Case 2:15-mj-00654 Document 5 Filed 12/07/15

FILEDPage 1 of 8 PageID# 14
DEC -7 2015
IT

REDACTED

2-' 15*1} 1*5*1

AFFIDAVIT IN SUPPORT OF APPLICATION FOR ISSUANCE OF CRIMINAL

COMPLAINT AM) ARREST WARRANT

1, Pasquale Ruocco, being duly sworn, hereby depose and state as follows:
Training and Experience

1.

I am a Special Agent of the Department of Homeland Security. Immigration and

Customs Enforcement, Homeland Security Investigations (MSI) and have been so employed
since May 2009. 1have successfully completed criminal investigator training at the Federal Law
Enforcement Training Center (FLETC) in Brunswick, Georgia. I am presently assigned to
conduct counter-proliferation investigations, as such I am responsible to conduct criminal
investigations involving but not limited to, the illegal export of military and defense articles and
"dual use" items (used in both civil and military applications) from the United States. As a
special agent with IIS1,1 have gathered experience related to techniques, methods, and
procedures employed by groups, organizations, companies, corporations, and individuals to
export goods and commodities in violation of United States export laws. As a federal agent. 1
am authorized to investigate violations of laws of the United States and to execute warrants
issued under the authority of the United Stales.
Purpose of the Affidavit

2.
This affidavit is submitted for the limited purpose of establishing probable cause
in support of a criminal complaint and issuance of a warrant of arrest for John Francis Stribling
("Slribling").

3.
The information in this affidavit is based on my personal knowledge and on
information provided to me by other law enforcement investigators during the course of this
investigation. Unless otherwise noted, information provided to me by other law enforcement
personnel does not necessarily reflect my personal observations or investigation but rather has
been passed to me by individuals with first-hand knowledge. Since this affidavit is being
submitted for the limited purpose of establishing probable cause in support of the issuance of an
arrest warrant. I have not included every fact known to me concerning this investigation. I have
set forth only those facts that arc necessary to establish probable cause to believe that John

Francis Stribling ("Stribling"), committed the following offenses: smuggling of goods from the
United States, in violation of 18 U.S.C. 554. and control of arms exports and imports, in
violation of 22 U.S.C. 2778 and 22 CFR 120-130 (International Traffic in Anns
Regulations) (hereinafter the "Subject Offenses").
4.

At the time of the events described below, the United States Munitions List

('"USML"). which is found at 22 CFR 121.1. included the following pertinent category:

Case 2:15-mj-00654 Document 5 Filed 12/07/15 Page 2 of 8 PageID# 15

Category I Firearms, Close Assault Weapons and Combat Shotguns. At all times relevant to the
facts set forth below, Category I included nonautomatic, semi-automatic and automatic firearms

to caliber .50 inclusive. Also within Category I are barrels, cylinders, receivers orcomplete
breech mechanisms, components, parts accessories and attachments for a firearm as defined in
Category I.
Summary of Probable Cause

5.

HSI Los Angeles provided email account content of an individual referred to

herein as the Cooperating Witness (CW). HSI Los Angeles subsequently sent me a compact disk
containing email communications between the CW's email account and Stribling's email
accounts. From my review of the email communications and further investigative steps, it
appeared that within the 2011-2012 timeframe, Stribling had utilized his email accounts to sell
and shipcertain firearms to the CW in Indonesia. Subsequent to those investigative steps, I was
able to interview the CW, who is cooperating pursuant to a federal plea agreement entered in the
Central District of California. I begin below by summarizing my interview with the CW. I then
describe certain email communications and related evidence.
A.

Interview of the CW

6.
I, along with special agents from the FBI, interviewed the CW on May 21, 2015.
The following is a summary of certain information provided by the CW; it does not include all
statements made by the CW during the interview.
7.
The CW indicated he dealt with a person he called Frannie or Francis ("Francis"
is Stribling's middle name). The CW first contacted Frannie at the eBay auction site. After
several purchases, the CW inquired if it was possible to purchase firearms. The CW stated
Frannie did not sell firearms on eBay and all communications with Frannie regarding firearms

were conducted via email attechsupport@milvolt.com and I^^^^^^^^BII'

8.

