Mickey Chandler's SpamSuite

I'm pretty sure that this application for a search warrant and its accompanying affidavit is the one that Soloway's attorneys don't want you to see. Wanting to seal this search warrant certainly makes more sense not letting people know about the seizure of 27 pair of shoes and 24 pair of sunglasses.

==============================
UNITED STATES DISTRICT COURT
WESTERN DISTRICT OF WASHINGTON

In the Matter of the Search of Six Dedicated Server Hard Drives, Owned by the Internet Hosting Provider Company GoDaddy.com Inc., rented by Robert A. Soloway, on or about March 30, 2007 through May 30, 2007

APPLICATION AND AFFIDAVIT'
FOR SEARCH WARRANT

I, KENNETH A. SCHMUTZ being duly sworn depose and say:

I am Special Agent, Federal Bureau of Investigation and have reason to believe that on the property or premises known as
the Internet Hosting Provider Company GoDaddy.com Inc.
in the Western District of Washington there is now concealed a certain person or property, namely
Six Dedicated Server Hard Drives rented by Robert Al Soloway on or about March 30, 2007 through May 30, 2007
which is
Evidence of Fraud in Electronic Mail, Mail Fraud, Wire Fraud, Aggravated ID Theft, and Money Laundering 1037 (a)(2) and (a)(3); 3341; 1343; concerning a violation of Title 18 United States Code, Sections 1028 (A); 1956(a)(1)

The facts to support a finding of probable cause are as follows:
See attached Affidavit of Special Agent KENNETH A. SCHMUTZ, attached hereto and incorporated herein.
Continued on the attached sheet(s) and made a part hereof:

KENNETH A. SCHMUTZ
Signature of Affiant
Sworn to before me and subscribed in my presence,
June 21, 2007
2: 30 pm at Seattle. Washington

JAMES P. DONOHUE, U.S. Magistrate Judge
Name and Title of Judge

-2-
AFFIDAVIT

STATE OF WASHINGTON
ss
COUNTY OF KING

KENNETH A. SCHMUTZ, being first duly sworn on oath, deposes and says:

1. INTRODUCTION and BACKGROUND

Warrant Requested

1. I make this affidavit in support of an application for a search warrant for six dedicated server hard drives, which are owned by the Internet Hosting Provider company, GoDaddy.corn, Inc. ("GoDaddy,") and which were rented by Robert A. Soloway beginning on or about March 30, 2007, continuing through the date of Soloway's arrest on May 30, 2007.

Agent Background
2. I am a Special Agent of the Federal Bureau of Investigation (FBI), and have been so employed since January 2004. I am currently assigned to the Seattle Office's Cyber Crime Squad, which investigates various computer-related crimes, including computer intrusions and Internet-related frauds.

3. I have both a Bachelors of Science, and a Masters of Science degree in Business Information Systems from Utah State University. Those degree programs involved, among other things, human computer interface, programming in three languages (C + +, COBOL, Pascal), and designing and creating Internet web pages. Prior to my work as a Special Agent, I worked for thirteen years in a variety of capacities in the computer technology field; holding positions, for example, in which I designed, implemented, and supported computer systems for credit unions, performed
-3-
quality assurance testing for a leading network operating system company, and managed a group of software engineers in a high-paced technology company. I have also taught computer classes at the community college level, including courses on Windows NT Server, Networking Essentials, and Introduction to Programming. I recently obtained industry certification in CompTia's Net+ program.

4. As an FBI agent, I have received specialized training, and gained experience in interviewing and interrogation techniques, arrest procedures, search warrant applications, the execution of searches and seizures, federal computer crimes, computer evidence identification, computer evidence seizure and processing, and various other federal criminal laws and procedures. I have investigated dozens of cases involving the use of computers and the Internet to commit federal crimes, and have personally participated in the execution of multiple search warrants involving the search and seizure of computers and related equipment.

Background and Investigation

5. On October 16, 2006, an investigator with the Federal Trade Commission (FTC) contacted the FBI in Seattle regarding a local resident who had been the subject of approximately 100 complaints of spamming, dating back to as early as 1999. I subsequently discussed the complaints with a representative of the FTC, reviewed many of the complaints, and also reviewed some of the summary data that had been gathered by the FTC with regard to the same.

6. The Seattle Office of the FBI consequently opened a criminal investigation of Robert Alan Soloway and his bulk e-mail business, variously known as Newport Internet Marketing, NIM, Newport Corp, NPR, and Broadcast Email Services. The investigation has been open and continuing thereafter.

