The Affidavit for Search Warrant, (see Document Manager), is a standard form signed and sworn by the special agent that summarizes the specifics of the search warrant. The application addresses the particulars of the person, property, or premises to be searched; the title and employing agency of the special agent; the judicial district where the person or property exists; a description of the items to be seized; and the nature of the alleged criminal violations. This section of the form is generally prepared by the attorney for the government assigned to the investigation.

In order to obtain a search warrant, the special agent must convince internal and external approving officials, and ultimately a Federal Judge Magistrate (magistrate), that there is probable cause to believe that:

The remainder of the application is the affidavit in support of the application drafted by the special agent along with input from CT Counsel and, if it is a grand jury investigation, the attorney for the government.

The affidavit sets forth, in a logical fashion, all the existing evidence to establish probable cause that a crime was committed, that evidence of the crime exists, and that the evidence is located at a particular location.

A suggested format for the affidavit includes the following sections:

Any time a special agent believes that evidence may be contained on a computer, a Computer Investigative Specialist (CIS) will be consulted at the initiation of the discussions in anticipation of a search warrant. The CIS will assist the special agent in drafting the search warrant affidavit and the list of items to be seized. As needed, the CIS will also assist in the interview of key witnesses/informants who have knowledge of the computers. Specific information must be developed regarding the subject’s use of the computer and the role of the computer(s) in the offense.

Unlike a criminal trial, the rules of evidence do not apply to a search warrant application and all evidence, whether direct, indirect, hearsay, or based upon personal knowledge, can be included in the affidavit to establish probable cause. Only that evidence which is necessary to establish probable cause need be disclosed in the affidavit. Consideration should therefore be given to the amount of investigative disclosure contained in the affidavit should it be unsealed before the conclusion of the investigation.

The use of hearsay information (i.e., information which was not obtained through direct personal knowledge and which is normally inadmissible in a criminal trial proceeding) may be included in the affidavit. It is common for an affidavit to contain the investigative findings of other police officers, Federal agents, independent third parties, etc.

Hearsay and other information provided by an informant is subject to a higher degree of scrutiny. Three landmark Supreme Court cases, Aquilar, Spinelli, and Gates, frame much of the current procedures involving the use of informant testimony. Aquilar and Spinelli established a two-prong test that has to be satisfied in order to use information from a particular informant. This test required that both the reliability and veracity (credibility) of an informant be established in order to use any information from the informant. The Gates decision modified Aquilar and Spinelli, holding that it is not necessary to apply the two prongs of the test independent of each other; rather, the credibility of the information provided by an informant may be evaluated in light of everything that is known at that point in the investigation. This standard is known as the " totality of the circumstances" and the Gates decision states: "The task of the issuing magistrate is simply to make a practical, common-sense decision whether, given all the circumstances set forth in the affidavit before him, including the 'veracity' and 'basis of knowledge' of persons supplying hearsay information, there is a fair probability that either contraband or evidence of a crime will be found in a particular place. And the duty of a reviewing court is simply to ensure that the magistrate had a 'substantial basis for ….conclude[ing]' that probable cause [462 US 213, 239] existed."

The reliability of an informant can be established by the following:

The veracity or credibility of the informant can be established by showing that the informant has as many of the following characteristics as possible:

Special agents should carefully evaluate information provided by informants. The decision to use an informant is sensitive and requires the agency to perform due diligence concerning the background of the individual who will be providing information or receiving direction from the IRS. Internal Revenue Manual 9.4.2, Sources of Information, addresses numerous suitability factors to consider in evaluating informants. The background, motivation, history of providing reliable information, and ability to independently corroborate testimony are all important factors which the special agent, SAC, CT Counsel, and the attorney for the government must consider in evaluating an informant's credibility.

