Timeline: Arrest Of The Darknet Market Vendor ‘Caliconnect’
David Ryan Burchard, a 38 year old man from Merced, California, was recently arrested last Monday and is accused of distributing marijuana and cocaine throughout the United States using several darknet markets including the Silk Road, Agora, Abraxas, and AlphaBay under the moniker “Caliconnect”. Federal authorities estimate that the total worth of every transaction made by Caliconnect is $1.43 million.
This investigation involved several agencies and people including the:
- US. Immigration and Customs Enforcement’s (ICE)
- Homeland Security Investigations (HSI)
- Internal Revenue Service-Criminal Investigation
- US. Postal Inspection Service
- Fresno Police Department
- Trial Attorney Anitha Ibrahim of the U.S. Department of Justice’s Computer Crimes and Intellectual Property Section
It all started early last year on March 2015 when HSI agent Matthew Larsen began investigating Burchard for “his sale of millions of dollars of Bitcoins to an unlicensed digital currency exchanger.”
March 18, 2015
Surveillance was conducted on his residence and vehicle via GPS. The surveillance revealed Burchard mailed a few parcels at a post office.
March 20, 2015
Surveillance footage was obtained by Postal Inspector Jessica Burger which showed a man that looked like Burchard mailing the parcels. Burger confirmed that was Burchard when she was shown a picture of him, and not only that, but she recognized him from a previous investigation where Burchard sent a parcel to an address that was empty and was subsequently sent back to the sender. Marijuana was found in the parcel after a search was conducted on it.
March 21, 2015
Burger reviewed video footage of Burchard mailing the parcel on March 18th and seized the parcel.
March 25, 2015
HSI agents observed Burchard attempting to mail a couple parcels that were addressed to an individual in North Carolina. The parcel was retrieved from the mail bin and sent to Postal Inspectors in North Carolina.
March 27, 2015
Burger obtained a search warrant for the seized parcel that Burchard attempted to mail on March 18th.
March 31, 2015
Burger went to HSI’s office in Fresno, and with Larsen, search the seized parcel from March 18th and found marijuana. A records check on the return address yielded a negative result.
May 1, 2015
A report from the North Carolina-based Postal Inspector came back which revealed that on March 30th the addresses on the parcels were found to be bogus and that a K-9 unit indicated that the parcels contained a controlled substance. A search warrant for the parcel was obtained on April 3rd. The Postal Inspector found marijuana when he searched the parcel. Larsen looked at the pictures of the contents of the parcels and noted that it is similar to parcels Burchard has mailed before.
May 5, 2015
Larsen spoke to the North Carolina-based Postal Inspector who said that field tests on the parcel for marijuana returned a positive result and that he had the marijuana destroyed on April 17th
June 3, 2015
HSI learned that Burchard trademarked “caliconnect”. Investigators looked on the internet for information about caliconnect and found reddit posts about people who claimed to have ordered marijuana from the vendor Caliconnect. Larsen reviewed the Silk Road vendor list provided by HSI Headquarters and found Caliconnect on that list. The list was provided to Larsen in March 2015.
June 11, 2015
Larsen learned that Caliconnect was estimated to be the 18th largest vendor on Silk Road with an estimated sales volume at $1,250,248.65.
Larsen discovered a vendor on Agora going by “the_real_caliconnect” who was selling marijuana. This vendor claimed to be the Caliconnect from the Silk Road, Silk Road 2.0, and the Black Market Reloaded. At the time of this discovery, the_real_caliconnect was in vacation mode.
June 13, 2015
Larsen learned that the_real_caliconnect was no longer in vacation mode.
July 20, 2015
Larsen found postal tracking numbers from presumably unencrypted private messages between Caliconnect and his customers from the Silk Road data. These tracking numbers were sent to a Postal Inspector.
July 21, 2015
Larsen reviewed the Postal Inspector’s findings and found that every post office used to send the parcels associated with the tracking numbers were located near Burchard’s home.
September 11, 2015
Larsen learned from the DEA that the username “caliconnect2” bought phentermine from the Silk Road.
September 29, 2015
At 12:00 PM Larsen and another HSI investigator went to Raley’s Supermarket – a supermarket where you can ship parcels from. Larsen showed a picture of Burchard to an employee there and was immediately recognized. At 1:02 PM, the employee contacted Larsen saying that Burchard had dropped off three parcels. He obtained the addressees and return address. A record check on the company on the return address yielded nothing but he did find out that the address itself on the return address is one street east of Burchard’s previous address.
October 5, 2015
The employee notified Larsen again that Burchard sent 3 more parcels. Larsen didn’t act on them.