Through the course of his dealings with Frannie, the CW stated that he completed

four firearm transactions between November 2011 and November 2012. The first firearm the

CW purchased was a Glock pistol for which he paid Frannie approximately $1,000 U.S. The
second firearm purchased was a FN Tactical pistol for which he paid Frannie approximately
$2,000 U.S. The third firearm purchased was a FN SCAR 17S rifle, for which he paid Frannie
approximately $5,000 U.S. The fourth firearm purchased was a Bushmaster Adaptive Combat
Rifle (ACR) for which he paid Frannie $4,000 to $5,000 U.S. The CW indicated that he agreed
to purchase two ACRs from Frannie but only received one ACR. The CW referred to the SCAR
17S as a/the "scarface" and the ACR as "Cobras." The ACR has a snake inscription on the side
of the firearm. The CW paid for the firearms via international bank wire. The CW's brother
conducted the wires on his behalf.

9.
The CW indicated that he received all four firearms via express mail service. All
firearm packages were addressed to the CW in Indonesia and listed female names as the sender.
Via email, Frannie advised the CW regarding packaging concealment methods as well as

Case 2:15-mj-00654 Document 5 Filed 12/07/15 Page 3 of 8 PageID# 16

tracking numbers. The CW received the Glock pistol and FN pistol separately but similarly
packaged, within ballistic body armorplate carrier pockets. The CW received both pistols
disassembled and concealed within ballistic vest plate carriers. The CW believes both pistols
were packaged in such a manner as to avoid detection from law enforcement.
B.

Email Communications and Related Information

10.
A review of the email correspondence between Stribling's email accounts and the
CW's account corroborates the information provided by the CW. For ease of reference, and to
distinguish between the two email accounts utilized, I generally refer below to communications

based on the email account used to send it (e.g., "Techsupport wrote ..."), rather than by the
identity of the sender.
11.
On November 27, 2011, a person utilized the email address
Techsupport@milvolt.com (hereinafter "Techsupport") to email the CW bank account
information. The account information provided to the CW in the email was for a Woodforest

National Bank. Techsupport listed John Francis Stribling as the account holder.

12.

According to Google records, Techsupport is the login email associated with a

Google Checkout account in the company name of Milvolt. The merchant name provided to
Google for the account is in the name F.J. Stribling at an address in Norfolk, Virginia.
Fstrib@hotmail.com is listed as an additional point of contact. Additionally, the account used
for the payment instrument via Google Checkout is the same Woodforest Bank account

information referenced in paragraph 11. Utilizing a bank account for Google Checkout enables
Stribling to fund and receive transactions conducted via the Google Checkout account.
1.

GLOCK 19 Sale

13.

On February 3,2012, Techsupport provided the CW with an invoice. The invoice

included the cost of the Glock 19 pistol among a list of additional items. Techsupport wrote, "I
can send you an invoice, let me know if you want it for the $3671", "$1000 for G19 G4." The

"G19 G4" referred to in this email is consistent with a reference to the fourth generation model
of the Glock 19 pistol.

14.
The CW responded to Techsupport and instructed Techsupport to separate the
firearm into parts and to divide the parts into two separate packages. The email included, "split
the frame and slide into 2 packages. Frame can go to the Crye Chassis package , put it in the
plate pocket is fine. Then the top end goes with the ops core. That is my thinking, just for
precaution although they will go uncheck on my side." Techsupport replied, "OK, sounds good.
1will reopen the Crye box and put the frame in there, and the slide and barrel inthe tool caddy
and inside the Ops helmet. Send over the wire As soon as you can. I will email photos of the
G19 tonight."

15.

Techsupport received an email on February 5, 2012, containing instructions on

packaging and confirming payment. The message included: "Fran, funds sent. Please check ur

Case 2:15-mj-00654 Document 5 Filed 12/07/15 Page 4 of 8 PageID# 17

google checkout. I need you to put the frame, bars and slides scattered inthe 2 packages and
please dissamble the mags and scatter them too. You can throw away the guide rod, recoil
spring and backstrap too."

16.

