Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 1 of 12

AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT

I, Patrick D. Armor, being first duly sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND

1. I have been employed as a Special Agent with the FBI since January 2015, and am

currently assigned to the Philadelphia Division’s Cyber Crime Squad, whose primary mission is to

investigate crimes involving computers and the Internet, including investigations targeting

individuals who utilize the Internet and computer networking tools to harm innocent victims. While

employed with the FBI, I have investigated and participated in investigations involving federal

criminal violations related to computers and the Internet, along with other federal violations. I have

gained experience through training at the FBI Academy, training involving computers and

networking technology, cybercrime, and everyday work related to conducting these types of

investigations.

2. Prior to being employed as a Special Agent with the FBI, I was a computer systems

engineer for 7 years in the private sector. During my employment, I was a primary architect and

administrator of multiple computer systems and software programs. I possess multiple operating

systems and networking certifications. I have also attended FBI training concerning computer crime

investigations and computer forensics. Based upon my training and experience, I am familiar with

the means by which individuals use computer and information networks such as the Internet to

commit various criminal offenses, and I have participated in the execution of searches and seizures

pursuant to warrants authorizing the seizure of evidence related to computer crimes.

3. I am an officer of the United States who is empowered by law to conduct

investigations of, and to make arrests for, offenses enumerated in, among other provisions, 18 U.S.C.

1
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 2 of 12

§ 1030 (the Computer Fraud and Abuse Act). As such, I am an “investigative or law enforcement

officer” within the meaning of 18, U.S.C. § 2510(7).

4. I submit this Affidavit in support of the issuance of a Criminal Complaint charging

BRYAN CONNOR HERRELL (“HERRELL”) with violations of 18 U.S.C. §§ 1341, 1349 (Attempt

to Commit Mail Fraud).

5. The information in this affidavit is based on my own investigation and training, and

that of other law enforcement officers, on interviews and information provided by witnesses and

cooperators, and review and analysis of business records. This affidavit does not include every fact

known to me, but only those facts that I believe are sufficient to establish probable cause for the

issuance of a criminal complaint for HERRELL.

FACTS SUPPORTING PROBABLE CAUSE TO ISSUE A CRIMINAL COMPLAINT

Summary

6. As set forth below, I contend there is probable cause to believe that HERRELL

manufactures counterfeit sports cards and trading cards, mails the cards out of state with the intent of

selling the counterfeit cards for profit, and has thus attempted to commit mail fraud violation of 18

U.S.C. §§ 1341, 1349..

Background Technical Terms

7. I use the following technical terms in this affidavit:

a. Internet: The Internet is a global network of computers and other electronic

devices that communicate with each other. Due to the structure of the Internet, connections between

devices on the Internet often cross state and international borders, even when the devices

communicating with each other are in the same state.

b. Jabber: Jabber is a secure Internet chatting protocol, also referred to as

“XMPP,” which can be used to communicate with others using an online chat software client. Any

2
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 3 of 12

Jabber/XMPP user is identified by their address or Jabber ID or “JID” in the form

“username@domain.” The domain identifies the server on which the account exists. Jabber IDs are

unique, that is, no two users may register the same jabber ID concurrently.

c. Cryptocurrencies: Cryptocurrencies are electronically-sourced units of value

that exist on the Internet and are not typically stored in a physical form. The most commonly used

cryptocurrency is called Bitcoin. Cryptocurrencies are not issued by any government, but instead are

generated and controlled through computer software operating on decentralized peer-to-peer

networks. Users of cryptocurrencies send units of value to and from “addresses,” which are unique

strings of numbers and letters functioning like a public username. One form of cryptocurrency

address, a Bitcoin address, is represented as a 26-to-35-character-long case-sensitive string of letters

and numbers. Each Bitcoin address is controlled through the use of a unique corresponding private

key, a cryptographic equivalent of a password or PIN needed to access the address. Only the holder

of an address’s private key can authorize any transfers of Bitcoin from that address to other Bitcoin

addresses. Because cryptocurrencies can be transferred peer-to-peer, users can limit their interaction

with traditional, regulated financial institutions, which collect information about their customers and

maintain anti-money laundering and fraud programs.