October 6, 2015
Raley’s gave photos from the surveillance cameras to Larsen showing a white male that looks like Burchard mailing the parcels.
Larsen dug into the Silk Road private messages between Caliconnect and his customers and found that he at one point accepted Green Dot MoneyPaks as a form of payment instead of bitcoin.
October 18, 2015
Larsen subpoenaed Green Dot for information about the MoneyPak codes referenced in the private messages.
October 30, 2015
Larsen received a response from Green Dot. Out of the 12 codes Larsen requested information on, Green Dot was only able to provide information on 1 of them. Green Dot indicated that money was sent from the one code to a AccountNow Prepaid Visa card that was registered to David Burchard. They also told Larsen that his card was blocked from receiving funds because they believed he was partaking in fraudulent activity.
November 13, 2015
Intern Mann searched the_real_caliconnect’s PGP key on Grams and discovered a vendor named “caliconnect4life” who was on AlphaBay. HSI learned that caliconnect4life became a vendor on November 10th.
November 18, 2015
Larsen learned from the FBI that “caliconnect2” was a vendor on the Silk Road according to private messages between caliconnect2 and “asianvixen”. Larsen also learned that caliconnect2 bought a fake ID; caliconnect2 told the vendor to put David Burchard on the mailing label. Benzodiazepine was also purchased by caliconnect2 which was shipped to David Burchard.
Upon review of 977 transactions related to Caliconnect on the Silk Road, HSI determined that 704 pounds of marijuana and 10.5 grams of cocaine was sold by Caliconnect.
November 25, 2015
Larsen followed Burchard to Raley’s and watched him mail a parcel. He obtained pictures of the parcels and learned the tracking number, addressees, and returning address. He didn’t seize the parcel.
December 15, 2015
Larsen reviewed a subpoena response from AccountNow for the Prepaid Visa card. The information from the response matched what Larsen had on Burchard.
December 29, 2015
Larsen, Intern Mann, and Fresno Police Department Detective Daniel conducted a controlled purchase of a half-pound of marijuana from caliconnect4life under the name “Megiddo”. They purchased the strain “OG Crack” for $900. The marijuana was set to be delivered to Buffalo, New York.
December 31, 2015
At 2:05, Larsen and Intern Mann followed Burchard to Raley’s. At 2:20, the employee confirmed that Burchard had mailed four parcels moments earlier. At 4:53, a Postal Inspector told Larsen that the parcel mailed by Burchard was addressed to the address Megiddo specified.
January 1, 2016
Megiddo received a private message from caliconnect4life saying when to expect a delivery.
January 4, 2016
Larsen received the parcel that was sent to Buffalo, York from HSI SA Brad Brechler. SA Brechler told Larson that the suspected marijuana weighed approximately 289 grams. Larsen noticed the packaging was similar to the other parcels mailed by Burchard. Larsen handed the parcel and the contents to Detective Vandersluis; a chemical analysis of it is still pending.
January 20, 2016
Larsen obtained a search warrant for Burchard’s residence.
January 21, 2016
The search warrant was executed by Larsen, other HSI agents, the IRS, the USPIS, the Merced Police Department, and California Highway Patrol.
At 7:10 AM, a knock and notice. Burchard, his spouse, and 3 children were found. No incident. Various computers and storage devices were seized along with items commonly associated with narcotics. Clothing was found with the label “caliconnect” on it.
At 10:40 AM, HSI searched storage units under Burchard’s control after he signed a DHS “Consent to Search” form. They found a credit card machine with blank cards suggesting Burchard was involved in fraudulent activities.
Burchard was interviewed, he denied selling marijuana but did say that Caliconnect was the name of his clothing brand. Burchard’s wife was interviewed as well.
Computer forensics on Burchard’s computer and storage devices revealed a lot of incriminating evidence. Caliconnect’s logo that was used on AlphaBay was found along. Decrypted PGP messages was provided by the computer forensics agent. Bruchard’s PGP password was “asshole209” which was apparently reused since it was a password given to the computer forensics agent by Larsen which was obtained from subpoenaed records. One of the 49 PGP messages retrieved was the same one caliconnect4life sent to Megiddo. Burchard’s bitcoin wallet was found as well.
Special Agent Ryan L. Spradlin who was in change of HSI San Fransisco made the statement “HSI and our partners are at the forefront of combating illicit activities and financial crimes now seen in virtual currency systems, Criminals continue to spread their businesses through online black-markets using digital currency like Bitcoin, however they do not escape the reach of law enforcement who will continue to investigate, disrupt, and dismantle hidden illegal networks that pose a threat in cyberspace.”
You can view Burchard’s criminal complaint in its entirety here.