Techsupport notified the CW that the Glock was sent. The message included,

"Both boxes are gone by EMS. One has CAGE, AIRFRame and pants. G is under the
removeable paf set in the back of the CAGE. Second box has tool roll with some wrenches and

G kit spread." I believe the reference to "G is under the removeable paf set" means that the
Glock 19 pistol was placed in the removable armor/pad section of the CAGE. The CAGE is a
body armor vest made by Crye Precision. Crye Precision also manufactures the AirFrame,
which is a ballistic helmet.

17.
On February 9,2012, Techsupport provided package-tracking numbers
E1515910151US and CW129215955US. Record checks identify two packages. The package
bearing Customs Declaration and Dispatch Note (CP-72) number CW129215955US was sent on
February 9,2012 at 2:19 PM. The information provided on CP-72 CW129215955US listed
"Stribling, None" and an address in Norfolk, Virginia, as the sender and a misspelling of the
CW's surname as the recipient at an address in Indonesia. The contents were described as
"nylon crash helmet, wrench kit-metric." The wrench kit-metric is similar to the tool roll
previously mentioned in paragraph 16. The second package bearing CP-72 CW129213659US
was sent on February 8, 2012 at 3:19 PM. The information provided on CP-72
CW129213659US listed "Stribling, Frances" and an address in Norfolk, Virginia as the sender
and a misspelling of the CW's name as the recipient at an address in Indonesia. The contents
were described as "padded nylon vest, climbing helmet and pants." The padded nylon vest and
climbing helmet descriptions are believed to have been used to describe the CAGE body armor
vest and Crye AirFrame helmet previously mentioned paragraph 16.
18.
Techsupport instructed the CW on Glock 19 pistol assembly via email on
February 13,2012. Included in the email by Techsupport was: "When you see Mr G. and get
him together, don't forget that the position has to be moved slightly to get everuthing together." I
understand "Mr. G" to be a reference to the Glock 19 pistol. On February 14,2012, Techsupport
received an email acknowledging the receipt of the packages.
2.

FN Tactical Pistol and FN SCAR 17S Sale

19.
A FN Tactical pistol and a FN SCAR 17S rifle were among items ordered by the
CW from Techsupport on April 10, 2012. The CW wrote "here's my list:" which included "1
pes small fde fn" and "lpcs big blk fn." The "small fde fn" requested by the CW references the
FN Tactical pistol in flat dark earth ("fde") color. The "big blk fn" references the FN SCAR 17S
in black color.

20.

Techsupport acknowledged the order via email and responded with a price list to

include the cost of the FN Tactical pistol and the FN SCAR 17S. Techsupport listed "1 pes
small fde fn - $2200" and "lpcs big blk fn - $4800", "Total = $10,987 - $1000 deposit = $9,987
Fran." Techsupport received from the CW via email, a copy of a bank wire receipt from Panin

Case 2:15-mj-00654 Document 5 Filed 12/07/15 Page 5 of 8 PageID# 18

Bank in Indonesia. The receipt listed John Francis Stribling of an address in Norfolk, Virginia,
and account endingin 4151 as the beneficiary with Woodforest National Bank as the receiving
bank of the $9,987.00 U.S. Woodforest National Bank records indicate John Francis Stribling is
the account holder of a bank account ending in 41551. I have underlined a "5" in the preceding
sentence because the Woodforest bank records indicate that Stribling's account had one
additional "5" in its number from that listed in the wire receipt from the CW. Despite what
appears to be the CW's error in listing the account number, Woodforest bank records show that
Stribling's Woodforest bank account did receive the funds sent from Panin Bank in Indonesia.

21.

The email address ^^BUHH (hereinafter "^H") instructed the CW

to stop using Techsupport via email on April 30, 2012. AdditionallyT^^B informed the CW
that the FN Tactical pistol was sent, and three additional packages, which contained the FN

SCAR 17S are to be shipped. Specifically (Hi wrote, "My website and email are being
changed over, so use this email address for a while." HI added: "We shipped the Tactical and
some crye by USPS Express #EI515911483US. Three other boxes with SCAR and other gear
coming this week. I also have two Bushie Enhanced ACR in black."

22.

