Chan Hung Le Criminal Complaint

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 51 of 78 Page ID #:51

the boxes off the cart, cut into it, and began to take out the
contents. M.B. went into the office area of the premises
through the pedestrian door next to the loading dock. M.B. came
back out of the warehouse and moved so an official USPS truck
could pull into the loading dock. He then left the parking lot
in the black Honda sedan at approximately 12:35 p.m.

b. At approximately 12:36 p.m., a marked DHL
delivery truck arrived and backed into the loading dock next to
the USPS truck. A uniformed DHL employee got out of the truck
and unloaded approximately eight large cardboard boxes that were
covered in yellow tape. The boxes were similar in size and
appearance to boxes known to be used by LE to receive shipments
of counterfeit cellphone parts from China and Hong Kong. They
also matched the size and appearance of the boxes delivered by
M.B. in the Honda sedan a few minutes earlier.

c. At approximately 1:00 p.m., two Pac Depot
employees began to open the boxes by the workbench received from
the Honda sedan. I observed that the interiors of the boxes
were lined with a layer of solid Styrofoam. I observed the
warehouse employees remove bubble-wrapped bundles from the boxes
that were also consistent with cellphone and tablet LCDs
received by LE in the past. This is consistent with the
packaging used by LE to receive shipments of counterfeit cell
phone parts from China and Hong Kong that were recovered from
previous customs seizures and search warrants.

50

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 52 of 78 Page ID #:52

d. At approximately 1:17 p.m., I observed a Pac
Depot employee unwrap the bubble-wrap bundles and observed that
the bundles contained stacks of tablet LCD screens. These items
appeared to be consistent with the types of items LE has
purchased from counterfeit suppliers in the past.

54. On January 11, 2019, I conducted another surveillance

at PREMISES A.
a. At approximately 10:10 a.m., three Pac Depot

employees staged pallets, trash bags, and several of the large
yellow DHL shipping boxes outside the loading dock at what
appeared to be the beginning of their work day. They loaded
these items onto dollies and hand carts and took them to a trash
compactor in the middle of the parking lot of the warehouse
complex (this area was publicly accessible, and appeared to be
shared by the entire complex, and not part of any individual
warehouse space). The large yellow boxes were similar in size
and appearance to boxes used by LE to receive shipments of
counterfeit cellphone parts from China and Hong Kong, as
described above. The employees did not put anything into the
small dumpster adjacent to the loading dock. After placing all
the boxes and bags into the compactor the employees returned to

PREMISES A.
b. At approximately 10:24 a.m., I entered the

concrete enclosure of the trash compactor. No one entered the
compactor enclosure or used the compactor after the Pac Depot
employees took the boxes and other trash from PREMISES A to the

51

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 53 of 78 Page ID #:53

compactor. I observed several of the large, yellow-taped DHL
shipping boxes in the compactor and entered the compactor to
inspect the labels on the boxes. I recovered several shipping
labels and invoices addressed to "PacDepot" and `~Gadetfix Inc"
from the compactor. The shipping labels appeared to have been
removed from several of the yellow-taped DHL boxes in the

compactor.

i. Two of the invoices were from a company

called ~~HK ATOUCH CO., LIMITED" ('~HK ATouch") in Hong Kong.
Each invoice was dated January 3, 2019, was for 800 `cell phone

LCD replacement screens," and listed a declared value of
"$1,200.00" for each shipment. The invoices were written to the
attention of "GRAN LE" and listed a cellphone number (714-623-
5099, i.e., the same phone number LE used between 2012 and 2015

to coordinate the smuggling scheme with Du).
ii. According to customs records, between July

1, 2018 and March 2, 2019, HK ATouch sent approximately 129
shipments of cell phone parts to `~Gadgetfix" at PREMISES A.

c. At approximately 1:15 p.m., a white Toyota Sienna

minivan ("Minivan 1") arrived at PREMISES A and backed into the
loading dock. California DMV records identified the male driver
as an individual with the initials Y.F. and the female passenger
as an individual with the initials Y.X.X. Both Y.F. and Y.X.X.
got out of the vehicle after it was parked at the loading dock.
Two Pac Depot employees unloaded approximately 15 large yellow-
taped boxes from the vehicle and put them on a hand cart at the

