Tweet
We have all suspected it... now we KNOW!
A federal drug case in Massachusetts has shed new light on how the United States Postal Service’s (USPS) law enforcement unit uses something as simple as IP logs on the postal tracking website to investigate crimes.
According to a December 2013 affidavit of an ongoing federal criminal case in Rockland, Massachusetts, one alleged drug dealer named Harold Bates was found out simply by the digital trail he left on the USPS' Track n’ Confirm website. The affidavit was added to the court docket in January 2015, and the case was first reported by Motherboard.
Bates was charged back in March 2014 with conspiracy to import methylone (also known as "molly"), importation of methylone, and possession with intent to distribute methylone, among other crimes. Last month, the judge in the case ruled against Bates in his attempt to supress evidence seized in those packages.
The judge’s memorandum and order explains that postal investigators found 500 grams of a substance that turned out to be methylone in a package to be delivered in Hollywood, Florida. That statement could suggest that investigators found the suspicious package first and then manually checked IP logs to see if anyone had been searching for tracking information. Once they located Bates’ IP address, they may have checked to see if it had been used to search for other packages.
But in the affidavit, United States Postal inspector Stephen Dowd seems to imply that this link happened in a more automated fashion.
As he wrote, "The USPS database reflected that an individual using a computer or other device with IP address 75.67.6.214 accessed the USPS Track 'n Confirm website to track the progress of both the Florida Parcel and Bates Parcel #1."
Neither the United States Postal Inspection Service (USPIS) nor Bates’ attorneys responded to Ars’ multiple requests for comment.
Ahmed Ghappour, a law professor at the University of California, Hastings, told Ars that he has never seen a case like this before. "What’s most bizarre about this case is the tip-off by algorithm," he said. "It seems that the investigation was triggered by a system that mines Track N’ Confirm user-data in order to detect suspicious activity."
"The Dowd affidavit is very clear that Postal Inspectors discovered a connection between packages delivered to Florida and Massachusetts before initiating contact and obtaining consent to search the Florida package," Ghappour said. "The affidavit is not clear whether the mere act of tracking packages addressed to different cities was sufficient to trigger the investigation or whether other factors, such as foreign return address, came into play."
You’ve got mail from China
The affidavit provides further detail on how Bates was investigated.
Once the USPIS found the matching IP addresses, it quickly determined that they belonged to a Comcast IP block. After requesting Comcast to hand over subscriber data, investigators found that the subscriber linked to the IP address at the time was someone named Matthew Demaggio of Rockland, Massachusetts.
After checking further records, the USPIS determined that Demaggio has been in jail in Massachusetts since September 2013 due to an armed robbery conviction. The USPIS then checked what postal mail was being delivered to the Rockland address and found that it was being addressed to Bates.
Dowd continued:
I have verified through a USPS letter carrier that Bates regularly received mail at the Bates Residence for at least the past six months through the present. I also reviewed records maintained at the Rockland Post Office and determined that five prior Express Mail parcels from either China or Hong Kong had arrived addressed to Bates at the Bates Residence since October 21, 2013.
For three of those packages, Bates had called ahead to the post office and arranged to come pick them up in person rather than wait for them to be delivered. So Dowd and his colleagues anticipated that he might do this again.
On November 13, 2013, Bates Parcel #1 arrived at the Rockland post office, and Dowd arranged for a controlled delivery—he secretly watched Bates arrive in the building and pick it up.
A dog named Lucky
There, Bates picked up his package and paid for a postal scale with $50 in cash. He and a woman that he was with drove to East Water Street in Rockland, where Massachusetts State Police (MSP) were surveilling his residence. The MSP watched as Bates placed two large white plastic garbage bags in a dumpster behind his building. Once Bates and the woman drove away, the MSP retrieved the bags.
Inside the bags was a host of evidence suggesting that Bates was involved in some sort of business from China.