Record checks identify a package bearing CP-72 CW12930690US. This package

was sent on April 27,2012. The CP-72 listed "Toshi, None," and an address in Norfolk,
Virginia as the sender and a misspelling of the CW's surname as the recipient at an address in
Indonesia. The contents were described as a "used padded nylon vest, bag and a car electric r."
The padded nylon vest is believed to reference the CAGE body armor vest and is consistent with
the information provided by the CW on the concealment method to be used to send both the
Glock 19 and FN Tactical pistols.

^^^ 23.

The CW acknowledged receipt ofthe package on May 2, 2012, by informing

HH: "Anyway , i received the package already." ^^| responded with an email, which

included: "Remember to not reassemble the FN G Tact with the thread protector on the
barrel scratches the Cerrocoat." and "I need to get a torque wrench to strip down the Heavy. It
will come in 3 packages. One with more crye crap, helmet, etc, one with receiver and barr set up
as shifter,and float vest, mags & piston/scar hider..." The "FN G Tact" is a reference to the FN
Tactical pistol and the "Heavy" is believed to reference the FN SCAR 17S.

24.

On May 13, 2012, IB notified the CW that three packages had been shipped.

Fstrib wrote "3 packages are on the way and another is waiting on the rest of the Crye Boonie
hats. If nothing by Wednesday another will be on its way to you. Here are the trackers:
EI404496056US E1392425007US EI392424995US fRAN."

25.

Record checks identify three packages likely associated with the shipments

referenced in HH's May 13th email. All three packages were sent on May 12,2012. The CP72 on the package bearing CP-72 CW129310474US listed, "Toshi, None" and an address in
Norfolk, Virginia as the sender and a misspelling of the CW's surname as the recipient at an
address in Indonesia. The contents were described as a "gear shifter and plug shifter." The CP72 on the package bearing CP-72 CW129310457US listed, "Toshi, Rosalie" and an address in
Norfolk, Virginia as the sender and a misspelling of the CW's name as the recipient at an address

Case 2:15-mj-00654 Document 5 Filed 12/07/15 Page 6 of 8 PageID# 19

in Indonesia. The contents were described as a "used jeepbrake, grip shifter, and night light."
The CP-72 on the package bearing CP-72 CW129310488US listed, "Toshi, None" and an
address in Norfolk, Virginia as the sender and a misspelling of the CW's surname as the
recipient at an address in Indonesia. The contents were described as a "helmet, wrench,
screwdrivers, and a solenoid."

26.

The CW responded to H | and inquired about the sender's name. The CW

wrote "Hello fran, great that you finally ship the 17S. All packages under the same sender
name? I should have told you to ship them in intervals, my bad."

27.

On May 19, 2012, the CW confirmed receipt of the SCAR 17S and expressed

displeasure with the packaging ofthe weapon. The CW wrote to H : "Hello Francis, got
those packages already. I found that there is not enough cover for the stuff, got real lucky today
customs are having internal problems so they don't check ."
3.

Bushmaster ACR Sale

28.

^H notifiedthe CWon May 21, 2012, that the Bushmaster ACR and other

items were ready to ship. | H wrote "Ready to start shipping this week. Here is the damage:'
and included in a list "1 Enhanced ACR -$4600," "Shipping - $350 Subtotal - $7649."

requested the CW to send the payment in smaller quantities to multiple bank accounts.
provided the CW with a second bank account in the name of Francis John Stribling at Branch
Banking and Trust (BB&T). Fstrib wrote, "I just need the payments/wires broken up into to wire
accounts so I don't have homeland looking at my transactions." A copy of two bank wire
receipts dated May 23,2012 from Panin Bank in Indonesia, show the CW's brother wired

$5000.00 U.S. to Woodforest National Bank account ending in 4151 and $7249.00 U.S. to a
BB&T account ending in 3149. The receipt for BB&T listed Francis John Stribling at an address
in Norfolk, Virginia, and account ending in 3149 as the beneficiary. The receipt for Woodforest
National Bank listed Francis John Stribling at an address in Norfolk, Virginia and account
ending in 4151 as the beneficiary.

