Gunsmoke Guns Search Warrant Affidavit

7/29/2019 Gunsmoke Guns Search Warrant Affidavit

1/35

AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURTfor the

District of Colorado

In the Matter of the Search of(Briefly describe the property to be searchedor identify the person by name and address)

Business located at9690 West 44th Avenue, Wheatridge, Colorado80033more fully described in Attachment A,

attached hereto.

)

))

)

))

)

Case No.

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under

penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe theproperty to be searched and give its location):

SEE ATTACHMENT A, which is attached to and incorporated in this Application and Affidavit

located in the State and District of Colorado , there is now concealed (identify the person or describe theproperty to be seized):

SEE ATTACHMENT B, which is attached to and incorporated in this Application and Affidavit

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):; evidence of a crime;; contraband, fruits of crime, or other items illegally possessed;; property designed for use, intended for use, or used in committing a crime;

a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section Offense Description

26 U.S.C. 7201, 7203 Tax Evasion

X Continued on the attached affidavit, which is incorporated by reference.

Delayed notice of days (give exact ending date if more than 30 days: ) is requestedunder 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet.

s/Benjamin G. HoppingApplicants signature

Benjamin G. Hopping, IRS-CI

Printed name and titleSworn to before me and: signed in my presence.

submitted, attested to, and acknowledged by reliable electronic means.

Date:Judges signature

City and state: Denver, COPrinted name and title

X e y re a e e ec ron c means.

BoydN.Boland

UnitedStatesMagistrateJudge

August 25, 201205 Mar 2013

13-sw-05213-BNB

Case 1:13-sw-05213-BNB Document 1 Filed 03/05/13 USDC Colorado Page 1 of 35


2/35

1

Attachment A

Based on my personal observations, the premise to be searched,

9690 West 44th Avenue, Wheatridge, Colorado 80033, is a one-

story, business attached to other businesses located on the

Southeast corner of the intersection of West 44th Avenue and

Iris Street in Wheat Ridge, Colorado. The premise is located on

the north-facing side of the business complex. The premise to

be searched is also identified by a sign above the front door

that reads Gunsmoke, Inc. The premise has a green canvassed

wagon affixed to the roof.



3/35

1

Attachment B

1. Based on the foregoing and my training and experience

as Special Agent with the Criminal Investigation Division of the

Internal Revenue Service, I respectfully submit that there is

probable cause to believe that for the period of January 1, 2006

to the present, the following items, which constitute evidence

of the commission of, contraband, the fruits of crime, or

instrumentalities of violations of Title 26, United States Code

7201 and 7203 for tax years 2006, 2007, 2008, 2009, 2010 and

2011 will be found at the PREMISES.

2. Personal and business financial records, specifically,

bank and brokerage account records, checks, deposits,

statements, check registers, savings passbooks, withdrawal

slips, certificates of deposit (CD) documents, wire transfers,

cashiers checks, money orders, financial statements, credit

applications, bank and brokerage account applications, loan

documents, loan payments, loan statements, invoices, receipts

and/or bills, ledgers, journals, notes, correspondence or other

records of RICH WYATT, RENEE WYATT and their business Gunsmoke,

Inc. for the years 2008, 2009, 2010 and 2011.

3. Originals or copies of completed Federal Income Tax

Returns for the tax years 2008, 2009, 2010 and 2011 (Forms 1040,



4/35

2

1040A, 1040EZ, 1040PC, 1040X, 1120, 1120S and 1065).

4. With respect to the above returns, all forms,

schedules, and attachments thereof, including Schedule A

(Itemized Deductions); Schedule B (Interest and Dividend

Income); Schedule C (Profit or Loss From Business); Schedule D

(Capital Gains and Losses); Schedule E (Supplemental Income and

Loss); Schedule EIC (Earned Income Credit Qualifying Child

Information); Forms 2441 (Child and Dependent Care Expenses);

Forms W-2 (Wage and Tax Statement); Forms 1099 (Non-Employee

Compensation Statements); Forms 8453 (U.S. Individual Income Tax

Declarations for Electronic Filing); worksheets and/or

supporting documentation used in the preparation of tax returns;

records identifying the taxpayers for whom these tax returns

have been prepared; and other documents used in the creation

and/or preparation of the above mentioned tax returns.

5. Bank account information for the years 2008 through

2012 including statements, records reflecting dates and amounts

of deposits, copies of checks, withdrawals, interest, debit and

credit memos, deposit slips, checks deposited, withdrawal slips,

and checks issued for withdrawals, Forms 1099 received.

6. Computer(s), computer hardware, computer software,

computer related documentation, computer passwords and data

security devices, digital storage media, any physical object



5/35

3

upon which computer data can be recorded, gaming devices,

digital communications devices, cellular telephones, cameras,

videotapes, video recording devices, video recording players,

and video display monitors, digital input and output devices

such as keyboards, mouse(s), scanners, printers, monitors,

electronic media and network equipment, modems, routers,

connection and power cords, and external or connected devices

used for accessing computer storage media that was used to

commit or facilitate commissions of Title 26 U.S.C. 7201,

7203.