By December 2013, the two USPIS packages from China had arrived, and both had been tracked with the same Comcast IP address. Updates were being sent to the e-mail address satva1100@ymail.com, the address previously associated with package tracking.
Dowd called an officer in the nearby Braintree Police Department to bring his drug-sniffing dog "Lucky."
Dowd continued:
I traveled with the two parcels to the USPS facility in Braintree, Massachusetts, where I placed the Parcel #2 and Parcel #3 at different ends of a large loading dock. I also placed six other innocent parcels among the two suspect parcels as controls.
Officer Seibert advised that upon reaching Parcel #2 and Parcel #3, "Lucky" reacted in a positive manner for the scent of controlled substances. No further indications were observed in the search area. Based on my training and experience, I know that a positive alert means that the parcels contain narcotics or were recently in close proximity to narcotics.
Dowd then "assumed the role of letter carrier" and attempted to deliver the packages to a woman named Julie Carlozzi at a different address on Maple Street, just a half mile away from Bates’ East Water Street residence. When Carlozzi didn’t respond, Dowd left a notice of a missed delivery. Less than an hour later, Carlozzi called the post office and said she would come pick them up in person.
When she picked up the packages, she was followed by undercover law enforcement. She drove to a nearby Rite Aid where she met Bates, who took the packages from her and put them in his car.
Based on these observations, the authorities sought and received a sealed warrant to search Bates’ packages and his home, and USPIS planned for a controlled delivery of two more packages for Carlozzi.
The bust took place the next day, on December 7, 2013. Carlozzi picked up her packages and drove to the same Rite Aid, where she again met Bates. The surveillance tail lost Carlozzi while another group stayed with Bates. After he stopped for gas, law enforcement made their move to arrest him.
Bates was arrested and taken to the Rockland Police Department, where he was interviewed. He waived his Miranda Rights and told the officers that he "received an e-mail from someone in China" and began ordering molly from that person; he paid for it with Western Union money transfers. He also consented to a search of his laptop and iPhone and gave officers the passwords to his e-mail and Skype accounts.
A federal drug case in Massachusetts has shed new light on how the United States Postal Service’s (USPS) law enforcement unit uses something as simple as IP logs on the postal tracking website to investigate crimes.
According to a December 2013 affidavit of an ongoing federal criminal case in Rockland, Massachusetts, one alleged drug dealer named Harold Bates was found out simply by the digital trail he left on the USPS' Track n’ Confirm website. The affidavit was added to the court docket in January 2015, and the case was first reported by Motherboard.
Bates was charged back in March 2014 with conspiracy to import methylone (also known as "molly"), importation of methylone, and possession with intent to distribute methylone, among other crimes. Last month, the judge in the case ruled against Bates in his attempt to supress evidence seized in those packages.
The judge’s memorandum and order explains that postal investigators found 500 grams of a substance that turned out to be methylone in a package to be delivered in Hollywood, Florida. That statement could suggest that investigators found the suspicious package first and then manually checked IP logs to see if anyone had been searching for tracking information. Once they located Bates’ IP address, they may have checked to see if it had been used to search for other packages.
But in the affidavit, United States Postal inspector Stephen Dowd seems to imply that this link happened in a more automated fashion.
As he wrote, "The USPS database reflected that an individual using a computer or other device with IP address 75.67.6.214 accessed the USPS Track 'n Confirm website to track the progress of both the Florida Parcel and Bates Parcel #1."
Neither the United States Postal Inspection Service (USPIS) nor Bates’ attorneys responded to Ars’ multiple requests for comment.
Ahmed Ghappour, a law professor at the University of California, Hastings, told Ars that he has never seen a case like this before. "What’s most bizarre about this case is the tip-off by algorithm," he said. "It seems that the investigation was triggered by a system that mines Track N’ Confirm user-data in order to detect suspicious activity."