52

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 54 of 78 Page ID #:54

~
1

edge of the loading dock. When all the boxes were unloaded from
the minivan, Y.X.X. returned to the front passenger seat. At
approximately 1:30 p.m., Y.F. entered the vehicle and drove out

of the lot.
55. Surveillance of the loading dock at PREMISES A over

the following two weeks showed the following:
a. On January 15, 2019, Y.F. arrived at the loading

dock at approximately 12:15 p.m. in Minivan 1. A Pac Depot
employee unloaded 19 yellow-taped boxes from Minivan 1 and took
them on a cart into PREMISES A. Y.F. then left a few minutes

later.
b. On January 17, 2019, a white minivan arrived at

the loading dock at approximately 11:13 a.m. but the driver and
license plate could not be identified due to impaired visibility
from rain. A Pac Depot employee unloaded approximately 16
yellow-taped boxes from the vehicle and took them on a cart into
PREMISES A. The white minivan departed at approximately 12:28

p.m.
c. On January 18, 2019, M.B. arrived at the loading

dock at approximately 12:48 p.m. in the black Honda Accord sedan
seen previously. A Pac Depot employee unloaded eight yellow-
taped boxes from the Honda and took them on a cart into PREMISES
A. M.B. left a few minutes later.

d. On January 21, 2019, Y.F. arrived at the loading
dock at approximately 11:55 a.m. in Minivan 1. A Pac Depot
employee unloaded 15 yellow-taped boxes from the minivan and

53

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 55 of 78 Page ID #:55

-- -

took them on a cart into PREMISES A. Y.F. departed at

approximately 12:10 p.m.
e. On January 22, 2019, M.B. arrived at the loading

dock at approximately 1:28 p.m. in the black Honda Accord sedan.
A Pac Depot employee unloaded ten yellow-taped boxes from the
vehicle and took them on a cart into PREMISES A. M.B. departed

a few minutes later.
f. On January 23, 2019, a second white Toyota Sienna

minivan, with a different license plate from the previously seen
minivan ("Minivan 2") arrived at the loading dock at
approximately 2:13 p.m. California DMV records identified the
driver of the vehicle as an individual with the initials J.C. A
Pac Depot employee unloaded 13 yellow-taped boxes from Minivan 2
and took them on a cart into PREMISES A. J.C. departed a few

minutes later.
g. Finally, as recently as March 21, 2019, I have

seen M.N., J.V. and T.T. all at PREMISES A. Based on my
surveillance on several occasions between January 2019 and April
2019, cars registered to and driven by each of these persons
have been seen at PREMISES A during normal business hours.
Therefore M.N. and J.V. continue to be employed there, and T.T.
continues to be involved in running the business.

S. Further Investigation of J.C. and LCTech
h. According to DHL billing records, the shipping

charges for the shipments to PREMISES A from HK ATouch in Hong
Kong are being billed to a DHL account under the name `~LCTECH

54

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 56 of 78 Page ID #:56

INTERNATIONAL INC" ("LCTech") located at 20539 E. Walnut Dr. N.,
in Walnut, California. This address is publicly listed on the
Google Maps website (https://maps.google.com) as the business
address for LCTech.

i. J.C., the driver of Minivan 2, in which he
dropped off 13 boxes of cell phone parts on January 23, 2019, is
listed ~as the DHL account holder.

j. California DMV vehicle registration records link
J.C. and LCTech to another warehouse premises located at 20475
Yellow Brick Rd in Walnut, California.

k. International shipping records obtained from CBP
show that between November 3, 2018 and January 30, 2019, HK
Atouch has sent 178 shipments of cell phone parts to ~~MDA TECH
AND TRADE CO., LTD" ("MDA") at this warehouse address on Yellow
Brick Road. Over the same approximate time period (November 8,
2018 to January 30, 2019), HK Atouch sent 58 shipments of cell
phone parts from Hong Kong to Gadgetfix at PREMISES A.

1. On February 19, 2019, I conducted an Internet
search for ~~MDA TECH AND TRADE CO., LTD." The first result
linked to a business listing for ~~MDA TECH AND TRADE CO., LTD"
on a Chinese website `~TradeKey"
(https://cn.tradekey.com/company/MDA-TECH-AND-TRADE-CO-LTD-
7614313.html). J.C. is shown as the contact on the business
listing above a description of MDA as a distributor of "Apple
parts & accessories, cellphone parts & accessories, game parts &

55

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 57 of 78 Page ID #:57

accessories, consumer electronics IC components, and car
electronics products."