After presenting the facts in a documentary manner, the special agent will summarize the evidence and draw conclusions that ultimately establish probable cause. The conclusion section will specifically state who violated the law, what criminal statutes were violated, where the evidence of the violation exists, and when the violations occurred. Almost every CI search warrant can be described as a financial search warrant because the purpose of any such warrant is to seize financial records. Due to the unique nature of financial investigations, the courts allow the affiant to draw conclusions based upon the special agent's experience and expertise, as well as the available documentary evidence. For example, based upon his/her experience in other investigations, the affiant may draw conclusions about the normal industry practices or the location and types of records that a particular business or individual may keep. Conclusions are not considered probable cause; instead, they support the finding of probable cause.

Throughout the search warrant approval process, the special agent can expect to receive requests for additional information from his/her approving officials. Such requests often seek source documentation to support statements contained within the affidavit. In addition, if the investigation ultimately results in a criminal prosecution, the subject will likely file a motion to suppress the evidence seized pursuant to the search warrant. For these reasons, having a "working copy" of the affidavit, which is organized in such a manner that each line in the affidavit can be traced to supporting documentation can be very helpful. Much like a prosecution recommendation report, but on an informal scale, the working copy of the affidavit is prepared with references. While formal evidence folders are not necessary, some organized means of easily retrieving the source documentation can make the approval and/or motion to suppress processes much simpler. Further, since time is essential to preserving the evidence, the reviews of CT Counsel; the SAC; DOJ, Tax Division; and the attorney for the government will be facilitated by a well-prepared and supported affidavit.

Under the particularity requirement of the Fourth Amendment, the courts consistently hold that the items to be seized must have a nexus to the underlying criminal offenses alleged in the affidavit. Evidence that is seized and found to exceed the scope of the search warrant will be suppressed and declared inadmissible at trial.

When preparing the list of items to be seized, the special agent must be specific as to the nature, type, and time frame of items and records to be seized. Use of "catch-all" phrases, such as " any and all records" , will be avoided as they imply an overly broad and non-specific search methodology.

There is an exception to the particularity requirement known as the permeated with fraud theory. If a business is so "permeated with fraud" that there are no records in existence which are devoid of evidence of the underlying criminal offenses, then all the records of the business may be seized. In these instances, the affidavit will specifically state that the business is "permeated with fraud" and describe in sufficient detail why all the records represent evidence of the alleged offenses.

The CIS will provide the proper language to be included describing computer hardware, software, and peripherals to be seized.

A magistrate judge will review the Application for Search Warrant, along with the affidavit, items to be seized, and a description of the premises to be searched, and will determine if there is probable cause that a crime was committed, that evidence of the crime exists, and that the evidence is located at the particular location specified. If the judge decides that probable cause does exist, he/she will sign the search warrant, authorizing the search of the location specified, for the items specified.

Federal Rules of Criminal Procedure, Rule 41 (e)(2), directs the officer to:

The inventories should indicate which items were seized as contraband and also indicate if any items were returned to the custodian. The special agent will obtain a receipt for any items returned to the custodian or turned over to other Federal, state, or local law enforcement officials.

In all circumstances where CI is involved in a search warrant that is being executed or served, the EARF is required to establish the basis for the action and to document the SAC’s approval of the enforcement action or involvement in the enforcement action.

Only one EARF need be prepared for multiple related sites and/or multiple related enforcement actions on the same investigation/same day.

The narrative to support CI’s involvement must be articulated in the appropriate sections of the form, following the criteria established in subsection 9.4.9.2. When one form is prepared for multiple sites, the narrative will contain justification for CI's participation in each site, along with the discussion of intrusiveness for tax investigations. Do not indicate that the reviewer should refer to the affidavit for information. In any enforcement operation, the SAC has the ultimate authority to approve and commit any available sources (except where Director, Field Operations approval is required for sensitive cases).

Completion of the Risk Assessment Guide (RAG) is required for all CI search warrants except those which are served on accounts of a Federally insured bank or financial institution, another Federal agency, or search warrants served via fax or mail. In addition, when CI is the affiant, completion of the RAG is not required for search warrants executed on safe deposit boxes, stock accounts, electronic accounts, and other non-physical locations.

