California love —

If you’re an alleged drug dealer, don’t use “asshole209” as a password

David Ryan Burchard is accused of selling $1.4M in marijuana and cocaine online.

If you’re an alleged drug dealer, don’t use “asshole209” as a password

Nearly 18 months ago, federal authorities began investigating a man from Merced, California, who they believed was selling millions of dollars in bitcoins to an “unlicensed digital currency exchanger.”

That man, David Ryan Burchard, was arrested in March 2016 and pleaded not guilty at his first court appearance. After being recently released on bail, he now faces nearly 20 counts of drug-related and money laundering charges.

According to the affidavit by special agent Matthew Larsen of Homeland Securities Investigations (HSI), the FBI estimates that Burchard was the 18th largest vendor on Silk Road. That made Burchard the third-largest US-based vendor on the notorious and now-shuttered online drug market.

Following Burchard’s arrest, prosecutors said that he sold $1.4 million worth of marijuana and cocaine on Silk Road. When the site was shut down, Burchard allegedly moved on to other sites, including Agora, Abraxas, and AlphaBay.

Burchard’s lawyer, Anthony Capozzi, himself a former federal prosecutor, said the case is still in its early stages and that a plea deal has not been offered yet.

“We received thousands of pages of discovery, and I haven’t gone through [them] yet,” he told Ars.

He noted that this was the first digital currency case that he’d ever worked on.

“It’s too early on, so many pages of discovery,” Capozzi added. “I can’t tell one way or the other which way the case is going at this point. With a case this complicated, it’s going to take a while.”

Assistant United States Attorney Grant Rabenn declined Ars’ request for comment. It is common for prosecutors to not respond to questions pertaining to ongoing cases. However, Lauren Horwood, a spokeswoman for the US Attorney’s office in the Eastern District of California, pointed out that there have been other Silk Road-related cases in the district.

Like Silk Road founder Ross Ulbricht and many other online criminals, Burchard’s case highlights the difficulty of maintaining good operational security (opsec).

Case in point: HSI forensics analysts determined that Burchard’s PGP password was “asshole209“ (the numbers refer to his California area code). With that easily cracked password, all of Burchard’s encrypted communications became readable.

Here’s how federal authorities tracked down Burchard.

Betrayed by a trademark

According to Larsen’s affidavit, HSI special agents located Burchard’s address “using surveillance and public records” by mid-March 2015. Once they found out that he drove a white Chevrolet Tahoe, they began conducting physical surveillance on his home on Gabriel Street in Merced, a city roughly two-and-a-half hours from San Francisco.

After observing the Burchard residence for two hours and seeing the Tahoe parked nearby, Larsen called a federal judge and “swore out a search warrant” to install a GPS tracking device on Burchard’s Tahoe. (This is notable, as since the 2012 Supreme Court decision, US v. Jones, law enforcement must get a warrant to place a GPS tracking device on a car.) Fifteen minutes later, Larsen and the other agents left.

Six days later, Larsen and other agents saw Burchard at a residence on Duke Court, a residential street just a few blocks from Merced College. Larsen and the other agents watched as the Tahoe drove from Merced to a post office in Clovis, about 67 miles away. Surveillance video obtained later showed that a “white male resembling BURCHARD” had three medium-sized parcels in the Clovis post office.

Working with United States Postal Inspector (USPI) Jessica Burger, Larsen continued monitoring the Tahoe’s movements and eventually got warrants to open several packages that Burchard had sent. All of them tested positive for marijuana.

By early June 2015, Larsen found that, amazingly, Burchard had applied for a United States trademark, in his own name, for the name “CALI CONNECT.” According to Burchard’s application, he said the name was to be used for t-shirts and hooded sweatshirts. Authorities subsequently began searching posts on Reddit and other websites for “caliconnect” or related variations.

Larsen found “Caliconnect” in the “Silk Road NTC Vendor List” that had been provided to him by HSI headquarters. “Caliconnect” was a marijuana trafficker with sales over $1.4 million. That entry also included many United States Postal Service tracking numbers, which Larsen sent to another USPI to follow up on.