56. On February 20, 2019, I conducted surveillance at the
Yellow Brick Road warehouse premises. At approximately 1:39
p.m., Minivan 2 arrived, driven by J.C. California DMV vehicle
registration records show that Minivan 2 is registered to
"LCTech International INC, or [J.C.'s name, reversed]" at that
Yellow Brick Road address.

57. Based on my training and experience and knowledge of
this investigation, I believe that this conduct is further
evidence that, at a minimum, LE continues to use non-standard
shipping channels and mechanisms to receive cell phone parts

from China/Hong Kong.
T. Conspiracy Remains Ongoing
58. Based on my training and experience, and the

investigation as a whole, LE appears persistent over many years
in continuing to commit violations of the Subject Offenses,
notwithstanding his knowledge of law enforcement investigations
,into his conduct, including search warrants and seizures on his
operations and the arrest of his co-schemer, Du. In addition,
given the large sums of money LE appears to have made as a
result of his activity over many years (even in the face of law
enforcement investigation), there is a significant likelihood
that this activity continues, at least in some form, to the
present. The recent activity at his warehouse and related
locations, as described above, coupled with the undercover

56

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 58 of 78 Page ID #:58

purchases and LE's recent wire transfer and importation
activity, supports this likelihood.

U. PREMISES B and CHAN LE, and Digital Devices
59. LE is believed to currently reside at 27562 Deputy
Circle, Laguna Hills, California (PREMISES B). As recently as
March 28, 2019, HSI agents observed LE at this premises with
T.T. and their children in the middle of the day. Records
obtained from T-Mobile in February 2019 show that LE remains the
owner of the cellphone number he used to communicate with Du
between 2012 and 2015. Subscriber information for this number
lists LE as the billing contact for the account and PREMISES B
as the billing address on the account. While T-Mobile only
provided one day of records (November 29, 2018), these records
indicate that several ca11s and text messages were sent
throughout that day. As of March 2019, California DMV
registration records show several vehicles registered to T.T. or
~~Gadgetfix Corp or Chan LE" at PREMISES B. As recently as March
28, 2019, HSI agents have observed these vehicles parked in the
driveway of PREMISES B. During several surveillances conducted
by HSI agents at PREMISES A and B between January and March
2019, LE and T.T. have been observed driving these vehicles
either to or from PREMISES A and B. As of March 29, 2019,
business license records on the California Secretary of State
website (https://businesssearch.sos.ca.gov/) show LE as the
incorporator and registered agent for ~~GADGETFIX CORPORATION."
LE and T.T. are both listed as "officers" and "directors" of the

57

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 59 of 78 Page ID #:59

company according to the most recent Form SI-200 "Statement .of
Information" signed by LE and submitted to the California
Secretary of State on November 11, 2018. PREMISES B is listed
as the address of record for LE and T.T. as officers of the
company and PREMISES A is listed as the business premises. The
same information is listed on the SI-Form 200 for ~~EZ ELEKTRONIX
CORPORATION" signed by LE and filed on April 20, 2018 and the
Form SI-200 for "FIX2SAVE, INC" signed by LE and filed on August

24, 2018.
60. As described above, LE has consistently used digital

devices, in particular his personal phone, to conduct business
relating to the conspiracy described herein. He has retained
the same telephone number throughout the duration of the
conspiracy, and has used it to register shipping accounts and to
communicate with co-conspirators, as described above. I also
know that applications such as WhatsApp, used by LE to
communicate with Du, can be accessed across digital devices
using the same account, such as by a phone and tablet, or a
phone and computer. Depending on user settings, these devices
may retain all or some of the user's communications with other
persons using the app. Further, I believe that given the time
difference to Hong Kong/China (15 hours ahead of California), LE
likely needs to communicate with his suppliers outside of normal
Southern California business hours, and that he therefore likely
needs to do so from his residence. Therefore, I believe that
there will be evidence relating to the Subject Offenses on

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 60 of 78 Page ID #:60

digital devices used by LE. I know, based on my training and
experience and information obtained throughout this
investigation, that LE is likely to have such digital devices
either on his person or at his residence. Depending on LE's
location at the time of the search, I anticipate that his phone
will be either on his person or nearby, while additional,
particularly non-mobile, digital devices are likely to be at
PREMISES A and B. Therefore, I believe there is probable cause
to believe that evidence, fruits, and instrumentalities of the
Subject Offenses will be found at PREMISES B and/or on LE's
person, as well as at PREMISES A.

