Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 1 of 20 Pageid#: 2

UNITED STATES DISTRICT COURT FOR THE

WESTERN DISTRICT OF VIRGINIA

IN THE MATTER OF THE SEARCH OF ) 7:21mj9

Case No. ___
)
The real property located at: )
) FILED UNDER SEAL
1765 Otter Drive, Ferrum, Virginia, 24088 )
)
1775 Scuffling Hill Road, )
Rocky Mount, Virginia, 24151 )
)
)

AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANT

Introduction

Your affiant, Kathryn Camiliere, being first duly sworn, hereby depose and state as
follows:

1. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) and have

been since May 1, 2016. I have a Bachelor’s Degree from the United States Military Academy,

and a Master’s Degree from King’s College in London. I have extensive training and experience

in the areas of terrorism investigations and white collar crime, as well as interview and

interrogation techniques, evidence recovery, source recruitment, and cellular phone analysis.

2. The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended

to show merely that there is sufficient probable cause for the requested warrant and does not set

forth all of my knowledge about this matter.

3. This affidavit is made in support of an application for a search warrant for the

following locations (hereinafter “SUBJECT RESIDENCES”):

 Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 2 of 20 Pageid#: 3

a. 1765 Otter Drive, Ferrum, VA, 24088 (SUBJECT RESIDENCE A) (Home of

Thomas Robertson) which is further described and depicted in Attachment A, as
a one story brick family home, as observed during physical surveillance. The
items to be searched and seized are described in the following paragraphs and in
Attachment B.

b. 1775 Scuffling Hill Road, Rocky Mount, VA, 24151 (SUBJECT RESIDENCE
B) (Home of Jacob Fracker), which is further described and depicted in
Attachment A. The items to be searched and seized are described in the following
paragraphs and in Attachment B.

4. Based on my training and experience and the information set forth herein, your

Affiant has probable cause to believe that THOMAS ROBERTSON and JACOB FRACKER

(“defendants”) engaged in violations of 18 U.S.C. § 1512(c), 18 U.S.C. § 1752(a) and 40 U.S.C.

§ 5104(e) in connection with their activity at the U.S. Capitol on January 6, 2021, and that

evidence, fruits and instrumentalities related to these violations, (as further described in

Attachment B), may be found at the SUBJECT RESIDENCES.

5. This affidavit is based upon information that I have gained from my investigation,

my training and experience, as well as information gained from conversations with other law

enforcement officers. Since this affidavit is being submitted for the limited purpose of securing a

search warrant, I have not included each and every fact known to me concerning this

investigation. I have set forth only the facts that I believe are necessary to establish probable

cause to believe that evidence, fruits, and instrumentalities (more precisely described in

Attachment B) of violations of 18 U.S.C. § 1512(c), 18 U.S.C. § 1752(a) and 40 U.S.C.

§ 5104(e) are located at the SUBJECT RESIDENCES (as further described in Attachment A).

2
 Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 3 of 20 Pageid#: 4

6. This investigation involves evidence, fruits, and instrumentalities of offenses

which are located within the jurisdiction and proper venue of the United States District Court for

the Western District of Virginia, as more fully articulated herein.

Pertinent Federal Criminal Statutes and Definitions

7. This investigation concerns alleged violations of:

a. 18 U.S.C. § 1752(a), which makes it a crime to (1) knowingly enter or remain in

any restricted building or grounds without lawful authority to do; (2) knowingly,
and with intent to impede or disrupt the orderly conduct of Government business
or official functions, engage in disorderly or disruptive conduct in, or within such
proximity to, any restricted building or grounds when, or so that, such conduct, in
fact, impedes or disrupts the orderly conduct of Government business or official
functions; (3) knowingly, and with the intent to impede or disrupt the orderly
conduct of Government business or official functions, obstruct or impede ingress
or egress to or from any restricted building or grounds; or (4) knowingly engage
in any act of physical violence against any person or property in any restricted
building or grounds; or attempts or conspires to do so. For purposes of Section
1752 of Title 18, a restricted building includes a posted, cordoned off, or
otherwise restricted area of a building or grounds where the President or other
person protected by the Secret Service is or will be temporarily visiting; or any
building or grounds so restricted in conjunction with an event designated as a
special event of national significance; and