“I observed that all the post offices utilized to send the parcels are located within the Central Valley of California, near the home of BURCHARD, who resides in Merced, California,” Larsen wrote in the affidavit.

By continuing to mine the Silk Road database, Larsen found numerous messages from “Caliconnect” to his customers and discovered that not all of them paid with Bitcoin. At least one of them used a pre-paid credit card loaded by a service called Green Dot Money Paks. When Larsen subpoenaed the Green Dot corporation for information about 12 Money Pak accounts, the company responded that it had no information on 11 of them. The 12th account, however, belonged to David Burchard of Merced, California.

By mid-June 2015—just weeks after a federal judge in New York gave Ulbricht a double life sentence—an account under the name “the_real_caliconnect” turned up on Agora, another dark market. Agora records show that “the_real_caliconnect” sold approximately 470 pounds of marijuana over the course of approximately 1,000 transactions.

The raid

Beginning in September 2015, Larsen and someone named “Intern Mann” tracked Burchard’s frequent visits to a Raley’s store in Merced where Burchard shipped numerous packages. The unknown intern seems to have had the foresight to use a dark web search engine to figure out where else that PGP public key was being published. Turned out, “caliconnect4life” was selling on Alpha Bay as well.

In December 2015, Larsen and Intern Mann joined a Fresno police detective in a controlled buy of half a pound of marijuana from “caliconnect4life” on Alpha Buy. They had it shipped to Buffalo, New York, where another HSI agent sent it back to California for Larsen’s inspection.

“I examined the parcel and determined the method of packaging was similar to the parcels sent by BURCHARD and previously seized by HSI Fresno,” he wrote. “The suspected marijuana was vacuum sealed in a food saver bag, which was then sealed in a moisture barrier bag.”

On January 20, 2016, Larsen obtained a search warrant for Burchard’s home on Gabriel Street in Merced. The next day, HSI agents raided the home, where they encountered Burchard, his partner Monica Saucedo, and their three children. As Larsen wrote:

[Special agents] and investigators conducted a search of the residence as authorized by the search warrant and seized numerous computers and other electronic storage devices. I also seized numerous items associated with the distribution of narcotics, including anti-static bags, a digital scale, food saver vacuum sealing bags; Amazon boxes with plastic storage bags; a trash bag containing marijuana, a box containing a sealed bag of marijuana. I also found pieces of clothing apparel with the label “caliconnect.” In addition to this evidence, case agents seized a 2010 Jaguar XF sedan; a Mercedes S63, a 2013 Mercedes, and a 2007 Chevy Tahoe.

Burchard also allowed law enforcement to search his nearby storage units. About an hour after the search of the residence began, Larsen, Intern Mann, and Internal Revenue Service Special Agent Kulbir Mand started questioning Burchard.

After he was read his Miranda rights, Burchard told the investigators that he traded bitcoins on LocalBitcoins.com, but he'd lost his wallet address when he discarded the computer where it was stored. He claimed that “Caliconnect” was the name of his clothing brand and denied selling marijuana through the “dark web.” Burchard denied that he had mailed marijuana to anyone.

Saucedo was also questioned after being read her rights. She said that her fiancé, Burchard, had not worked in “six or seven years” and that she was a stay-at-home mother. Somehow, though, the family was able to afford the monthly $1,350 rent on the Gabriel Street house in Merced.

Weeks later, after HSI forensics analysts had inspected the seized Asus laptop found in Burchard’s dining room, they found several notable pieces of circumstantial evidence, including the black and gold “Caliconnect” logo in use on AlphaBay, an installation of Tor, and a decrypted message that matched, identically, the controlled Buffalo, New York, transaction.

“This address and message are identical to the information provided by who conducted the undercover controlled buy of a half-pound of marijuana from ‘caliconnect4life’ on the dark-web market AlphaBay,” Larsen noted.

Capozzi, Burchard’s lawyer, told Ars that we should check back in October 2016, when the next status conference is set to be held before the judge in federal court in Fresno.

“This one is very interesting, and it’s going to be an exciting case to handle,” Capozzi said.

Channel Ars Technica