61. As an officer and director for Gadgetfix, EZ
Elektronix, and Fix2Save, personal electronic devices belonging
to or used by T.T. are also likely to contain evidence of the
violations alleged in this case and are also likely to be found
at PREMISES A and B. As described above, T.T. appears to be
connected to the ongoing scheme in several ways, as reflected in
the use of her name and credit card information for the Texas
drop shipment account described in Section E, her name on the
invoices and wire transfers described in Sections G and I, the
text from Du described in Section H, the money transfers into
her accounts described in Section P, and the surveillance of
T.T. at PREMISES A described in Section R. Therefore, I believe
there is also probable cause to believe that evidence, fruits,
and instrumentalities of the Subject Offenses will be found on
digital devices possessed by T.T.

59

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 61 of 78 Page ID #:61

62. Finally, based on the above-described involvement by
M.N. and J.V. in the drop shipment mailing scheme, and their
apparent continued employment at PREMISES A, I believe there is
also probable cause to believe that evidence, fruits, and
instrumentalities of the Subject Offenses will be found on
digital devices possessed by M.N. and J.V.

VII. TRAINING AND EXPERIENCE ON DIGITAL DEVICES5
63. Based on my training, experience, and information from
those involved in the forensic examination of digital devices, I
know that the following electronic evidence, inter alia, is
often retrievable from digital devices:

a. Forensic methods may uncover electronic files or
remnants of such files months or even years after the files have
been downloaded, deleted, or viewed via the Internet. Normally,
when a person deletes a file on a computer, the data contained
in the file does not disappear; rather, the data remain on the
hard drive until overwritten by new data, which may only occur
after a long period of time. Similarly, files viewed on the
Internet are often automatically downloaded into a temporary
directory or cache that are only overwritten as they are

edddaccpcilaeasaooegtsgmmncaikiemnktttnuere5iroagncaynoplitbsAn,dcio;siedaoaalcvitrsgnuaigidsasspscisimo;etytes,indosasntssptl,gapth,endroefmmtceirronosovnaeorob;nitgirmtisceen,eloewr,dbessilmieo,,reetntovesdhcekil;ssiel,lceucaueespca;tdpsaheneichnnrarnaodceianmgpnorspdtaemsh"bacsmm,esdlebu,oreienlnmdacgtieoeauliorctnmnrtaafiidsiatlcnt,tlsoipsoytpmourmrdorpnstaoderou,/ruevicdtottvineeeaueicgsvrpnrtcessihdesp"oi;cos,urne.ndtipgsrecnpe,isadcrruv;belosnselvucuiosieddect;nciseshsega,ss;silri,taeaansanlngsldayutcehd
60

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 62 of 78 Page ID #:62

replaced with more recently downloaded or viewed content and may
also be recoverable months or years later.

b. Digital devices often contain electronic evidence
related to a crime, the device's user, or the existence of
evidence in other locations, such as, how the device has been
used, what it has been used for, who has used it, and who has
been responsible for creating or maintaining records, documents,
programs, applications, and materials on the device. That
evidence is often stored in logs and other artifacts that are
not kept in places where the user stores files, and in places
where the user may be unaware of them. For example, recoverable
data can include evidence of deleted or edited files; recently
used tasks and processes; online nicknames and passwords in the
form of configuration data stored by browser, e-mail, and chat
programs; attachment of other devices; times the device was in
use; and file creation dates and sequence.

c. The absence of data on a digital device may be
evidence of how the device was used, what it was used for, and
who used it. For example, showing the absence of certain
software on a device may be necessary to rebut a claim that the
device was being controlled remotely by such software.

d. Digital device users can also attempt to conceal
data by using encryption, steganography, or by using misleading
filenames and extensions. Digital devices may also contain
"booby traps" that destroy or alter data if certain procedures
are not scrupulously followed. Law enforcement continuously

61

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 63 of 78 Page ID #:63

develops and acquires new methods of decryption, even for
devices or data that cannot currently be decrypted.