b. 40 U.S.C. § 5104(e)(2), which makes it a crime for an individual or group of

individuals to willfully and knowingly (A) enter or remain on the floor of either
House of Congress or in any cloakroom or lobby adjacent to that floor, in the
Rayburn Room of the House of Representatives, or in the Marble Room of the
Senate, unless authorized to do so pursuant to rules adopted, or an authorization
given, by that House; (B) enter or remain in the gallery of either House of
Congress in violation of rules governing admission to the gallery adopted by that
House or pursuant to an authorization given by that House; (C) with the intent to
disrupt the orderly conduct of official business, enter or remain in a room in any
of the Capitol Buildings set aside or designated for the use of— (i) either House
of Congress or a Member, committee, officer, or employee of Congress, or either
House of Congress; or (ii) the Library of Congress; (D) utter loud, threatening, or
abusive language, or engage in disorderly or disruptive conduct, at any place in
the Grounds or in any of the Capitol Buildings with the intent to impede, disrupt,
or disturb the orderly conduct of a session of Congress or either House of
3
 Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 4 of 20 Pageid#: 5

Congress, or the orderly conduct in that building of a hearing before, or any

deliberations of, a committee of Congress or either House of Congress; (E)
obstruct, or impede passage through or within, the Grounds or any of the Capitol
Buildings; (F) engage in an act of physical violence in the Grounds or any of the
Capitol Buildings; or (G) parade, demonstrate, or picket in any of the Capitol
Buildings; and

c. 18 U.S.C. § 1512(c), which makes is it a crime to corruptly (1) alter, destroy,

mutilate, or conceal a record, document, or other object, or attempt to do so, with
the intent to impair the object’s integrity or availability for use in an official
proceeding; ௗRU (2) otherwise obstruct, influence, or impede any official
proceeding, or attempt to do so.

Probable Cause

The Riots at the U.S. Capitol

8. The U.S. Capitol, which is located at First Street, SE, in Washington, D.C., is

secured 24 hours a day by U.S. Capitol Police. Restrictions around the U.S. Capitol include

permanent and temporary security barriers and posts manned by U.S. Capitol Police. Only

authorized people with appropriate identification are allowed access inside the U.S. Capitol. On

January 6, 2021, the exterior plaza of the U.S. Capitol was closed to members of the public.

9. On January 6, 2021, a joint session of the United States Congress convened at the

United States Capitol, which is located at First Street, SE, in Washington, D.C. During the joint

session, elected members of the United States House of Representatives and the United States

Senate were meeting in separate chambers of the United States Capitol to certify the vote count

of the Electoral College of the 2020 Presidential Election, which had taken place on November

3, 2020. The joint session began at approximately 1:00 p.m. Shortly thereafter, by

approximately 1:30 p.m., the House and Senate adjourned to separate chambers to resolve a

particular objection. Vice President Mike Pence was present and presiding, first in the joint

session, and then in the Senate chamber.

4
 Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 5 of 20 Pageid#: 6

10. As the proceedings continued in both the House and the Senate, and with Vice

President Mike Pence present and presiding over the Senate, a large crowd gathered outside the

U.S. Capitol. As noted above, temporary and permanent barricades were in place around the

exterior of the U.S. Capitol building, and U.S. Capitol Police were present and attempting to

keep the crowd away from the Capitol building and the proceedings underway inside.

11. At approximately 2:00 p.m., certain individuals in the crowd forced their way

through, up, and over the barricades, and officers of the U.S. Capitol Police, and the crowd

advanced to the exterior façade of the building. The crowd was not lawfully authorized to enter

or remain in the building and, prior to entering the building, no members of the crowd submitted

to security screenings or weapons checks by U.S. Capitol Police Officers or other authorized

security officials.

12. At such time, the certification proceedings still underway and the exterior doors

and windows of the U.S. Capitol were locked or otherwise secured. Members of the U.S. Capitol

Police attempted to maintain order and keep the crowd from entering the Capitol; however,

shortly after 2:00 p.m., individuals in the crowd forced entry into the U.S. Capitol, including by

breaking windows and by assaulting members of the U.S. Capitol Police, as others in the crowd

encouraged and assisted those acts.