BRYAN CONNOR HERRELL uses the Jabber ID: TargetAccount 1

8. On July 31, 2017, a federal search warrant was executed at the home of an individual

(“Cooperator 2”) who controlled an online account with username “UndercoverAccount.” 2

1
I believe that the Jabber account ID believed to be used by HERRELL would be recognized by others. Therefore that
username is obscured here with the false replacement “TargetAccount” for the purpose of protecting the investigation
going forward.
2
Similar to the facts in footnote 1, Cooperator 2’s username is a unique moniker that would be recognizable to persons
not named in this document. Therefore that username is obscured here with the false replacement “UndercoverAccount”
for the purpose of protecting the investigation going forward and Cooperator 2’s safety.

3
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 4 of 12

“Cooperator 2” told the FBI that he used the UndercoverAccount account to communicate with

another user using the Jabber ID TargetAccount on a regular basis. Cooperator 2 used the Jabber

account “UndercoverAccount@jabb3r.de” to communicate with HERRELL (as alleged below) who

used Jabber account TargetAccount.

9. On approximately August 22, 2017, “Cooperator 2” voluntarily gave written consent

for the FBI to assume the online identity of UndercoverAccount. On the same date, the FBI logged

into the UndercoverAccount Jabber account, changed the password, and assumed the online identity

of UndercoverAccount. On approximately August 23, 2017, the FBI signed in as

UndercoverAccount and was immediately contacted by the user of TargetAccount and began to

communicate.

10. In subsequent Jabber chat conversations, TargetAccount proposed a plan for

UndercoverAccount to be a “runner” of counterfeit sports and other collector cards. Essentially,

TargetAccount would create the counterfeit cards at home, ship them to UndercoverAccount, then

UndercoverAccount would sell the cards to pawn shops and private buyers in the Philadelphia area.

TargetAccount proposed dividing the proceeds and getting paid by UndercoverAccount with

bitcoin. Once UndercoverAccount sold enough cards and made sufficient money in the Philadelphia

area, TargetAccount proposed UndercoverAccount move on to other areas in the east coast of the

United States. UndercoverAccount communicated an alias name to TargetAccount and gave the

shipping address of a FedEx Office store in King of Prussia, Pennsylvania. Some of these shipments

are identified below.

September 18 Shipment

11. On September 18, 2017, TargetAccount communicated to UndercoverAccount that a

package was sent via FedEx and sent the tracking number:

4
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 5 of 12

*below are relevant portions of Jabber chat on 09/18/2017* (all times Eastern)

(1:05:16 PM) TargetAccount: ok

(1:05:23 PM) TargetAccount: im mailing it in an hour or two
(1:06:08 PM) UndercoverAccount@jabb3r.de: ok
(1:06:14 PM) TargetAccount: 86 jordan
(1:06:17 PM) TargetAccount: two of them
...
(1:16:49 PM) UndercoverAccount@jabb3r.de: send me tracking shit so i know when
to get it

(1:17:17 PM) TargetAccount: it will arrive by 10:30 AM

(1:17:23 PM) TargetAccount: ill send the tracking also
(1:17:27 PM) TargetAccount: but its always by 10:30
(1:17:32 PM) TargetAccount: that is their guarantee
...
(1:59:23 PM) TargetAccount: ok
(1:59:30 PM) TargetAccount: brb
...
(3:03:16 PM) UndercoverAccount@jabb3r.de: wont the printer rat u out
(3:03:20 PM) UndercoverAccount@jabb3r.de: ?
(NOTE: No conversation took place between these times. “TargetAccount” went
idle and signed off at some point, but the event was not recorded.)
(5:04:38 PM) TargetAccount: ok its sended
(5:05:22 PM) TargetAccount: sended
(5:05:48 PM) TargetAccount: 787767897005
(5:12:57 PM) UndercoverAccount@jabb3r.de: ok

12. According to information received from FedEx, the package was shipped overnight

from a FedEx Office, address 11435 East Briarwood Avenue, Centennial, Colorado, 80112

(hereinafter “OFFICE 1”). The shipment was paid for at the store with cash at approximately 4:32

P.M. Eastern Time. FedEx Office provided video surveillance footage of a customer completing

the transaction at the store. Still shots of the video are provided below:

5
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 6 of 12

In the video, it appears the person sent two separate packages.

13. On September 20, 2017, an FBI Agent took possession of the package (tracking

number 787767897005) from a FedEx Office at 99 Town Center, King of Prussia, Pennsylvania

19406. The package contained two counterfeit 1986 Fleer Michael Jordan basketball cards. The

cards were contained in a plastic case with a certificate of condition and authenticity from PSA, an

organization who grades cards and memorabilia. During online chats, TargetAccount told

UndercoverAccount the cards, certificates, and plastic cases on each were counterfeit. During

subsequent chats, TargetAccount encouraged UndercoverAccount to sell each counterfeit card for at

least $8,000.00.