2. .Based on my training, experience, and information from
those involved in the forensic examination of digital devices, I
know that it is not always possible to search devices for data
during a search of the premises for a number of reasons,
including the following:

a. Digital data are particularly vulnerable to
inadvertent or intentional modification or destruction. Thus,
often a controlled environment with specially trained personnel
may be necessary to maintain the integrity of and to conduct a
complete and accurate analysis of data on digital devices, which
may take substantial time, particularly as to the categories of
electronic evidence referenced above. Also, there are now so
many types of digital devices and programs that it is difficult
to bring to a search site all of the specialized manuals,
equipment, and personnel that may be required.

b. Digital devices capable of storing multiple
gigabytes are now commonplace. As an example of the amount of
data this equates to, one gigabyte can store close to 19,000
average file size (300kb) Word documents, or 614 photos with an
average size of 1.5MB.

3. The search warrant requests authorization to use the
biometric unlock features of a device, based on the following,
which I know from my training, experience, and review of
publicly available materials:

62

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 64 of 78 Page ID #:64

a. Users may enable a biometric unlock function on
some digital devices. To use this function, a user generally
displays a physical feature, such as a fingerprint, face, or
e ye, and the device will automatically unlock if that physical
feature matches one the user has stored on the device. To
unlock a device enabled with a fingerprint unlock function, a
user places one or more of the user's fingers on a device's
fingerprint scanner for approximately one second. To unlock a
device enabled with a facial, retina, or iris recognition
function, the user holds the device in front of the user's face
with the user's eyes open for approximately one second.

b. In some circumstances, a biometric unlock
function will not unlock a device even if enabled, such as when
a device has been restarted or inactive, has not been unlocked
for a certain period of time (often 48 hours or less), or after
a certain number of unsuccessful unlock attempts. Thus, the
opportunity to use a biometric unlock function even on an
enabled device may exist for only a short time. I do not know
the passcodes of the devices likely to be found in the search.

c. For these reasons, if while executing the
warrant, law enforcement personnel encounter a digital device
that may be unlocked using one of the aforementioned biometric
features, the warrant I am applying for would permit law
enforcement personnel to, with respect to any device that
appears to have a biometric sensor and falls within the scope of
the warrant: (1) compel the use of LE's, T.T.'s, J.V.'s or

63

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 65 of 78 Page ID #:65

M.N.'s thumb- and/or fingerprints on the device(s); and (2) hold
the device(s) in front of the face of any of those persons with
his or her eyes open to activate the facial-, iris-, and/or

retina-recognition feature.

VIII. NON-LAW-ENFORCEMENT PERSONNEL TO ASSIST WITH SEARCH

64. Pursuant to 18 U.S.C. ~ 3105, HSI intends to have

representatives of Samsung and Apple present during the

requested searches in order to assist law enforcement in the

identification of counterfeit Samsung and Apple marks.

IX. CONCLUSION

65. For all the reasons described above, there is probable
cause to believe that LE has committed the Subject Offenses,
that is: there is probable cause to believe that (1) LE has
conspired and continues to conspire with his suppliers in China
and various individuals connected to his businesses to defraud
the United States, including by disguising his importation
practices; to traffic in counterfeit goods; and to import goods
into the U.S. contrary to law; (2) LE has conspired and
continues to conspire to transmit and transfer funds from the
United States to Hong Kong/China with the intent to promote the
carrying on of his trafficking in counterfeit goods; (3) LE has
conspired and continues to conspire to commit wire fraud and
mail fraud by fraudulently offering counterfeit and unauthorized
electronics parts for sale on his eBay stores and using
interstate and foreign wires and the mails to carry out his
scheme; and (4) LE has used the means of identification of

.~

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 66 of 78 Page ID #:66

numerous other persons during and in relation to this fraudulent

activity.
66. Further, there is probable cause to believe that the

items listed in Attachment B, which constitute evidence, fruits,
and instrumentalities of the Subject Offenses will be found at
the PREMISES A and PREMISES B and on CHAN LE's person, as

described in Attachments A-1, A-2, and A-3.

BRENT ~-~-1-r Special Agent
ROGAN,

Homeland Security

Investigations

Subscribed to and sworn before me
2019.
this IZ day of f

HONORABLE KAREN E. SCOTT
UNITED STATES MAGISTRATE JUDGE

65

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 67 of 78 Page ID #:67

'~

~T~A~F3i~~N'~ A-1.