13. Shortly thereafter, at approximately 2:20 p.m. members of the United States

House of Representatives and United States Senate, including the President of the Senate, Vice

President Mike Pence, were instructed to—and did—evacuate the chambers. Accordingly, all

proceedings of the United States Congress, including the joint session, were effectively

suspended until shortly after 8:00 p.m. the same day. In light of the dangerous circumstances

5
 Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 6 of 20 Pageid#: 7

caused by the unlawful entry to the U.S. Capitol, including the danger posed by individuals who

had entered the U.S. Capitol without any security screening or weapons check, Congressional

proceedings could not resume until after every unauthorized occupant had left the U.S. Capitol,

and the building had been confirmed secured. The proceedings resumed at approximately 8:00

pm after the building had been secured. Vice President Pence remained in the United States

Capitol from the time he was evacuated from the Senate Chamber until the session resumed.

14. During national news coverage of the aforementioned events, video footage

which appeared to be captured on mobile devices of persons present on the scene depicted

evidence of violations of local and federal law, including scores of individuals inside the U.S.

Capitol building without authority to be there.

15. According to information the FBI has reviewed, after 2:00 p.m., but before the

joint session of Congress resumed at 8:00 p.m., the defendants Thomas Robertson and Jacob

Fracker were photographed in the Capitol Building making an obscene statement in front of a

statute of John Stark. At the time they were photographed, the defendants were off-duty from

their positions as police officers with the Rocky Mount Police Department in Rocky Mount,

Virginia.

16. In social media posts, Defendant Robertson is quoted as saying, “CNN and the

Left are just mad because we actually attacked the government who is the problem and not some

random small business ... The right IN ONE DAY took the f***** U.S. Capitol. Keep poking

us.” He also stated that he was “proud” of the photo in an Instagram Post that was shared to

Facebook, because he was “willing to put skin in the game.”

6
 Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 7 of 20 Pageid#: 8

17. A now-deleted Facebook post by Defendant Fracker containing the caption, “Lol

to anyone who’s possibly concerned about the picture of me going around... Sorry I hate

freedom? …Not like I did anything illegal…y’all do what you feel you need to….”

18. In a statement to Newsweek, Defendant Robertson admitted that he and

Defendant Fracker sent the photo to their police department colleagues, and after it was leaked to

social media he reposted it on his own Facebook page. It has also been reported that Robertson

stated that he broke no laws, did not know about the violence, and that he had been escorted “in”

by the Capitol Police. Robertson made these claims notwithstanding his previous posts that he

had “attacked the government” and “took the f**** Capitol.” Moreover, at that date and time,

the United States Capitol was on lockdown and the defendants’ presence inside was without

lawful authority.

The Defendants’ Arrest and Additional Probable Cause

19. Based on the foregoing, a Magistrate Judge in the District of Columbia found

probable cause that Thomas Robertson and Jacob Fracker committed violations of 18 U.S.C. §

1752, and 50 U.S.C. § 5104, and an arrest warrant issued. They defendants were taken into

custody on Wednesday, January 13, 2021, in the Western District of Virginia, and were released

subject to certain conditions, including a ban from any public protest or demonstration anywhere.

20. At the time of their arrest, the defendants’ cell phones, used to take photos and

video while at the U.S. Capitol, were not located on their person or in their cars.

21. Following the defendants’ arrest, I reviewed additional footage from the U.S.

Capitol, and observed Jacob Fracker wearing a gas mask. The gas mask was not on his person

when he was taken into custody. During the riots, Jacob Fracker was wearing a black hooded

7
 Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 8 of 20 Pageid#: 9

sweatshirt, and Thomas Robertson appears to be wearing a black jacket. Neither the black jacket,

nor the black sweatshirt were on Robertson or Fracker’s person when they were taken into

custody.

22. Also on Wednesday, January 13, 2021, a Magistrate Judge in the District of

Columbia issued a search warrant for the defendant’s Facebook accounts, finding probable cause

that they contained evidence of violations of 18 U.S.C. § 1752 and 40 U.S.C. § 5014.

23. A review of the material obtained from Facebook showed that: On January 7,

2021, Fracker sent a photo and multiple videos to a friend on Facebook. The photo depicted

Fracker, dressed in a black sweatshirt with an American flag on the left side, standing in front of

a statue which was holding a “Trump 2020, Make America Great Again” flag. After sending the

photo but before sending the videos, Fracker told his Facebook friend “Don’t share these. Just

thought you should know there’s hitter out here trying to make a fucking difference at any cost.”