One Risk Assessment Guide will be prepared for each search warrant site.

A Risk Assessment Guide is not required in investigations where CI is assisting other Federal, state, or local agencies; however, at the discretion of the SAC, a Risk Assessment Guide may be warranted.

Special agents may fully participate in every aspect of an enforcement action involving medium or low risk CI search warrants.

If a determination is made that entry into a premises or structure presents a high risk situation, special agents will not engage in the entry. Other means, such as the use of specially trained entry teams from other local, state, or Federal agencies will be considered. In these situations, once entry is made and the location is secured, special agents will then be permitted to enter and complete the search.

The Search Warrant Checklist (see Document Manager) will be prepared for all CI search warrants. Only one Search Warrant Checklist should be prepared for multiple related sites on the same investigation/same day.

A Search Warrant Checklist is not required in investigations where a CI special agent is assisting other Federal, state, or local agencies.

A Search Warrant Plan, (see Document Manager), will be prepared for all CI search warrants. One search warrant plan will be prepared for each search warrant site.

This plan is not required in investigations where a CI special agent is assisting other Federal, state, or local agencies; however, it is recommended that the operational plan of the other law enforcement entity be made a part of the EARF, along with the special agent’s articulation of the need for CI involvement.

Criminal Tax Counsel will review all CI search warrants for legal sufficiency and probable cause. In Title 26 and tax-related Title 18 money laundering investigations, CT Counsel will also evaluate the intrusiveness issue. Subsequent to his/her review, CT Counsel will provide written advice to the SAC for his/her consideration in the search warrant approval process.

The SAC is required to obtain written concurrence from the respective Director, Field Operations, for the execution of a search warrant in a sensitive investigation (as defined in IRM 9.4.1 (see Approving a Subject Criminal Investigation)).

The SAC will obtain written concurrence from the respective Director, Field Operations, when a search warrant which targets an individual requiring DOJ, Tax Division approval is being considered (see subsection 9.4.9.3.3.3 below). Criminal Tax Counsel review is required prior to forwarding the search warrant to the Director, Field Operations for concurrence.

Pursuant to DOJ, Tax Division, Directive No. 52, the local United States Attorneys Office can approve most Title 26 and tax-related Title 18 search warrants. However, DOJ, Tax Division retains exclusive authority to approve Title 26 and tax-related Title 18 search warrants directed at offices, structures, or premises owned, controlled, or under the dominion of a subject of an investigation who is:

It should be expected that due to the sensitivity of these professions, this additional scrutiny may require a longer period of review. As soon as possible, the SSA should consult with a CT Counsel and DOJ, Tax Division attorney for general guidance on questions regarding the language and details of the affidavit. General questions that can be resolved early will facilitate the review process. However, the specifics of the investigation cannot be disclosed to the DOJ, Tax Division attorney until the SAC makes a referral to the DOJ, unless the case is being investigated by a grand jury.

Once the SAC concurs with the search warrant (signed the EARF) and advises the Director, Field Operations of the proposed action, the following documents will be forwarded to DOJ, Tax Division as a referral:

Chain of custody is the preservation by successive custodians of the evidence of a crime or any relevant writing in its original condition. Documents or other physical objects may be the instruments used to commit a crime and are generally admissible as such. However, the trial judge must be satisfied that the writing or other physical object is in the same condition as when the crime was committed.

In financial investigations, it may be months or years between the time the evidence is obtained and judicial proceedings. During this time, the documents or other physical objects may have been transferred between two or more special agents or several different special agents may have accessed the original evidence. In order for documents or other physical objects to be admissible as evidence, it is necessary to prove the items are in the same condition as when they were seized, since failure to maintain the evidence in its original condition could jeopardize admissibility.