PREMISES TO BE SEARCHED
The premises to be searched is described as 15Q41 Bake

Parkway, Unit C,. in Irvi~e~ CaZi~ornia ("PREMISES A"). The
s~ructure is a white commercial office building with no trim and
tinted office windows located in. the Phoenix Business Centeno
The building appears to consist of ten distinct businesses,
divided info units "A" through ":~." The building number "15041"
is displayed in large gray numbers just below the r- oof-line•at
boih ends of the building above uni~s "A" and "Lr` and again in
the middle of the bui.Iding above unite "G.'r

PREMISES AF Unit Cr has the uni-~ letter "C" displayed i.n
white above the front entrance on the south side of the lauilding.
The~e are two "FedE,x" signs on the ixont of PREMISES A, one a
window decal and the oi.her a canvas tarp, that identify unit "C"
as a '~Fed~x Authorized ShipCentex." PREMISES 1~ appears to
consist of two internal divisions: an "oi=ice" section on. the
east side oz the unit accessible through a tinted glass door and
a "wareh.ouse" section on she west side oz the unit that is
accessible by two roll-up garage doors at a loading dock and an
adjacen~ pedestrian door at the top of a sma).1 set of cement
staixs. The pedes~rian door displays a sign that reads "NO`~ICE:

Employees Only."

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 68 of 78 Page ID #:68

.- ,

PREMISES TO BE S~RCHED
The premises to be searched is located at 27562 Deputy

Circ.Ie r Laguna Hills F California ("PREMISES B") e The structure
zs white two-story single-fam?ly residence, with a brown shingled
roofj light blue facia anal windotar panes, and gray and white
"stacked-slate" stone trim. ~'he attached 3-car garage is on the
east side of the residence. each of the Three identical garage
doors is painted blue and contains ~welre small hinted windows
along the pop. A "II" shaped white concrete dr3~eway curves zx3.
front of the garage. The wooden, brown double frank door is on
she southwest:. side of the residence (fac?ng sough) and is
accessi.ble by a stone ioat path from the street and a sidewalk
from. the dxiveway. The house number "27562" zs painted in black

numbers on a white background on the curb on Deputy Circle to the
right oz the stone foot path that leads to the fxant door. The
.house number is also displayed on a ruse-colored decret?ve s'- gn
afii~ed to the exterior wall of she residence to the right of the

front door°

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 69 of 78 Page ID #:69

tt

~3TT~,.CF~I~~ A-3

PERSON TO BE SEARCHED
The person of CHAN HUNG LE ("LE"), an Asian male born an

1~ugust 3Q, 1974, Frith black hair, approximately live iez~ seven
inches tall, tNeighing approximately 130 pounds, with brownlblack
eyes. The search of LE shall include containers or con-~eyances
that are within LE's imTn.ediate vicinity and control, including
clothing and personal belongings, compartments r backpacke r
wallets] briefcases, and bags at the location where the search
warrant is executed. It shall not include a body cavity o_r
strip searches

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 70 of 78 Page ID #:70

ATTACFIMENT B

I. ITEMS TO BE SEIZED
1. The items to be seized are evidence, contraband,

fruits, or instrumentalities of violations of 18 U.S.C. ~ 371
(Conspiracy to Defraud the United States, to Traffic in
Counterfeit Goods in violation of 18 U.S.C. ~ 2320, and to
Import Merchandise Illegally"in violation of 18 U.S.C. ~ 545);
18 U.S.C. ~ 1956(h) (Money Laundering Conspiracy); 18 U.S.C.
~ 1349 (Conspiracy to Commit Mail Fraud and Wire Fraud); and 18
U.S.C. ~ 1028A (Aggravated Identity Theft) (the "Subject

Offenses"), namely:
a. Cellular telephone and similar electronic device

components bearing counterfeit trademarks, including but not
limited to Samsung and Apple/iPhone products, as well as related
packaging, containers, labels, labeling, and literature;

b. Records, documents, programs, applications or
materials relating to the importation, acquisition, possession,
purchase, manufacture, sale, shipment, handling, use, or
distribution of any products bearing counterfeit trademarks,
including any such records relating to the importation or
shipment of such goods to locations other than 15041 Bake
Parkway, Unit C, Irvine, California;

c. Records, documents, programs, applications or
materials relating to the sale of misleadingly labeled or
described electronics parts, such as parts advertised as OEM or
otherwise suggested to be genuine consumer electronics brand-

name parts;