The first video (Video 1) appears to depict Fracker (wearing a black sweatshirt with an American

flag on the left side) wearing a gas mask inside of the US Capitol building. Turning the camera

towards himself, Fracker hits his chest multiple times. Fracker tells his Facebook friend “Shit

was wild lol I pissed in Nancy P’s toilet.”

24. The second video (Video 2) appears to be taken on the lower levels outside of the

Capitol. Fracker again towards the camera towards himself and can be seen wearing the same gas

mask as in Video 1. While holding the camera (not facing himself), the person I believe to be

Fracker moves up the steps of the Capitol and past a barrier. At approximately 2:13 seconds into

the video, the person I believe to be Fracker yells “Let’s fucking go!” Video 3 is taken within the

Capitol. Fracker again turns the camera towards himself, and he can again be seen wearing a

8
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 9 of 20 Pageid#: 10

black sweatshirt with an American flag on the left side, as well as a gas mask. In the background,

one can clearly hear someone within the crowd yelling “PELOSI!”

25. After sending Video 3, Fracker tells his Facebook friend “We did hahaha it was

fucking amazing. Flash bangs going off, CS gas, rubber bullets flying by. Felt so good to be back

in the shit hahaha I was like 8th person inside the building, shit was fuckin LIT.” Later in the

conversation with the same Facebook friend, Fracker states “I haven’t been that hyped up since

fuckin Nowzad hahaha.” From my experiences in Afghanistan, I am aware that Nowzad is a

town within Nawzad District, Helmand Province, Afghanistan. I believe that Fracker was

comparing his experiences in the Capitol with his time in Afghanistan. On January 7, 2021,

Fracker replied to a comment made by a friend “Freedom 2020. Fuck commies. Fuck tyranny.

And fuck anyone in the way of a free America.”

26. On December 19, 2020, Robertson commented on Facebook “Civility has left me.

Im tired of always taking the high road and being beat by those who cheat, lie, and steal to win

and then allow their media to paint me as the bad guy. I won’t be disenfranchised. I’ll follow the

path our founders gave us. Redress of grievances (already done) civil disobedience (here now)

and then open armed rebellion. I’ve spent the last 10 years fighting an insurgency in Iraq and

then Afghanistan. Im prepared to start one here and know a bunch of like minded and trained

individuals.” On December 29, 2020, Robertson commented on a post “Amen. The time is upon

us to remind our government where their power is derived from.” On January 4, 2021, Robertson

comments on a Facebook post “Ill be in DC Wednesday to peacefully protest, the day after….we

shall see.”

9
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 10 of 20 Pageid#: 11

27. On January 7, 2021, Robertson messaged whom I believe to be a close blood

relative Facebook. Robertson tells his relative “Safe at home. Bumps bruised and eyes sore from

tear gas but good! Love you!”

28. On January 8, 2021, Robertson comments on a post “Well.....Fuck you. Being

nice,polite,writing letters and sending emails hasn't worked. Peaceful protests haven't worked.

Millions of FB posts,tweets,and other social media hasn't worked. All thats left is violence and

YOU and your "Friends on the other side of the isle" have pushed Americans into that corner.

The picture of Senators cowering on the floor with genuine fear on their faces is the most

American thing I have seen in my life. Once....for real....you people ACTUALLY realized who

you work for.” Also on January 8, Robertson comments “Peace is done. Now is the time for all

the braggart "Patriots" to buckle armor or shut the fuck up. Facebook warriors time is done. The

next revolution started 1/6/21 in case you "Im ready" and "standing by" guys missed it.” Again

on January 8, Robertson commented in part “The next revolution started in DC 1/6/21. The only

voice these people will now listen to is VIOLENCE. So,respectfully. Buckle armor or just stay at

home.”

29. Furthermore, on January 8, 2021, Robertson replied to a comment in part

“Respectfully....I was in Richmond 1/20/20 and I was in the Capitol building 2 days ago. I am a

VCDL, NRA member and a serving Soldier and police officer. Damage control by the

Republicans in DC is trying to say it was ANTIFA. It wasnt. Possible some were there? Of

course. Caused it?? Nope.”

30. On January 9, 2021 Robertson messages a Facebook friend with two photos, one

of which was described previously (Fracker and Robertson together with Fracker making an

10
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 11 of 20 Pageid#: 12

obscene gesture), and a second photo looking down what appears to be the steps of the Capitol.