The custody and storage of seized computers requires additional precautions. The investigating special agent along with the CIS are both responsible to see that the following is maintained in relation to computers:

The witness through whom the instrument is to be introduced into evidence must be able to identify it as being in the same condition as when it was recovered.

In order that a seized item may be admissible as evidence, it is necessary to prove that it is the same item that was seized and is in the same condition as when it was seized. Since several persons may handle the evidence in the interval between the seizure and the judicial proceedings, it should be adequately marked at the time of seizure for later identification.

Contraband is any property that is unlawful to possess. Narcotics, stolen property, and other contraband should be photographed, seized, and recorded on a separate inventory. When possible, an appropriate Federal or local law enforcement agency should be called to the search warrant scene to take custody of the contraband.

Weapons are not necessarily contraband. When found at search warrant sites, weapons should be cleared and secured. All firearms recovered in the course of the criminal investigation and taken into Federal custody should be traced through the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF’s) electronic firearms trace submission system (eTrace) at the earliest time practicable. If weapons are legally owned, they should be returned to the rightful owner at an appropriate time after the execution of the search warrant (see IRM 9.7.12, Evidence Seizures, for additional guidance relating to tracing of firearms in connection with criminal investigations).

Currency seized for forfeiture or as evidence falls within prescribed the procedures of IRM 9.7.6, Custody and Storage of Seized Assets. Special agents should review the IRM section for the proper procedures for the handling of currency at search warrant sites. The field office AFC must be notified when currency is seized to ensure the proper storage/deposit of the funds.

Evidence not covered within the scope of the search warrant can only be seized by obtaining a new search warrant or from obtaining the consent of the owner of the property. Form 6884, Voluntary Consent to Search of Person, Premises or Conveyances, (see Document Manager), should be included in the search warrant kit for such instances. Proper planning will foresee outbuildings, garages, vehicles, etc. that will require a separate search warrant.

For computer and/or electronic evidence such as computer hard drives, floppy disks, and computer compact discs (CDs), the evidence will be transferred to the CIS agent. Audio and videotapes should be transferred to the technical equipment agent. These technical personnel have the expertise and specialized training in the proper custody and analysis of such evidence. After processing, he/she can either maintain the original evidence or transfer it to the investigating special agent/evidence custodian along with the working copies that have been processed.

Exit photographs and/or video should be taken to document the condition of the premises at the conclusion of the search. A copy of the search warrant and inventory (not the affidavit) will be left at the premises or with a person in control of the premises. The site will be secured before the team leader leaves the premises.

In order to preserve, in its original condition, all evidentiary material that may be offered into evidence, seized material such as records, recordings, videotapes, document, and other physical objects should be tracked so the custody and control of the evidence can be documented at all times.

Evidence Tag Log forms will be used to record and track the transfer of evidence. Such forms will also be used jointly with Form 13437, National Forensic Laboratory Request for Service, to record the chain of custody transfer of evidence to a forensic examiner or laboratory. This form was designed for use when any evidence is transferred from one custodian to another. It also enables a custodian to keep track of and retain multiple chain-of-custody forms. For example, use of the form will show a change in an investigating special agent/custodian, transfer of evidence to a forensic examiner or laboratory for analysis, or a temporary transfer of evidence to an AUSA for presentation in a judicial proceeding.

The Evidence Access Control Log form is designed to record and document all access to controlled areas where evidence is stored. The form is formatted to record access to the storage location or a specific evidence storage container such as a wire cage, file cabinet, envelope, box, etc. The official evidence custodian is required to record an access entry no more than one time per day. Everyone else is required to record an access entry for each and every instance when they enter the controlled access area. The "notes" section for each access entry, except those for the official evidence custodian, is used to record specific information about the purpose for entering the controlled access area, identify what evidence was accessed, and specify the reason for accessing the evidence. The form is kept with the evidence at the secured storage location.