7. Much of the evidence that was uncovered during the investigation was recounted or summarized in an Affidavit that I swore before Magistrate Judge Mary
-4-
Alice Theiler on May 23, 2007 ("May 23 Affidavit") in support of an Application for Search Warrant to search Soloway's apartment at 1200 Western Ave., in Seattle, Washington. That Affidavit is appended hereto as Attachment A, and incorporated by reference herein.

8. Also on May 23, 2007, the Grand Jury for the Western District of Washington returned an indictment, charging Soloway and his bulk e-mail business with ten counts of Mail Fraud, five counts of Wire Fraud, two counts of Fraud in E-Mail, five counts of Aggravated Identity Theft, and 13 counts of Money Laundering.

9. As explained in both the May 23 Affidavit (at paragraphs 39 - 44), and in the Indictment, (at paragraph 29 of Count 1), Soloway's wire and mail fraud scheme, and his criminal spamming operations have involved the use of a succession of rented servers. More specifically, evidence (including that referenced in paragraphs 39 - 44 of the May 23 Affadivit), obtained during the investigation has shown that Soloway rented groups of servers from various Internet Hosting Providers. He would then install a software program named "Dark Mailer" on the rented servers. The "Dark Mailer" program is recognized within the Internet community as a spamming software program that taps into a network of zombie proxy computers (a "botnet"), and is able to send 50,000 pieces of e-mail per hour. It affords near-total anonymity because of the zombie proxy network feature.

10. During the course of the investigation, I received information that criminal Spam from Soloway was being transmitted from servers that were owned by GoDaddy. Records were obtained from GoDaddy that confirmed that "Robert Solowa", with an address of 1200 Western Avenue, Seattle, WA, had rented servers from GoDaddy beginning on March 30, 2007. The rental was paid with Visa Card No. XXXXXXXXXXXX1217. Other bank records obtained during the investigation show that this Visa Card No. belonged to Robert Soloway.

-5-
11. Robert Soloway was arrested on May 30, 2007, and had his initial appearance in Court on that same date.

12. During the week of June 4, 2007, I spoke by telephone with Ben Butler, Network Abuse Administrator for GoDaddy.com. He advised me that Robert Soloway had rented a total of six dedicated servers from GoDaddy. Mr. Butler indicated that GoDaddy was interested in determining whether the servers that had been rented by Soloway had been used to transmit or distribute spam. Mr. Butler indicated further that if GoDaddy determined that the servers that had been rented by Soloway had been used in spamming activity, GoDaddy would turn those servers over to the FBI.

13. Mr. Butler subsequently telephoned me and advised me that GoDaddy had determined that there was reason to believe that the six dedicated servers that had been rented by Soloway had been used for spamming activity, as indicated by the presence of the Dark Mailer program on them. Mr. Butler further reported that his company, GoDaddy.com, was now requesting that a search warrant be provided to them, and that the company would provide the six servers to the FBI upon receipt of such a warrant.

Conclusion

14. Based on the facts and evidence presented in this affidavit, and in the May 23, 2007 Affidavit incorporated herein, I believe there is probable cause to believe that fruits, instrumentalities and evidence of violations of Title 18 U.S.C. Sections 1037 (a)(2) and(a)(3) (Fraud in Electronic Mail), Title 18 U.S.C. Section 1341 (Mail Fraud), Title 18 U.S.C. Section 1343 (Wire Fraud), Title 18 U.S.C, Section 1028(A) (Aggravated ID Theft), and Title 18 U.S.C. Section 1956(a)(1) (Money Laundering) exist on the six dedicated server hard drives, which are owned by the Internet Hosting Provider company, GoDaddy.com, Inc. ("GoDaddy,") and which were rented by
-6-
Robert A. Soloway beginning on or about March 30, 2007, continuing through the date of Soloway's arrest on May 30, 2007.

KENNETH A SCHMUTZ, Special gent
Federal Bureau of Investigation

Subscribed to and Sworn to before me this 21st day of June, 2007.

JAMES P. DONOHUE
United States Magistrate Judge

Attachment	Date	Size
GoDaddySearchWarrant.pdf	06/28/09 1:05 pm	180.63 KB
SearchWarrantSchmutzAffidavit1.pdf	06/28/09 1:05 pm	648.51 KB
SearchWarrantSchmutzAffidavit2.pdf	06/28/09 1:05 pm	637.8 KB