7. For any computer, computer hard drive, or other

physical object upon which computer data can be recorded

(hereinafter, COMPUTER) that is called for by this warrant, or

that might contain items otherwise called for by this warrant:

a. evidence of who used, owned, or controlled the

COMPUTER at the time the items described in this warrant were

created, edited, or deleted, such as logs, registry entries,

configuration files, saved usernames and passwords, documents,

calendars, browsing history, user profiles, e-mail, e-mail

contacts, "chat" or instant messaging logs, photographs, and

correspondence;

b. evidence of software that may allow others to

control the COMPUTER, such as viruses, Trojan horses, and other



6/35

4

forms of malicious software, as well as evidence of the presence

or absence of security software designed to detect malicious

software;

c. evidence of the lack of such malicious software;

d. evidence of the attachment to the COMPUTER of

other storage devices or similar containers for electronic

evidence;

e. evidence of counter-forensic programs (and

associated data) that are designed to eliminate data from the

COMPUTER;

f. evidence of the times the COMPUTER was used;

g. passwords, encryption keys, and other access

devices that may be necessary to access the COMPUTER;

h. documentation and manuals that may be necessary

to access the COMPUTER or to conduct a forensic examination of

the COMPUTER;

i. contextual information necessary to understand

the evidence described in this attachment;

j. volatile data necessary to preserve evidence

prior to powering-off and unplugging a running computer.

k. any and all information, notes, software,

documents, records, or correspondence, in any format and medium



7/35

5

pertaining to violations of Title 26 U.S.C. 7201, 7203.

8. If evidence located on a COMPUTER appears to relate to

criminal acts other than violations of Title 26 U.S.C. 7201,

7203, and that are not listed in this Attachment, those items

will not be further examined unless and until a search warrant

is applied for and issued for evidence of any such separate

criminal act.

DEFINITIONS:

9. As used above, the terms "records" and "information"

include all of the foregoing items of evidence in whatever form

and by whatever means they may have been created or stored,

including any form of computer or electronic storage (such as

hard disks or other media that can store data); any handmade

form (such as writing, drawing, painting); any mechanical form

(such as printing or typing); and any photographic form (such as

microfilm, microfiche, prints, slides, negatives, videotapes,

motion pictures, or photocopies).



8/35

AFFIDAVIT

I, Benjamin G. Hopping, being duly sworn, hereby depose and

state:

INTRODUCTION

1. I am a Special Agent (S/A) with the Internal Revenue

Service (IRS), Criminal Investigation (CI) and have been so

employed since 2001. I have been trained in accounting and

financial investigative techniques at the Federal Law Enforcement

Training Center (FLETC). My formal education includes a

Bachelors degree in Accounting from the University of Northern

Colorado. During my years as a Special Agent with IRS-CI I have

conducted multiple investigations involving criminal tax and

money laundering violations. During these investigations I have

gained experience in debriefing defendants, cooperating witnesses

and other persons who have had personal experience and knowledge

of the activities associated with fraud schemes and other

criminal violations.

2. Based on my review of information obtained from IRS

computer records, conversations with other S/As, and information

obtained from other sources, I am familiar with the facts and

circumstances of this investigation.

PURPOSE

3. I make this affidavit in support of an application for

a warrant to search: GUNSMOKE, INC. located at 9690 West 44th



9/35

Avenue, Wheat Ridge, CO 80033. (THE PREMISES). This affidavit

does not purport to set forth all of my knowledge of or

investigation into this case.

PREMISES TO BE SEARCHED

4. Based on my personal observations, THE PREMISES is a

one-story, business located on the Southeast corner of the

intersection of West 44 Avenue and Iris Street in Wheat Ridge,th

Colorado. THE PREMISES is identified by a sign above the front

door that reads Gunsmoke, Inc. THE PREMISES has a green

canvassed wagon affixed to the roof.

5. Based on the following facts set forth in this

affidavit, I believe that there is probable cause to believe that

WYATT and others have committed violations of Title 26, United

States Code, Sections 7203 and 7201(Failure to File Tax Returns

and Tax Evasion) for the tax years 2006 through 2011. I further

believe that there is probable cause to believe that evidence,

instrumentalities, and fruits of the crimes described above will

be found at THE PREMISES located at 9690 West 44th Avenue, Wheat

Ridge, CO 80033, which location is more fully described in

Attachment A, which is attached hereto and incorporated herein by

reference.

2



10/35

RELEVANT STATUTES

6. Title 26, United States Code, Section 7203 (Failure to

File Tax Returns), Any person required under this title to pay

any estimated tax or tax, or required by this title or by

regulations made under authority thereof to make a return, keep

any records, or supply any information, who willfully fails to

pay such estimated tax or tax, make such return, keep such

records, or supply such information, at the time or times

required by law or regulations, shall, in addition to other

penalties provided by law, be guilty of a misdemeanor.