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 71 of 78 Page ID #:71

d. Records, documents, programs, applications or
materials relating to the use of names of persons other than
CHAN LE in connection with the importation, purchase, shipment,
or receipt of products or packages bearing counterfeit

trademarks;
e. Records, documents, programs, applications or

materials relating to Hongwei Du, Saduan Industrial, Honape
Industrial Co., Limited, A List Technology (HK) Co. Ltd., or
Mobile Communication Parts (HK);

f. Any documentation, keys, or access codes showing
ownership or control over storage or warehouse space or private
storage areas;

g. Records, documents, programs, applications, and
materials showing ownership, dominion, or control over the
SUBJECT PREMISES;

h. Any records, documents, programs, applications,
and materials consisting of or relating to communications with
any representatives consumer electronics manufacturers (such as
Apple, Samsung, and others);

i. Assets, and evidence of assets, derived from or
used in connection with trafficking in counterfeit goods
(including in connection with the promotion of the carrying on
of that activity), such as United States and foreign currency
(that is, U.S. currency or U.S. currency equivalent in excess of
U.S. $500, including the first $500 if more than $500 is
recovered), negotiable instruments, financial instruments,

ii

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 72 of 78 Page ID #:72

1

books, receipts, bank statements and bank records, money drafts,
money orders and cashiers' checks, receipts, check registers,

and bank checks;
j. Records, documents, programs, applications, and

materials relating to the processing, secreting, transfer,
concealment or expenditure of any proceeds derived from or used
in connection with trafficking in counterfeit goods;

k. Records, documents, programs, applications, and
materials reflecting or relating to the identity or location
others involved in the Subject Offenses, such as photographs,
travel records, or communications;

1. Any digital device which is itself or which
contains evidence, contraband, fruits, or instrumentalities of
the Subject Offenses, and forensic copies thereof.

m. With respect to any digital device containing
evidence falling within the scope of the foregoing categories of

items to be seized:
i. evidence of who used, owned, or controlled

the device at the time the things described in this warrant were
created, edited, or deleted, such as logs, registry entries,
configuration files, saved usernames and passwords, documents,
browsing history, user profiles, e-mail, e-mail contacts, chat
and instant messaging logs, photographs, and correspondence;

ii. evidence of the presence or absence of
software that would a11ow others to control the device, such as
viruses, Trojan horses, and other forms of malicious software,

iii

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 73 of 78 Page ID #:73

as well as evidence of the presence or absence of security
software designed to detect malicious software;

iii. evidence of the attachment of other devices;
iv. evidence of counter-forensic programs (and
associated data) that are designed to eliminate data from the

device;

v. evidence of the times the device was used;

vi. passwords, encryption keys, biometric keys,

and other access devices that may be necessary to access the

device;

vii. applications, utility programs, compilers,

interpreters, or other software, as well as documentation and
manuals, that may be necessary to access the device or to

conduct a forensic examination of it;

viii. records of or information about

Internet Protocol addresses used by the device;
ix. records of or information about the device's

Internet activity, including firewall logs, caches, browser
history and cookies, "bookmarked" or "favorite" web pages,
search terms that the user entered into any Internet search
engine, and records of user-typed web addresses.

2. As used herein, the terms "records," "documents,"
"programs," "applications," and "materials" include records,
documents, programs, applications, and materials created,
modified, or stored in any form, including in digital form on
any digital device and any forensic copies thereof.

iv

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 74 of 78 Page ID #:74

3. As used herein, the term ~~digital device" includes any
electronic system or device capable of storing or processing
data in digital form, including central processing units;
desktop, laptop, notebook, and tablet computers; personal
digital assistants; wireless communication devices, such as
telephone paging devices, beepers, mobile telephones, and smart
phones; digital cameras; gaming consoles (including Sony
PlayStations and Microsoft Xboxes); peripheral input/output
devices, such as keyboards, printers, scanners, plotters,
monitors, and drives intended for removable media; related
communications devices, such as modems, routers, cables, and
connections; storage media, such as hard disk drives, floppy
disks, memory cards, optical disks, and magnetic tapes used to
store digital data (excluding analog tapes such as VHS); and

security devices.
II. SEARCH PROCEDURE FOR DIGITAL DEVICES

4. In searching digital devices or forensic copies
thereof, law enforcement personnel executing this search warrant
will employ the following procedure:

a. Law enforcement personnel or other individuals
assisting law enforcement personnel (the "search team") wil1, in
their discretion, either search the digital device(s) on-site or
seize and transport the device(s) and/or forensic image(s)
thereof to an appropriate law enforcement laboratory or similar
facility to be searched at that location. The search team shall
complete the search as soon as is practicable but not to exceed

u

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 75 of 78 Page ID #:75

120 days from the date of execution of the warrant. The
government will not search the digital devices) and/or forensic
image(s) thereof beyond this 120-day period without obtaining an
extension of time order from the Court.