October 3 Shipment

14. At a later date, an FBI Agent, acting covertly as UndercoverAccount, communicated

two separate sales of the supposed counterfeit basketball cards to TargetAccount. On October 3,

2017, an FBI Agent, acting covertly as UndercoverAccount, sent TargetAccount approximately

0.78075717 bitcoin, with a bitcoin market value of approximately $3,463.03 US Dollars on that date.

6
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 7 of 12

On the same date, TargetAccount sent another package from a FedEx Office at 16710 East Quincy

Avenue in Aurora, Colorado 80015 (hereinafter “OFFICE 2”). The shipment was paid for at the

store with cash at approximately 7:07 P.M. Eastern Time. FedEx Office provided video

surveillance footage of a customer completing the transaction at the store. Still shots of the video are

provided below:

15. On October 3, 2017, TargetAccount communicated to UndercoverAccount that a

package was sent via FedEx and sent the tracking number:

*below are relevant portions of Jabber chat on 10/3/2017* (all times Eastern)

(4:53:28 PM) TargetAccount: ok brb hours

(4:54:19 PM) UndercoverAccount@jabb3r.de: ok
(NOTE: No conversation took place between these times. “TargetAccount” signed off
at 6:33:50 PM ET, then signed on at 7:38:08 PM ET.)
(7:38:14 PM) TargetAccount: ok
(7:38:17 PM) TargetAccount: its sended
(7:38:20 PM) TargetAccount: tomorrow by 10 30
(7:39:02 PM) TargetAccount: its 3 jordans one of which has a dirty label
(7:39:22 PM) TargetAccount: but consider that the payoff for selling the cards for so cheap

7
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 8 of 12

(7:40:21 PM) UndercoverAccount@jabb3r.de: lol

...
(8:18:54 PM) TargetAccount: 787951602072

16. On October 4, 2017, an FBI Agent took possession of the package (tracking number

787951602072) from a FedEx office at 99 Town Center in King of Prussia, Pennsylvania 19406.

The package contained three counterfeit 1986 Fleer Michael Jordan basketball cards. The cards

were contained in a plastic case with a certificate of condition and authenticity from PSA. During

online chats, TargetAccount told UndercoverAccount the cards, certificates, and plastic cases on

each were counterfeit, and encouraged UndercoverAccount to sell each counterfeit card at pawn

shops or to private buyers.

October 26 Shipment

17. After several more Jabber chat conversations and another bitcoin payment to

TargetAccount from UndercoverAccount, TargetAccount communicated to UndercoverAccount that

a package containing a counterfeit trading card and some additional items would be shipped via

FedEx on October 26, 2017. On that date at approximately 4:30 P.M. ET, two FedEx Office

employees spotted an individual at OFFICE 1, who later was positively identified by both employees

and FBI Denver surveillance as BRYAN CONNOR HERRELL, through comparison with

HERRELL’s Colorado driver’s license. At approximately 4:31P.M. ET, HERRELL paid cash to

ship a package with FedEx tracking number 788227375245. FBI Denver surveillance observed

HERRELL enter a car and drive away. HERRELL eventually travelled to a residence and was

observed parked outside at approximately 5:00 P.M. ET. The house is owned by persons believed

to be HERRELL’s parents.

8
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 9 of 12

18. An FBI Agent, acting covertly as UndercoverAccount, maintained an online Jabber

presence during the time of the FedEx transaction. Below is a log of messages, observations, and

events of the Jabber activity between UndercoverAccount and TargetAccount:

*below are relevant portions of Jabber chat on 10/26/2017* (all times Eastern)

(3:58:29 PM) TargetAccount: yes and i write nothing for 5 minutes

(3:58:35 PM) TargetAccount: and you bring it up again

(NOTE: After this message, TargetAccount appeared idle until signoff)

(3:59:09 PM) UndercoverAccount@jabb3r.de: lol ok

(4:28:34 PM) UndercoverAccount@jabb3r.de: ?

(NOTE: No conversation took place between these times. “TargetAccount” signed off
at 4:44:16 PM ET, then signed on at 5:07:51 PM ET.)

(5:07:58 PM) TargetAccount: ok its sended

(5:08:08 PM) TargetAccount: arrives by 8 AM

At FBI’s request, this package was held at FedEx and not shipped. HERRELL eventually picked it

back up and re-shipped it on October 30.