7. Title 26, United States Code, Section 7201(Evasion of

Assessment), Any person who willfully attempts in any manner to

evade or defeat any tax imposed by this title or the payment

thereof shall, in addition to other penalties provided by law, be

guilty of a felony.

KNOWLEDGE AND EXPERIENCE OF AFFIANT

8. Based upon your affiants experience, knowledge, and

training, your affiant knows business owners typically maintain

business records at their business location, at their residence

and/or on their person. Your affiant also knows it is common

practice for businesses to maintain records of income, expenses,

profit or loss and asset acquisition and disposition. These

records would include Forms W-2 and 1099, billing records,

3



11/35

invoices, receipts, prepared books and records, canceled checks,

bank and stock brokerage statements, deposit slips, check stubs,

payroll records, records of capital assets, cash disbursement and

receipt journals, general ledgers, subsidiary ledgers, financial

statements, loan applications, business income and information

tax returns, prepared income tax worksheets and schedules,

business contracts, and other records showing the receipt and

disposition of funds. Your affiant knows from experience in

dealing with business records, the flow of funds into and out of

a business can be tracked by tracing the paper trail. The paper

trail is created by the entries into the business records and

bank accounts, and by the documents received or prepared to

support a transaction. Your affiant also knows that original

business records are ordinarily kept and maintained for extended

periods of time, often several years. Your affiant also knows it

is common practice for businesses to maintain records of the

acquisition and disposition of assets. These records would

include: titles, deeds, mortgages, leases, loan applications,

sales agreements and other records related to ownership.

9. Based on my discussions with ATF Special Agent Nicholas

Horn I understand that Federal Firearms Licensees or FFLS are

required to maintain records of all firearms transactions as

described in Title 27, Chapter II, Code of Federal Regulations

4



12/35

(CFR) Chapter II part 478, section 478.121

a. Specifically, this section states, The records

pertaining to firearms transactions prescribed by this part shall

be retained on the licensed premises in the manner prescribed by

this subpart and for the length of time prescribed by 478.129.

The records pertaining to ammunition prescribed by this part

shall be retained by this part shall be retained on the licensed

premises in the manner prescribed by 478.125. Section 478.129

as referred to in this statute states that all FFLS shall

maintain Form 4473, Firearms Transaction Record Part I, Over-the-

Counter for not less than twenty (20) years. Every record of a

firearm transaction is evidence of revenue (outgoing) earned by

Gunsmoke, Inc. or cost of goods sold (incoming) incurred by

Gunsmoke, Inc. According to ATF records, Gunsmoke Inc. was an

FFL from April 12, 2006 until May 3, 2012. On or about February

21, 2012, an existing FFL called Triggers was transferred to THE

PREMISES. Triggers holds a current FFL, but has agreed to

voluntarily surrender its license on April 1, 2013. When

Triggers changed its address to THE PREMISES and before or on the

date that Gunsmoke Inc. dissolved its FFL, all of Gunsmoke,

Inc.s firearms should have been entered as acquisitions in

Triggers A & D book as mandated by Title 27 478.121.

Therefore, the records of Gunsmoke Inc.s revenue and expenses

5



13/35

should still be located at the premises.

10. Based upon your affiant's experience, knowledge, and

training; your affiant knows individuals typically maintain

personal financial records at their residence, their business

location and/or on their person. Your affiant also knows it is

common practice for individuals to maintain records of personal

income and expenses. These records would include Forms W-2, 1098

and 1099, pay stubs, bank statements, brokerage statements,

canceled checks, deposit slips, certificates of deposit, records

of savings accounts, wire transfer records, credit card

statements and information, receipts, individual income tax

returns, and other records showing the receipt and disposition of

funds. Your affiant also knows it is common practice for

individuals to maintain records of the acquisition and

disposition of assets. These records would include titles, deeds,

mortgages, leases, loan applications, and other records related

to ownership.

11. As described above and in Attachment B, which

attachment is incorporated herein by reference, this application

seeks permission to search for records that might be found on the

premises, in whatever form they are found. One form in which the

records might be found is data stored on a computers hard drive

or storage media. Thus, the warrant applied for would authorize

6



14/35

the seizure of electronic storage media or, potentially, the

copying of electronically stored information.

12. With respect to the federal violations relating to tax

evasion and failure to file tax returns, from my experience and

training and through discussions with other law enforcement

agents, I know that:

a. Individuals engaged in an income-producing activity,

who wish to evade income tax on income earned by that activity,

often keep records in a form of another media, such as on a

computer, reflecting the true earnings of the business and

individually, in order to comprehend their true wealth for future

financing purposes, for obtaining property such as homes and

assets, or to sell the business;

b. Individuals engaged in an income-producing activity,

who wish to evade income tax on income earned by that activity,

often possess copies, in some form, of books and records

reflecting the true income of their activity, in their business.

