).
In fact, while Ombisi's Motion to Suppress relies upon the arguments made in Russell's Motions to Suppress, Ombisi does not rely upon the page where the evidence Russell believes was unlawfully obtained from the prior search of his iCloud Account is discussed. (See D.E. #97 at PageID 941 (citing D.E. #89 at 808-09, 811-812); D.E. #89 at PageID 810).
Instead, the new evidence contained in Affidavit 2 that does pertain to Ombisi was discovered from the warrant issued on August 12, 2020 allowing the placement of a GPS tracking device on Ombisi's Jetta as well as from USPS surveillance footage. Ombisi has not argued that any of this information was obtained unlawfully. Thus, absent any further challenges to whether probable cause existed to issue the Second Search Warrant, it is RECOMMENDED that it did, that the First Search Warrant was not arbitrarily issued, and that the evidence obtained by the execution of the warrant should not be suppressed.
The Court notes that, not only has Ombisi not stated in the instant motion that any GPS tracking data from Ombisi's Jetta was obtained unlawfully, none of the motions filed by Ombisi or Russell in this case, which have to date challenged nineteen search warrants, have raised such a challenge. (See D.E. #81, #83, #85, #87, #89, #99, #100, #110).
III. Conclusion
For the reasons set forth herein, it is RECOMMENDED that Ombisi's Motion to Suppress Evidence Obtained Pursuant to Search Warrants for Apple iCloud Records (D.E. #97) be DENIED.
ANY OBJECTIONS OR EXCEPTIONS TO THIS REPORT MUST BE FILED WITHIN FOURTEEN (14) DAYS AFTER BEING SERVED WITH A COPY OF THE REPORT. 28 U.S.C. § 636(b)(1)(C). FAILURE TO FILE THEM WITHIN FOURTEEN (14) DAYS MAY CONSTITUTE A WAIVER OF OBJECTIONS, EXCEPTIONS, AND ANY FURTHER APPEAL.