The investigating special agent may request laboratory examination of certain items of evidence. In selecting evidence to be sent to an examiner or laboratory for examination, it may be necessary to remove a selected item from its storage container.

Investigators can subpoena basic subscriber information. The ECPA permits the government to compel two kinds of information using a subpoena. First, the government may compel the disclosure of the basic subscriber information (discussed above) listed in 18 USC §2703(c)(2):

Investigators can subpoena opened e-mail from a provider if they comply with the notice provisions of 18 USC §2703(b)(1)(B) and 18 USC §2705. This notice is not the notice required under 26 USC §7609(a)(3)(A), third-party recordkeepers. In general, internet service providers are not third-party recordkeepers.

Agents who obtain a subpoena, and either give prior notice to the subscriber or comply with the delayed notice provisions of 18 USC §2705(a), may obtain:

As a practical matter, this means that agents can obtain opened e-mail (and other stored electronic or wire communications in "electronic storage" the more than 180 days) using a subpoena, so long as they comply with the ECPA's notice provisions. See House of Representatives, Public Law 99-647, at 64-65 (1986).

The notice provisions can be satisfied by giving the customer or subscriber "prior notice" of the disclosure (see 18 USC §2703(b)(1)(B)). However, 18 USC §2705(a)(1)(B) and 18 USC §2705(a)(4) permit notice to be delayed for 90 days "upon the execution of a written certification of a supervisory official that there is reason to believe that notification of the existence of the subpoena may have an adverse result." See 18 USC §2705(a)(1)(B).

Special agents need a 18 USC §2703(d) court order to obtain most account logs and most transactional records.

Special agents who obtain a court order under 18 USC §2703(d) may obtain:

The governmental entity must offer specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation.

This standard does not permit law enforcement merely to certify that it has specific and articulable facts that would satisfy such a showing. Rather, the government must actually offer those facts to the court in the application for the order.

Investigators can obtain everything in an account except for unopened e-mail or voice mail stored with a provider for 180 days or less using a 18 USC §2703(d) court order that complies with the notice provisions of 18 USC §2705.

Agents who obtain a court order under 18 USC §2703(d), and either give prior notice to the subscriber or else comply with the delayed notice provisions of 18 USC §2705(a), may obtain:

As an alternative to giving prior notice, agents can obtain an order delaying notice for up to 90 days when notice would seriously jeopardize the investigation. In such cases, agents generally will obtain this order by including an appropriate request in the agents' 18 USC §2703(d) application and proposed order. The legal standards for obtaining a court order delaying notice mirror the standards for certified delayed notice by a supervisory official. The applicant must satisfy the court that "there is reason to believe that notification of the existence of the court order may . . . endanger the life or physical safety of an individual; lead to flight from prosecution; lead to destruction of or tampering with evidence; lead to intimidation of potential witnesses; or . . . otherwise seriously jeopardize an investigation or unduly delay a trial." Importantly, the applicant must satisfy this standard anew every time the applicant seeks an extension of the delayed notice.

Investigators can obtain the full contents of an account with a search warrant. The ECPA does not require the government to notify the customer or subscriber when it obtains information from a provider using a search warrant.

Special agents who obtain a search warrant under Rule 41 of the Federal Rules of Criminal Procedure (Fed. R. Crim. P. R41) or an equivalent state warrant may obtain:

In other words, agents can obtain every record and all of the contents of an account by obtaining a search warrant based on probable cause pursuant to Fed. R. Crim. P. R41. The search warrant can then be served on the service provider and compels the provider to divulge to law enforcement the information described in the search warrant. Notably, obtaining a search warrant obviates the need to give notice to the subscriber (see 18 USC §2703(b)(1)(A)).

Title 18 USC §2703(f) imposes on the provider of wire or electronic communication services or a remote computing service the obligation, upon the written request of a governmental entity, to take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process. Exhibit 9.4.9-1 is a sample of a 18 USC §2703(f) "Preservation Letter" .