EVIDENCE OF PROBABLE CAUSE

ATF Investigation

13. In or around June of 2010, S/A Nicholas Horn with the

Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)

received a referral from the Industry Operations division of the

ATF. According to the referral, Wyatt as manager of Gunsmoke,

7



15/35

Inc. unlawfully possessed six (6) fully automatic weapons in

violation of Title 18 U.S.C. 922(o). S/A Horn initiated an

investigation based on this referral.

14. During the ATF investigation, S/A Horn discovered that

although Wyatt manages and runs Gunsmoke, Inc. he is not the

owner of record. The owner of record is named Victor Rodriguez

(Rodriguez). S/A Horn contacted Rodriguez twice during his

investigation.

15. On or about June 25, 2010, S/A Horn contacted Rodriguez

and requested an interview. Rodriguez responded that he was out

of town and would not return until June 29, 2010. On or about

June 28, 2010, Wyatt contacted S/A Horn and told him that

Rodriguez had contacted Wyatt and asked him why S/A Horn

contacted him. Wyatt told S/A Horn that Rodriguez was just the

owner of Gunsmoke, Inc. and did not have a hand in the day-to-day

operations of the business. Wyatt told S/A Horn that all

questions related to S/A Horns investigation could be directed

to Wyatt because Wyatt ran the business.

16. On or about July 1, 2010, S/A Horn interviewed

Rodriguez. Rodriguez told S/A Horn that he purchased Gunsmoke,

Inc. from Wyatt in 2005 after Wyatt went through a serious

divorce. Rodriguez stated that he could not remember how much he

paid Wyatt for Gunsmoke Inc. Rodriguez stated that at the time

8



16/35

of the interview Gunsmoke Inc. was not profitable and he did not

receive any income from Gunsmoke Inc. Rodriguez stated he had an

agreement with Wyatt where Wyatt would purchase Gunsmoke Inc.

back from Rodriguez once the business became profitable.

Rodriguez stated that he and Wyatt agreed that Wyatt would

purchase Gunsmoke Inc. by paying Rodriguez a share of the

profits.

Secretary of the State of Colorado

17. Gunsmoke Inc. was incorporated with the State of

Colorado on February 1, 2006 by Rodriguez at 9690 West 44th

Avenue, Wheat Ridge, Colorado 80033. Rodriguez filed a

statement curing Gunsmoke Inc.s filing delinquency December 27,

2010. As of October 29, 2012 this entity is in noncompliant

status for failing to file a periodic report.

18. An entity named Gunsmoke Guns Inc. was incorporated

with the Colorado Secretary of State on April 29, 2011 by Wyatt

at The Premises. This is a different entity with a different

Colorado State identification number than Gunsmoke Inc. As of

October 29, 2012 this entity is in noncompliant status for

failing to file a periodic report.

Mutual of Omaha Bank

19. The Mutual of Omaha Bank provided a bank statement and

supporting documents for Gunsmoke Incs small business checking

9



17/35

account numbered 000600248428 for the month of August, 2011 to

IRS-CI personnel. The bank statement lists THE PREMISES as the

address for Gunsmoke, Inc. The bank statement shows that

Gunsmoke Inc. had a beginning balance of $27,119.05 and during

August, 2011, $99,666.79 was deposited and $121,847.21 was

withdrawn. The deposits include a check for $40,000 from Gurney

Productions. The check is made out to Gunsmoke, Inc. at THE

PREMISES. According to the website at,

www.gurneyproductions.com, Gurney Productions produces several

reality based television shows including American Guns on The

Discovery Channel. The other withdrawal and deposit items appear

to be for items related to the operation of a firearms retailer.

Discovery Channel

20. Wyatt and his family are part of a reality television

series on the Discovery Channel called American Guns.

According to the shows webpage at:

(http://dsc.discovery.com/tv/american-guns/), The Wyatts are

your typical suburban family except they just happen to own one

of the premiere firearms facilities in the world. Rich Wyatt and

his wife Renee own Gunsmoke, where they buy, sell and trade guns.

They -- and the one-of-a-kind and historic guns they make and

sell -- are featured in the all-new series AMERICAN GUNS.

10



18/35

Colorado Department of Revenue

21. According to the Colorado Department of Revenue,

Gunsmoke, Inc. has filed sales tax returns for the months of

January, 2008 through October, 2011 with the exceptions of

October of 2009 and March, 2010. Each return where the signature

is legible appears to bear the signature of Rich Wyatt, based on

a review of the signatures and the signature on Rich Wyatts

Colorado Drivers license. The fact that Wyatt signed the sales

tax returns confirms his statement to the S/A Horn that he runs

Gunsmoke, Inc. The 2011 sales tax returns for Gunsmoke, Inc.

reflect the following sales:

Month Net Sales

January, 2011 $18,211.00February, 2011 $12,006.00March, 2011 $9641.00April, 2011 $8279.00May, 2011 $7921.00June, 2011 $7997.00July, 2011 $6261.00August, 2011 $10,013.00

September, 2011 $11,937.00October, 2011 $14,060.00

Total Reported Net Sales 2011 $106,326.00

IRS Transcripts

22. According to IRS transcripts Wyatt did not file U.S.

Individual Income Tax Returns (Form 1040) for the 2008, 2009 or

2010 tax years. Wyatt filed a Form 1040 for the 2011 tax year

that lists a $98,751 loss from his interest in Gunsmoke, Inc.