29.
A BB&T bank statement addressed to John Francis Stribling for account ending
in 3149, indicated a wire transferdeposit on May 24, 2012, in the amount of $7232.00 U.S.
Bank records for Woodforest National Bank account ending in 41551, assigned to John F
Stribling indicated a wire transferdeposit on May 24, 2012 in the amount of $4983.00 U.S.
Discrepancies between the U.S. Dollar amounts in paragraphs 28 and 29 are attributed to fees
imposed by the sending/receiving financial institutions.

30.

In an email exchange of multiple messages on June 19 and 20,2012, BH

provided the female name used on packages sent to the CW. The name provided was "Rosalie."

Additionally, ^B informed the CW that SCAR 17S magazines were included in the shipment.
SCAR 17S magazines are also restricted from export under Catergory I of the USML. Record
checks show "Rosalie Toshi" and various combinations thereof, as the listed sender of packages

from Stribling's address in HIH^HHI and an address atBI^^^^^^^B inNorfolk,

Virginia. Public data base checks identify the jjj^HJiiii^HIBl address as an address

Case 2:15-mj-00654 Document 5 Filed 12/07/15 Page 7 of 8 PageID# 20

previously used by Stribling. HI wrote, "I shipped the first ofthree packages to you." "It has
magazine^^ndSurefire6^ound mags, SCAR mag," "The current package is scehduled to go
to your I^^HI^H^H^H address. From Rosalie."
31.

Record checks identify a package bearing CP-72 CW129310465US. This

package^vassemonJunel9, 2012. The information provided on the CP-72 listed, "Toshi, R"
and the iHHHI^^l address as the sender and a misspelling ofthe CW's surname as the
recipient at an address in Indonesia. The contents were listed as "camping gear." The CW later

informed H| via email that he had received the package.

32.
On August 26, 2012, through an email exchange of multiple messages,
Techsupport confirmed shipment of the Bushmaster ACRs and provided tracking numbers.
Techsupport wrote, "EI404487010us cwl 29204379us" "ACRs broken down to every
component. Individually wrapped in bubble wrap. ACRs Mags wrapped in bubble wrap."
Additionally, Techsupport provided the packaging materials used for concealment of the ACR

barrel. Techsupport wrote, "Craftsman screwdrive set over barrel kit. Listed as tools, lifejacket,
shifter, etc."

33.
Record checks of CP-72 CW129204379US identify a package was sent on
August 25,2012. The information provided on the CP-72 listed "Toshi, Rosalie" and the

|address asthe sender and the CW's name as the recipient at an address in
Indonesia. The contents were described as a "Jeep transmission shifter."

34.
The CW acknowledged receipt of the package on August 31,2012, by writing to
Techsupport: "Received the box safe and sound, but I thought there was two of them cobras, are
the other one standing by at your place?" As previously mentioned above, the "cobras" refer to
the Bushmaster ACR.

35.
HSI Los Angeles provided a photograph taken from a video of the CW at a gun
range in Indonesia. The photograph depicts an ACR on a black pad placed on the ground. The
CW identified this ACR as the one he purchased from Stribling.
C.

U.S. Department of State License Determination and History

36.
On April 9,2015, HSI Norfolk received confirmation from the U.S. Department
of State, Directorate of Defense Trade Controls (DDTC) that the four firearms referenced above
along with their respective magazines are controlled for export under Category I of the U.S.
Munitions List.

37.

On June 11, 2015, the U.S. Department of State, Office of Defense Trade Control

Compliance confirmed John Francis Stribling has no record of being registered with the DDTC,
nor has he ever applied for or was granted a license to export and or broker the export of any
defense article or service.

Case 2:15-mj-00654 Document 5 Filed 12/07/15 Page 8 of 8 PageID# 21

Conclusion

38.

Based upon the facts described herein, I submit that probable cause exists to

believe that John Francis Stribling engaged in the Subject Offenses. I therefore respectfully
request the issuance of a warrant to arrest John Francis Stribling based upon probable cause that
he committed the offenses outlined above.

Pasquale Ruocco
Special Agent
Homeland Security Investigations
Norfolk, Virginia

Subscribed and sworn before me this

day of December 2015 at Norfolk, VA.

UNITED STATES MAGISTRATE JUDGE