b. The search team will conduct the search only by
using search protocols specifically chosen to identify only the
specific items to be seized under this warrant.

i. The search team may subject all of the data
contained in each digital device capable of containing any of
the items to be seized to the search protocols to determine
whether the device and any data thereon falls within the list of
items to be seized. The search team may also search for and
attempt to recover deleted, "hidden," or encrypted data to
determine, pursuant to the search protocols, whether the data
falls within the list of items to be seized.

ii. The search team may use tools to exclude
normal operating system files and standard third-party software
that do not need to be searched.

iii. The search team may use forensic examination
and searching tools, such as "Encase" and "FTK" (Forensic Tool
Kit), which tools may use hashing and other sophisticated

techniques.
c. If the search team, while searching a digital

device, encounters immediately apparent contraband or other
evidence of a crime outside the scope of the items to be seized,
the team shall immediately discontinue its search of that device

vi

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 76 of 78 Page ID #:76

pending further order of the Court and shall make and retain
notes detailing how the contraband or other evidence of a crime
was encountered, including how it was immediately apparent
contraband or evidence of a crime.

d. If the search determines that a digital device
does not contain any data falling within the list of items to be
seized, the government will, as soon as is practicable, return
the device and delete or destroy all forensic copies thereof.

e. If the search determines that a digital device
does contain data falling within the list of items to be seized,
the government may make and retain copies of such data, and may
access such data at any time.

f. If the search determines that a digital device is
(1) itself an item to be seized and/or (2) contains data falling
within the list of other items to be seized, the government may
retain the digital device and any forensic copies of the digital
device, but may not access data falling outside the scope of the
other items to be seized (after the time for searching the
device has expired) absent further court order.

g. The government may also retain a digital device
if the government, prior to the end of the search period,
obtains an order from the Court authorizing retention of the
device (or while an application for such an order is pending),
including in circumstances where the government has not been
able to fully search a device because the device or files
contained therein is/are encrypted.

vii

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 77 of 78 Page ID #:77

h. After the completion of the search of the digital
devices, the government shall not access digital data falling
outside the scope of the items to be seized absent further order
of the Court.

5. In order to search for data capable of being read or
interpreted by a digital device, law enforcement personnel are
authorized to seize the following items:

a. Any digital device capable of being used to
commit, further, or store evidence of the offense(s) listed
above;

b. Any equipment used to facilitate the
transmission, creation, display, encoding, or storage of digital
data;

c. Any magnetic, electronic, or optical storage
device capable of storing digital data;

d. Any documentation, operating logs, or reference
manuals regarding the operation of the digital device or
software used in the digital device;

e. Any applications, utility programs, compilers,
interpreters, or other software used~to facilitate direct or
indirect communication with the digital device;

f. Any physical keys, encryption devices, dongles,
or similar physical items that are necessary to gain access to
the digital device or data stored on the digital device; and

viii

Case 8:19-mj-00291-DUTY Document 1 Filed 04/12/19 Page 78 of 78 Page ID #:78

g. Any passwords, password files, biometric keys,
test keys, encryption codes, or other information necessary to
access the digital device or data stored on the digital device.

6. During the execution of this search warrant, law
enforcement personnel are authorized to: (1) depress the thumb-
and/or fingers of CHAN HUNG LE, T.T., J.V., or M.N. (persons
described in the Affidavit accompanying the warrant application}
onto the fingerprint sensor of the device (only when the device
has such a sensor), and direct which specific fingers) and/or
thumb(s) shall be depressed; and (2) hold the device in front of
the face of any of those persons with his or her eyes open to
activate the facial-, iris-, or retina-recognition feature, in
order to gain access to the contents of any such device. In
depressing a person's thumb or finger onto a device and in
holding a device in front of a person's face, law enforcement
may not use excessive force, as defined in Graham v. Connor, 490
U.S. 386 (1989); specifically, law enforcement may use no more
than objectively reasonable force in light of the facts and
circumstances confronting them.

7. The special procedures relating to digital devices
found in this warrant govern only the search of digital devices
pursuant to the authority conferred by this warrant and do not
apply to any search of digital devices pursuant to any other
court order.

ix