11



19/35

There are no other sources of income listed on Wyatts 2011 Form

1040. Neither Gunsmoke Inc. nor Gunsmoke Guns Inc. has ever

filed Federal Income tax returns. Gunsmoke Inc. requested and

received an Employer Identification Number (EIN) in February of

2006. Gunsmoke Inc. has filed employment tax returns during 2007

through 2011 with the exceptions of the first and fourth quarters

of 2010 and the second and third quarters of 2011. Gunsmoke Inc.

reported to the State of Colorado the names of the employees it

paid and the amounts for each quarter. This information was used

to query the IRS Information Returns Processing database (IRP)

for each employee reported to The State of Colorado. The

resulting data is summarized below:

Wages Reported by Gunsmoke, Inc.

Employee Name Year Annual WagesReported to

Colorado

Annual WagesReported to

IRS

Darrell Flores 2007 $4,521.00 $3,058.00

2008 $2,527.20 $0.00

2009 $4,686.80 $0.00

2010 $5,463.80 $0.00

2011 $3,790.80 $5,102.00

Matthew Meece 2007 $13,157.15 $10,619.00

Renee Wyatt 2008 $1,421.00 $0.00

2009 $3,823.60 $0.00

2010 $3,418.00 $0.00

12



20/35

2011 $2,496.00 $66,000.00

Rich Wyatt 2007 $9,600.00 $8,641.00

2008 $7,200.00 $0.00

TOTAL $ 62,105.35 $ 93,420.00

Based on this analysis and with the exception of the $66,000 that

was reported to the IRS in 2011 on behalf of Renee Wyatt,

Gunsmoke, Inc. showed a pattern of materially underreporting the

wages it paid to its employees to the IRS.

23. Wyatts wife Renee Wyatt has filed Federal Income tax

returns for the tax years 2008 through 2011. Renee Wyatt

reported the following income:

Year Wages Interest Adjusted

Gross Income

Taxable

Income

2008 $3328.00 $163.00 $3491.00 $02009 $3328.00 $62.00 $3390.00 $0

2010 $3328.00 $0 $0 $02011 $66,000.00 $0 $64,500.00 $32,175.

Renee Wyatt did not have a Schedule C, Profit or Loss from

Business (Sole Proprietorship) attached to any of her 2008

through 2011 tax returns which indicates that Renee Wyatt did not

report any of the income from Gunsmoke, Inc. on her tax returns.

24. According to IRS transcripts, on or about December 14,

2012, First Data Merchant Services Corporation filed a Form 1099-

K, Payment Card and Third Party Network Transactions for credit

card sales paid to Gunsmoke at THE PREMISES during the 2011 tax

13



21/35

year. The EIN listed on the Form 1099-K is Wyatts Social

Security Number. According to the Form 1099-K, Gunsmoke had

$820,028 in credit card sales during 2011. This does not include

cash or check sales.

25. According to the Adams County, Colorado Clerk and

Recorder, the house located at 1164 W. 11 Place, Northglenn,th

Colorado is owned by Renee Reid, now known as Renee Wyatt. Wyatt

and Renee Wyatt are married and share this residence. Wyatt

lists this address on his Colorado Drivers License as his home

address.

26. According to the Jefferson County, Colorado Clerk and

Recorder, Renee Wyatt purchased the house and property located at

7156 Timbers Drive, Evergreen, Colorado 80439 on or about October

22, 2012 for $678,000. Renee Wyatt signed a Deed of Trust

secured by the property with Mutual of Omaha Bank for $400,000.

Based on the public records, Renee Wyatt paid approximately

$278,000 in addition to her mortgage to purchase this house.

27. An entity named Lake Shore Holdings, Inc. was

incorporated with State of Nevada on or about November 29, 2005.

Renee C. Wyatt with an address of 848 N. Rainbow Blvd # 1611, Las

Vegas, Nevada 89107 is listed as the President, Secretary,

Treasurer, and Director. According to the Palm Beach County

Appraiser, a condominium located at 1105 Lake Shore Drive, # 201,

14



22/35

Lake Park, Florida was purchased in June, 2008 for $163,500 by

Lake Shore Holdings, Inc. with a mailing address of 848 N.

Rainbow Blvd, # 1611, Las Vegas, Nevada. According to the Palm

Beach County Appraiser, another condominium located at 1115 Lake

Shore Drive, # 201, Lake Park, Florida was purchased in July,

2009 for $175,000 by Lake Shore Holdings, Inc. with a mailing

address of 848 N. Rainbow Blvd, # 1611, Las Vegas, Nevada.