Robertson tells his friend “Shot in the ass with a rubber bullet,” and then sends a picture with

what appears to be a large bruise from a rubber bullet. Robertson goes on to say “We were

stomping on the roof of their safe room chanting WHOS HOUSE? OUR HOUSE”. On January

10, 2021, Robertson tells a friend on Facebook “I’m going to war. Can’t speak for everyone.”

The friend then asks whether Robertson is being sent “there?” Robertson replies “No. Im going

to fight the cocksuckers who stole our country.” The friend then asks “Where are you going to

between US?” Robertson replies “DC on the 20th for sure.” On January 11, 2021, Robertson

posted an image with the words “By bullet or ballot restoration of the republic is coming.” On

January 13, 2021, he told a Facebook friend “I may die but I’ll be damned before I strike my

colors.”

31. Based on information I have reviewed from Facebook, I know that Thomas

Robertson used the following digital devices access social media: An SM-J727R4 running (used

to access Facebook on January 11, 2021); a SM-T510 (used to access Facebook on January 7,

2021); and a computer running Windows 10 (used to access Facebook on December 4, 2020).

32. Based on information I have reviewed from Facebook, I know that Jacob Fracker

used an iPhone 12 to access Facebook on January 13, 2021.

The Subject Residences

33. Law enforcement database checks confirmed that Defendant Robertson resides at

Subject Residence A, and Defendant Fracker resides at Subject Residence B.

11
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 12 of 20 Pageid#: 13

34. Robertson has Subject Residence A listed as his home of record on his Driver’s

License. Fracker self-identifies his shipping address as 1775 Scuffling Hill Rd, Rocky Mount, Va

24151 to a friend on Facebook on January 10, 2021.

35. Given that the Robertson and Fracker (1) knowingly and willfully forcibly entered

the U.S. Capitol on January 6, 2021, and carried a gas mask, and cell phone with which they took

pictures, and (2) documented their activities using digital devices to access Facebook, your

affiant believes that there is probable cause to believe that there exists physical and/or electronic

evidence of the commission of the above-described offenses at the SUBJECT PREMISES,

including the aforementioned gas mask, digital devices, and clothes the defendants were wearing

on January 6, 2021.

36. As described above and in Attachment B, this application seeks permission to

search for records that might be found on the PREMISES, in whatever form they are found. One

form in which the records might be found is data stored on a digital device (including a smart

phone), a computer’s hard drive or other storage media. Thus, the warrant applied for would

authorize the seizure of digital devices, electronic storage media or, potentially, the copying of

electronically stored information, all under Rule 41(e)(2)(B).

Background on Digital Devices and Storage Media

37. I submit that if a computer or storage medium is found on the PREMISES, there

is probable cause to believe those records will be stored on that computer or storage medium, for

at least the following reasons:

a. Based on my knowledge, training, and experience, I know that computer files or

remnants of such files can be recovered months or even years after they have been

12
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 13 of 20 Pageid#: 14

downloaded onto a storage medium, deleted, or viewed via the Internet.

Electronic files downloaded to a storage medium can be stored for years at little

or no cost. Even when files have been deleted, they can be recovered months or

years later using forensic tools. This is so because when a person “deletes” a file

on a computer, the data contained in the file does not actually disappear; rather,

that data remains on the storage medium until it is overwritten by new data.

b. Therefore, deleted files, or remnants of deleted files, may reside in free space or

slack space—that is, in space on the storage medium that is not currently being

used by an active file—for long periods of time before they are overwritten. In

addition, a computer’s operating system may also keep a record of deleted data in

a “swap” or “recovery” file.

c. Wholly apart from user-generated files, computer storage media—in particular,

computers’ internal hard drives—contain electronic evidence of how a computer

has been used, what it has been used for, and who has used it. To give a few

examples, this forensic evidence can take the form of operating system

configurations, artifacts from operating system or application operation, file

system data structures, and virtual memory “swap” or paging files. Computer

users typically do not erase or delete this evidence, because special software is

typically required for that task. However, it is technically possible to delete this

information.

d. Similarly, files that have been viewed via the Internet are sometimes

automatically downloaded into a temporary Internet directory or “cache.”