"The Dowd affidavit is very clear that Postal Inspectors discovered a connection between packages delivered to Florida and Massachusetts before initiating contact and obtaining consent to search the Florida package," Ghappour said. "The affidavit is not clear whether the mere act of tracking packages addressed to different cities was sufficient to trigger the investigation or whether other factors, such as foreign return address, came into play."
You’ve got mail from China
The affidavit provides further detail on how Bates was investigated.
Once the USPIS found the matching IP addresses, it quickly determined that they belonged to a Comcast IP block. After requesting Comcast to hand over subscriber data, investigators found that the subscriber linked to the IP address at the time was someone named Matthew Demaggio of Rockland, Massachusetts.
After checking further records, the USPIS determined that Demaggio has been in jail in Massachusetts since September 2013 due to an armed robbery conviction. The USPIS then checked what postal mail was being delivered to the Rockland address and found that it was being addressed to Bates.
Dowd continued:
I have verified through a USPS letter carrier that Bates regularly received mail at the Bates Residence for at least the past six months through the present. I also reviewed records maintained at the Rockland Post Office and determined that five prior Express Mail parcels from either China or Hong Kong had arrived addressed to Bates at the Bates Residence since October 21, 2013.
For three of those packages, Bates had called ahead to the post office and arranged to come pick them up in person rather than wait for them to be delivered. So Dowd and his colleagues anticipated that he might do this again.
On November 13, 2013, Bates Parcel #1 arrived at the Rockland post office, and Dowd arranged for a controlled delivery—he secretly watched Bates arrive in the building and pick it up.
A dog named Lucky
There, Bates picked up his package and paid for a postal scale with $50 in cash. He and a woman that he was with drove to East Water Street in Rockland, where Massachusetts State Police (MSP) were surveilling his residence. The MSP watched as Bates placed two large white plastic garbage bags in a dumpster behind his building. Once Bates and the woman drove away, the MSP retrieved the bags.
Inside the bags was a host of evidence suggesting that Bates was involved in some sort of business from China.
By December 2013, the two USPIS packages from China had arrived, and both had been tracked with the same Comcast IP address. Updates were being sent to the e-mail address satva1100@ymail.com, the address previously associated with package tracking.
Dowd called an officer in the nearby Braintree Police Department to bring his drug-sniffing dog "Lucky."
Dowd continued:
I traveled with the two parcels to the USPS facility in Braintree, Massachusetts, where I placed the Parcel #2 and Parcel #3 at different ends of a large loading dock. I also placed six other innocent parcels among the two suspect parcels as controls.
Officer Seibert advised that upon reaching Parcel #2 and Parcel #3, "Lucky" reacted in a positive manner for the scent of controlled substances. No further indications were observed in the search area. Based on my training and experience, I know that a positive alert means that the parcels contain narcotics or were recently in close proximity to narcotics.
Dowd then "assumed the role of letter carrier" and attempted to deliver the packages to a woman named Julie Carlozzi at a different address on Maple Street, just a half mile away from Bates’ East Water Street residence. When Carlozzi didn’t respond, Dowd left a notice of a missed delivery. Less than an hour later, Carlozzi called the post office and said she would come pick them up in person.
When she picked up the packages, she was followed by undercover law enforcement. She drove to a nearby Rite Aid where she met Bates, who took the packages from her and put them in his car.
Based on these observations, the authorities sought and received a sealed warrant to search Bates’ packages and his home, and USPIS planned for a controlled delivery of two more packages for Carlozzi.
The bust took place the next day, on December 7, 2013. Carlozzi picked up her packages and drove to the same Rite Aid, where she again met Bates. The surveillance tail lost Carlozzi while another group stayed with Bates. After he stopped for gas, law enforcement made their move to arrest him.
Bates was arrested and taken to the Rockland Police Department, where he was interviewed. He waived his Miranda Rights and told the officers that he "received an e-mail from someone in China" and began ordering molly from that person; he paid for it with Western Union money transfers. He also consented to a search of his laptop and iPhone and gave officers the passwords to his e-mail and Skype accounts.
Comment