28. According IRS transcripts, Lake Shore Holdings, Inc.

with the address of 848 N. Rainbow Blvd, # 1611, Las Vegas,

Nevada filed Form 1120, U.S. Corporation Income Tax Returns (Form

1120) for the years 2005 through 2011. The 2011 Form 1120 does

not list any income, assets or liabilities. The 2010 Form 1120

lists $504,698 in assets, $3,900 of gross rents and no

liabilities. Therefore it does not appear that the condominiums

are encumbered by any mortgages.

29. According to the Florida Department of Motor Vehicles a

1997 Mercedes Benz automobile was registered by Renee Christy

Wyatt with the same date of birth as the aforementioned Renee

Wyatt to 1115 Lake Shore Drive #201, West Palm Beach, Florida.

Based on the Nevada Secretary of State, the IRS transcripts and

the Florida Department of Motor Vehicles, it appears as though

Renee Wyatt opened a Nevada Corporation and purchased two

condominiums for a total of $338,500 either without mortgages or

15



23/35

has since paid the balance of any mortgages held. During the

same years that Renee Wyatts Nevada Corporation purchased the

condominiums (2008 and 2009), Renee Wyatt reported $3491 and

$3390 respectively of adjusted gross income to the IRS (see table

in paragraph 22).

30. According to the Jefferson County, Clerk and Recorder,

THE PREMISES is owned by a company called Trifecta Capital, Inc.

According to the Colorado Secretary of State, Trifecta Capital

Inc. was registered on February 21, 2006 by V. Manuel Rodriguez

as a foreign entity from Nevada. According to the Nevada

Secretary of State, as of September 27, 2012, the president,

secretary, treasurer and director of Trifecta Capital, Inc. is

Renee Wyatt. According to IRS records, Trifecta Capital, Inc.

has never filed a tax return.

31. According to the Colorado Department of Motor Vehicles,

Wyatt has no currently registered vehicles in his name.

Gunsmoke, Inc. has the following vehicles registered:

Vehicle Dated Registered Expires

2007 Range Rover SUV 2/25/2009 May, 20132004 GMC Truck 5/4/2011 May, 20122001 Audi Sedan 2/19/2011 April, 2013

32. According to IRS transcripts, Wyatt did not receive a

Form W-2, 1099 or Schedule K-1 from Gunsmoke Inc. or Gunsmoke

Guns Inc. for the years 2008 through 2011.

16



24/35

33. On or about February 27, 2013, S/A Horn entered THE

PREMISES and spoke to Wyatt. While inside THE PREMISES, S/A Horn

observed a computer and a filing cabinet inside a room that Wyatt

identified as his office. S/A Horn reviewed information on a

computer located inside THE PREMISES with an employee named Colt.

S/A Horn saw customer and employee information stored on this

computer. The information included the employee and customer

names, addresses and phone numbers. Wyatt told S/A Horn that he

lives in Evergreen, Colorado and that it took about thirty

minutes for Wyatt to travel from his house to THE PREMISES.

34. On or about February 27, 2013 Industry Operations

Investigator (IOI) Matthew Deasaro entered THE PREMISES and

reviewed the Acquisitions and Dispositions (A&D) book. IOI

Deasaro noticed that on average the A&D book showed a few

firearms transactions each day. A record of all acquisition and

dispositions is required by Title 27 478.1219 (see paragraph 8

above). The A&D book is further described on page 8 of the

Federal Firearms Licensee Quick Reference and Best Practices

Guide, ATF Publication 5300.15. While at THE PREMISES, Wyatt

told IOI Deasaro that he had Gunsmoke Inc.s Form 4473s

(Firearms Transaction Record Part I-Over-The-Counter) stored in

boxes inside THE PREMISES. All FFLs are required to complete

Form 4473s for each firearm sale they make as required by Title

17



25/35

27 478. Wyatt told IOI Deasaro that he needed time to go

through the Form 4473s to remove the receipts that were stapled

to some of the Form 4473s. IOI Deasaro informed your affiant

that it is common practice for firearms dealers to staple sales

receipts to Form 4473s for record keeping purposes.

35. Based on the ATF investigation, bank records, the

Discovery Channel, The Colorado Department of Revenue, Colorado

Department of Motor Vehicles, Adams County Clerk and Recorder and

IRS records, Wyatt has failed to report his income for the years

2008 through 2011 and has used Rodriguez as a nominee to disguise

his involvement in earning his income from Gunsmoke Inc. in

violation of Title 26 USC 7201 and 7203. As manager and owner

in fact of Gunsmoke Inc. according to the Discovery Channel,

Wyatt has also failed to report the income earned by Gunsmoke

Inc. to the IRS. Wyatt has also maintained a lifestyle

commensurate with his actual income by living in a house owned in

his wifes name and driving cars owned in his business name.