13
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 14 of 20 Pageid#: 15

38. Forensic evidence. As further described in Attachment B, this application seeks

permission to locate not only computer files that might serve as direct evidence of the crimes

described on the warrant, but also for forensic electronic evidence that establishes how

computers were used, the purpose of their use, who used them, and when. There is probable

cause to believe that this forensic electronic evidence will be on any storage medium in the

PREMISES because:

e. Data on the storage medium can provide evidence of a file that was once on the

storage medium but has since been deleted or edited, or of a deleted portion of a

file (such as a paragraph that has been deleted from a word processing file).

Virtual memory paging systems can leave traces of information on the storage

medium that show what tasks and processes were recently active. Web browsers,

e-mail programs, and chat programs store configuration information on the

storage medium that can reveal information such as online nicknames and

passwords. Operating systems can record additional information, such as the

attachment of peripherals, the attachment of USB flash storage devices or other

external storage media, and the times the computer was in use. Computer file

systems can record information about the dates files were created and the

sequence in which they were created, although this information can later be

falsified.

f. As explained herein, information stored within a computer and other electronic

storage media may provide crucial evidence of the “who, what, why, when,

where, and how” of the criminal conduct under investigation, thus enabling the
14
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 15 of 20 Pageid#: 16

United States to establish and prove each element or alternatively, to exclude the

innocent from further suspicion. In my training and experience, information

stored within a computer or storage media (e.g., registry information,

communications, images and movies, transactional information, records of

session times and durations, internet history, and anti-virus, spyware, and

malware detection programs) can indicate who has used or controlled the

computer or storage media. This “user attribution” evidence is analogous to the

search for “indicia of occupancy” while executing a search warrant at a residence.

The existence or absence of anti-virus, spyware, and malware detection programs

may indicate whether the computer was remotely accessed, thus inculpating or

exculpating the computer owner. Further, computer and storage media activity

can indicate how and when the computer or storage media was accessed or used.

For example, as described herein, computers typically contain information that

log: computer user account session times and durations, computer activity

associated with user accounts, electronic storage media that connected with the

computer, and the IP addresses through which the computer accessed networks

and the internet. Such information allows investigators to understand the

chronological context of computer or electronic storage media access, use, and

events relating to the crime under investigation. Additionally, some information

stored within a computer or electronic storage media may provide crucial

evidence relating to the physical location of other evidence and the suspect. For

example, images stored on a computer may both show a particular location and

15
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 16 of 20 Pageid#: 17

have geolocation information incorporated into its file data. Such file data

typically also contains information indicating when the file or image was created.

The existence of such image files, along with external device connection logs,

may also indicate the presence of additional electronic storage media (e.g., a

digital camera or cellular phone with an incorporated camera). The geographic

and timeline information described herein may either inculpate or exculpate the

computer user. Last, information stored within a computer may provide relevant

insight into the computer user’s state of mind as it relates to the offense under

investigation. For example, information within the computer may indicate the

owner’s motive and intent to commit a crime (e.g., internet searches indicating

criminal planning), or consciousness of guilt (e.g., running a “wiping” program to

destroy evidence on the computer or password protecting/encrypting such

evidence in an effort to conceal it from law enforcement).

g. A person with appropriate familiarity with how a computer works can, after

examining this forensic evidence in its proper context, draw conclusions about

how computers were used, the purpose of their use, who used them, and when.

h. The process of identifying the exact files, blocks, registry entries, logs, or other

forms of forensic evidence on a storage medium that are necessary to draw an

accurate conclusion is a dynamic process. While it is possible to specify in

advance the records to be sought, computer evidence is not always data that can

be merely reviewed by a review team and passed along to investigators. Whether

data stored on a computer is evidence may depend on other information stored on

16
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 17 of 20 Pageid#: 18

the computer and the application of knowledge about how a computer behaves.

Therefore, contextual information necessary to understand other evidence also

falls within the scope of the warrant.

i. Further, in finding evidence of how a computer was used, the purpose of its use,

who used it, and when, sometimes it is necessary to establish that a particular

thing is not present on a storage medium. For example, the presence or absence

of counter-forensic programs or anti-virus programs (and associated data) may be

relevant to establishing the user’s intent.