October 30 Shipment

19. Upon several further Jabber chat conversations, TargetAccount communicated to

UndercoverAccount that a package containing another counterfeit trading card along with repair

tools, would be shipped via FedEx on October 30, 2017. On that date at approximately 5:25 P.M.

ET, FBI Denver surveillance observed HERRELL exit the residence referenced above, enter a

vehicle, and drive away. HERRELL drove to FedEx Office, address 23870 East Smoky Hill Road,

Suite 10, Aurora, CO 80016 (“hereinafter OFFICE 3”), arriving at approximately 5:35 P.M. ET.

Around that time, a FedEx Office employee witnessed HERRELL complete a cash transaction for an

overnight shipment with FedEx tracking number 788267976930. At approximately 5:44 P.M. ET,

9
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 10 of 12

FBI Denver surveillance observed HERRELL exit OFFICE 3 with a receipt in hand and enter a

vehicle. Below is a photograph of HERRELL walking to the vehicle:

HERRELL drove away and arrived at residence referenced above at approximately 5:59 P.M. ET.

HERRELL exited the vehicle and entered residence at approximately 6:00 P.M. ET.

20. At approximately 6:03 P.M. ET, Jabber user TargetAccount signed online and

communicated that FedEx package with tracking number 788267976930 was sent. Below is a log of

messages, observations, and events of the Jabber activity between UndercoverAccount and

TargetAccount:

*below are relevant portions of Jabber chat on 10/30/2017* (all times Eastern)

(5:13:36 PM) UndercoverAccount@jabb3r.de: sounds perfect lol

(5:13:50 PM) TargetAccount: yes

(5:13:55 PM) TargetAccount: when is mike available

(NOTE: After this message, TargetAccount appeared idle until signoff)

(5:15:52 PM) UndercoverAccount@jabb3r.de: idk

10
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 11 of 12

(5:15:59 PM) UndercoverAccount@jabb3r.de: maybe tmrw

(5:27:56 PM) UndercoverAccount@jabb3r.de: bro
(5:28:15 PM) UndercoverAccount@jabb3r.de: cant load bypass.top
(5:30:38 PM) UndercoverAccount@jabb3r.de: ?

(NOTE: No conversation took place between these times. “TargetAccount” signed off
at 5:44:28 PM ET, then signed on at 6:03:22 PM ET.)

(6:03:42 PM) TargetAccount: ok its sended

(6:04:59 PM) TargetAccount: 788267976930
(6:05:33 PM) UndercoverAccount@jabb3r.de: ok
(6:06:40 PM) TargetAccount: so fuck mike
(6:06:43 PM) TargetAccount: then reseal the other card
(6:06:46 PM) TargetAccount: using the clamps
(6:06:52 PM) TargetAccount: and the directions i gave you last week

21. Throughout all of the dates referenced above, the user of TargetAccount

acknowledged that the shipped cards were counterfeit. Furthermore the user told

UndercoverAccount how he made the fake cards appear to be genuine, and how the fake cards he

sent would fool persons into giving money in exchange for the fake cards.

22. The user of TargetAccount continues to communicate with UndercoverAccount about

counterfeit cards through the present day.

23. Based on the above information, I believe the following:

1) HERRELL controls the Jabber account with username TargetAccount.

2) HERRELL constructed counterfeit sports and trading cards and mailed them to
person who he believes is a co-conspirator but is actually an FBI undercover agent.

3) HERRELL engaged in this scheme with intent to misrepresent to others that the
cards are valuable and that they will pay money for those cards.

4) In fact, the cards are not valuable because they are fake, but made to appear
genuine.

5) HERRELL receives payments that he believes are the proceeds of counterfeit card
sales in Bitcoin.

11
Case 1:17-mj-01217-KLM Document 1-1 Filed 11/13/17 USDC Colorado Page 12 of 12

CONCLUSION

Based on the above information, I respectfully submit that this affidavit supports probable

cause BRYAN CONNOR HERRELL did, on or about August 22, 2017, through the present, attempt

to commit mail fraud in violation of 18 U.S.C. §§ 1341, 1349.

s/Patrick D. Armor
PATRICK D. ARMOR
Special Agent
Federal Bureau of Investigation

November 13, 2017

Subscribed and sworn to before me on No

_________________________________________
__________________________________
HONORABLE KRISTEN L. MIX
United States Magistrate Judge

12