36. Gunsmoke Inc. and the Discovery Channel appear to be

Wyatts sole sources of income. The bank account statement

produced by Mutual of Omaha Bank lists Gunsmoke Inc. as the

account holder at the PREMISES. The PREMISES address was also

provided to the Colorado Secretary of State. Gunsmoke Inc. is a

retail gun store. Based on my training and experience retail

18



26/35

businesses maintain their records at the same location where they

conduct their business.

COMPUTER DATA

37. As described above and in Attachment B, I submit that

if computers or storage media are found at the Subject Premises,

there is probable cause to search and seize those items for the

reasons stated below. Some of these electronic records might

take the form of files, documents, and other data that is user-

generated. Some of these electronic records, as explained below,

might take a form that becomes meaningful only upon forensic

analysis.

38. For example, based on my knowledge, training, and

experience, I know that a powered-on computer maintains volatile

data. Volatile data can be defined as active information

temporarily reflecting a computer's current state including

registers, caches, physical and virtual memory, network

connections, network shares, running processes, disks, floppy,

tape and/or CD-ROM and printing activity. Collected volatile

data may contain such information as opened files, connections to

other computers, passwords used for encryption, the presence of

anti-forensic tools, or the presence of programs loaded in memory

that would otherwise go unnoticed. Volatile data and its

corresponding evidentiary value is lost when a computer is

19



27/35

powered-off and unplugged.

39. Based on my knowledge, training, and experience, I know

that computer files or remnants of such files can be recovered

months or even years after they have been downloaded onto a

storage medium, deleted, or viewed via the Internet. Electronic

files downloaded to a storage medium can be stored for years at

little or no cost. Even when files have been deleted, they can

be recovered months or years later using forensic tools. This is

so because when a person deletes a file on a computer, the data

contained in the file does not actually disappear; rather, that

data remains on the storage medium until it is overwritten by new

data. Therefore, deleted files, or remnants of deleted files,

may reside in free space or slack space-that is, in space on the

storage medium that is not currently being used by an active

file-for long periods of time before they are overwritten. In

addition, a computers operating system may also keep a record of

deleted data in a swap or recovery file.

40. Also, again based on my training and experience, wholly

apart from user-generated files, computer storage media-in

particular, computers internal hard drives-contain electronic

evidence of how a computer has been used, what it has been used

for, and who has used it. This evidence can take the form of

operating system configurations, artifacts from operating system

20



28/35

or application operation, file system data structures, and

virtual memory swap or paging files. Computer users typically

do not erase or delete this evidence, because special software is

typically required for that task. However, it is technically

possible to delete this information. Data on the storage medium

not currently associated with any file can provide evidence of a

file that was once on the storage medium but has since been

deleted or edited, or of a deleted portion of a file (such as a

paragraph that has been deleted from a word processing file).

Web browsers, e-mail programs, and chat programs store

configuration information on the storage medium that can reveal

information such as online nicknames and passwords. Operating

systems can record additional information, such as the attachment

of peripherals, the attachment of USB flash storage devices or

other external storage media, and the times the computer was in

use. Computer file systems can record information about the

dates files were created and the sequence in which they were

created.

41. As further described in Attachment B, this application

seeks permission to locate not only computer files that might

serve as direct evidence of the crimes described on the warrant,

but also for evidence that establishes how computers were used,

the purpose of their use, who used them, and when.

21



29/35

42. In cases like this one, where the evidence may consist

partly of graphic files, the monitor and printer are also

essential to show the nature and quality of the graphic images

that the system can produce. In addition, the analyst needs all

assisting software (operating systems or interfaces, and hardware

drivers) and any applications software, which may have been used

to create the data (whether stored on hard drives or on external

media), as well as all related instructional manuals or other

documentation and security devices. Moreover, searching

computerized information for evidence or instrumentalities of

crime commonly requires the seizure of the entire computers

input/output periphery devices (including related documentation,

passwords and security devices) so that a qualified expert can

accurately retrieve the systems data in a controlled

environment.

43. Devices such as modems can contain information about

dates, frequency, and computer(s) used to access the internet.

The monitor, keyboard, and mouse may also have fingerprints on

them indicating the user of the computer and its components.

44. User attribution evidence can also be found on a

computer and is analogous to the search for indicia of

occupancy while executing a search warrant at a residence. For

example, registry information, configuration files, user

22



30/35

profiles, e-mail, e-mail address books, chat, instant

messaging logs, photographs, and correspondence (and the data

associated with the foregoing, such as file creation and last

accessed dates) may be evidence of who used or controlled the

computer or storage medium at a relevant time. Further, in

finding evidence of how a computer was used, the purpose of its

use, who used it, and when, sometimes it is necessary to

establish that a particular thing is not present on a storage

medium. For example, the presence or absence of counter-forensic

programs or anti-virus programs (and associated data) may be

relevant to establishing the users intent.