39. Necessity of seizing or copying entire computers or storage media. In most cases,

a thorough search of a premises for information that might be stored on storage media often

requires the seizure of the physical storage media and later off-site review consistent with the

warrant. In lieu of removing storage media from the premises, it is sometimes possible to make

an image copy of storage media. Generally speaking, imaging is the taking of a complete

electronic picture of the computer’s data, including all hidden sectors and deleted files. Either

seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded

on the storage media, and to prevent the loss of the data either from accidental or intentional

destruction. This is true because of the following:

j. The time required for an examination. As noted above, not all evidence takes the

form of documents and files that can be easily viewed on site. Analyzing

evidence of how a computer has been used, what it has been used for, and who

has used it requires considerable time, and taking that much time on premises

could be unreasonable. As explained above, because the warrant calls for forensic

17
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 18 of 20 Pageid#: 19

electronic evidence, it is exceedingly likely that it will be necessary to thoroughly

examine storage media to obtain evidence. Storage media can store a large

volume of information. Reviewing that information for things described in the

warrant can take weeks or months, depending on the volume of data stored, and

would be impractical and invasive to attempt on-site.

k. Technical requirements. Computers can be configured in several different ways,

featuring a variety of different operating systems, application software, and

configurations. Therefore, searching them sometimes requires tools or knowledge

that might not be present on the search site. The vast array of computer hardware

and software available makes it difficult to know before a search what tools or

knowledge will be required to analyze the system and its data on the Premises.

However, taking the storage media off-site and reviewing it in a controlled

environment will allow its examination with the proper tools and knowledge.

l. Variety of forms of electronic media. Records sought under this warrant could be

stored in a variety of storage media formats that may require off-site reviewing

with specialized forensic tools.

40. Nature of examination. Based on the foregoing, and consistent with Rule

41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying

storage media that reasonably appear to contain some or all of the evidence described in the

warrant, and would authorize a later review of the media or information consistent with the

warrant. The later review may require techniques, including but not limited to computer-assisted

18
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 19 of 20 Pageid#: 20

scans of the entire medium, that might expose many parts of a hard drive to human inspection in

order to determine whether it is evidence described by the warrant.

41. Because several people share the PREMISES as a residence, it is possible that the

PREMISES will contain storage media that are predominantly used, and perhaps owned, by

persons who are not suspected of a crime. If it is nonetheless determined that that it is possible

that the things described in this warrant could be found on any of those computers or storage

media, the warrant applied for would permit the seizure and review of those items as well.

Request for Sealing

42. It is respectfully requested that this Court issue an order sealing, until further

order of the Court, all papers submitted in support of this application, including the application

and search warrant. I believe that sealing this document is necessary because the items and

information to be seized are relevant to an ongoing investigation into the criminal organizations

as not all of the targets of this investigation will be searched at this time. Based upon my

training and experience, I have learned that online criminals actively search for criminal

affidavits and search warrants via the Internet, and disseminate them to other online criminals as

they deem appropriate, i.e., post them publicly online through the carding forums. Premature

disclosure of the contents of this affidavit and related documents may have a significant and

negative impact on the continuing investigation and may severely jeopardize its effectiveness.

Conclusion

26. Based on the facts set forth above, your affiant respectfully submits that there is

probable cause to believe that THOMAS ROBERTSON and JACOB FRACKER engaged in

violations of 18 U.S.C. § 1512(c), 18 U.S.C. § 1752(a) and 40 U.S.C. § 5104(e). Furthermore,

19
Case 7:21-mj-00009-RSB Document 1-1 Filed 01/18/21 Page 20 of 20 Pageid#: 21

there is probable cause that evidence, fruits and instrumentalities of these violations (described

with more specificity in Attachment B to this affidavit) are presently located at the SUBJECT

RESIDENCES, as depicted in Attachment A to this affidavit, including any outbuildings, sheds,

garages and/or vehicles that are on the premises.

27. Accordingly, your affiant respectfully requests that the Court issue a search

warrant pursuant to Rule 41 of the Federal Rules of Criminal Procedure authorizing FBI agents

and representatives of the FBI, with assistance from representatives of other law enforcement

agencies as required, to search 1765 Otter Drive, Ferrum, Virginia, 24088, and 1775 Scuffling

Hill Road, Rocky Mount, Virginia A, 24151 (more precisely described in Attachment A), for

evidence, fruits, and instrumentalities (more precisely described in Attachment B).

_ __

Kathryn Camiliere
Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me this 18th day of January 2021 via telephone.

Entered: January 1, 2021

Robert S. Ballou
Robert S. Ballou
United States Magistrate Judge

SEEN AND APPROVED:

/s Matthew M. Miller______
Assistant United States Attorney

20