45. Searching Computer(s) for the evidence described in the

attachment may require a range of data analysis techniques. For

example, information regarding user attribution or Internet use

is located in various operating system log files that are not

easily located or reviewed. Or, a person engaged in criminal

activity will attempt to conceal evidence of the activity by

hiding files or giving them deceptive names. As explained

above, because the warrant calls for records of how a computer

has been used, what it has been used for, and who has used it, it

is exceedingly likely that it will be necessary to thoroughly

search storage media to obtain evidence, including evidence that

is not neatly organized into files or documents. Just as a

23



31/35

search of a premises for physical objects requires searching the

entire premises for those objects that are described by a

warrant, a search of this premises for the things described in

this warrant will likely require a search among the data stored

in storage media for the things (including electronic data)

called for by this warrant. Additionally, it is possible that

files have been deleted or edited, but that remnants of older

versions are in unallocated space or slack space. This, too,

makes it exceedingly likely that in this case it will be

necessary to use more thorough techniques.

46. Based upon my knowledge, training and experience, I

know that a thorough search for information stored in storage

media often requires agents to seize most or all storage media to

be searched later in a controlled environment. This is often

necessary to ensure the accuracy and completeness of data

recorded on the storage media, and to prevent the loss of the

data either from accidental or intentional destruction.

Additionally, to properly examine the storage media in a

controlled environment, it is often necessary that some computer

equipment, peripherals, instructions, and software be seized and

examined in the controlled environment. This is true because of

the following:

24



32/35

a. The nature of evidence. As noted above, not all

evidence takes the form of documents and files that can be easily

viewed on site. Analyzing evidence of how a computer has been

used, what it has been used for, and who has used it requires

considerable time, and taking that much time on premises could be

unreasonable. Also, because computer evidence is extremely

vulnerable to tampering and destruction (both from external

sources and from code embedded in the system as a booby-trap),

the controlled environment of a laboratory is essential to its

complete and accurate analysis.

b. The volume of evidence and time required for an

examination. Storage media can store the equivalent of millions

of pages of information. Additionally, a suspect may try to

conceal criminal evidence; he or she might store it in random

order with deceptive file names. This may require searching

authorities to peruse all the stored data to determine which

particular files are evidence or instrumentalities of crime.

Analyzing evidence of how a computer has been used, what it has

been used for, and who has used it requires considerable time,

and taking that much time on premises could be unreasonable. As

explained above, because the warrant calls for forensic

electronic evidence, it is exceedingly likely that it will be

necessary to thoroughly examine storage media to obtain evidence.

25



33/35

Reviewing information for things described in the warrant can

take weeks or months, depending on the volume of data stored, and

would be impractical and invasive to attempt on-site.

c. Technical requirements. Computers can be configured in

several different ways, featuring a variety of different

operating systems, application software, and configurations.

Therefore, searching them sometimes requires tools or knowledge

that might not be present on the search site. The vast array of

computer hardware and software available makes it difficult to

know before a search what tools or knowledge will be required to

analyze the system and its data on-site. However, taking the

storage media off-site and reviewing it in a controlled

environment will allow its examination with the proper tools and

knowledge.

d. Variety of forms of electronic media. Records sought

under this warrant could be stored in a variety of storage media

formats that may require off-site reviewing with specialized

forensic tools.

47. Based on the foregoing, and consistent with Rule

41(e)(2)(B), when persons executing the warrant conclude that it

would be impractical to review the media on-site, the warrant I

am applying for would permit seizing or imaging storage media

that reasonably appear to contain some or all of the evidence

26



34/35

described in the warrant, thus permitting its later examination

consistent with the warrant. The examination may require

techniques, including but not limited to computer-assisted scans

of the entire medium, that might expose many parts of a hard

drive to human inspection in order to determine whether it is

evidence described by the warrant.

CONCLUSION

48. Based on the foregoing facts and my training and

experience, I believe there is probable cause to believe that the

fruits, instrumentalities, and evidence of violations of United

States Code, Title 26, 7203 and 7201 (Failure to File and Tax

Evasion), will be found at 9690 West 44th Avenue, Wheat Ridge, CO

80033, the location to be searched as more fully described in

Attachment A.

27



35/35

49. In consideration of the foregoing, your affiant

requests that this Court issue a search warrant authorizing the

search of the location described in Attachment A,and the seizure

of items as more fully described in Attachment B, which

attachment A and B are incorporated herein by reference,as fully

set forth herein.

s/Benjamin G. HoppingBenjamin G. HoppingSpecial Agent, IRS-CI

Reviewed by AUSA Suneeta Hazra

Subscribed and Sworn to before me

On this __ day of March, 2013.

__________________________________UNITED STATES MAGISTRATE JUDGE

5th

__ ___________________IT STATES MAGISTRATE


Gunsmoke Guns Search Warrant Affidavit

Documents

Transcript of Gunsmoke Guns Search Warrant Affidavit