Contents

• [9.4] 10.1 OVERVIEW

• [9.4] 10.2 Mail Covers
  • [9.4] 10.2.1 Definitions Relating to Mail Covers
  • [9.4] 10.2.2 Mail Cover Requests
    • [9.4] 10.2.2.1 Written Requests
    • [9.4] 10.2.2.2 Oral Requests
    • [9.4] 10.2.2.3 Subjects of the Mail Covers
  • [9.4] 10.2.3 Time Frame for Mail Cover Requests
  • [9.4] 10.2.4 Renewal of Mail Cover Requests
  • [9.4] 10.2.5 Result of Mail Cover Requests

• [9.4] 10.3 TRASH PICKUP

• [9.4] 10.4 Emergency Driving
  • [9.4] 10.4.1 Definitions
  • [9.4] 10.4.2 Factors To Consider
  • [9.4] 10.4.3 Offensive Tactics
  • [9.4] 10.4.4 Other Agencies
  • [9.4] 10.4.5 Emergency Equipment
  • [9.4] 10.4.6 Rights of Third Parties

• [9.4] 10.5 COMPUTER SEARCHES AND SEIZURES

• [9.4] 10.6 COMPUTER EVIDENCE
  • [9.4] 10.6.1 Applicable Law
  • [9.4] 10.6.2 Additional Information

• [9.4] 10.7 PROBABLE CAUSE AND PREPARATION OF SEARCH WARRANT

• [9.4] 10.8 THE APPROACH AND SEARCH

• [9.4] 10.9 CUSTODY AND STORAGE OF SEIZED PROPERTY
  • Exhibit [9.4] 10-1 U.S. Postal Inspection Service Managers, Inspection Operations Support Group (ISOSG) Office Addresses and Areas Covered

[9.4] 10.1  (07-29-1998)
OVERVIEW

1. This chapter details:
   1. The use of mail covers
   2. Searching trash
   3. Emergency driving
   4. Computer Searches and Seizures

   ---

[9.4] 10.2  (07-29-1998)
Mail Covers

1. The United States Postal Service (USPS) regulations which constitute the sole authority and procedure for initiating, processing, placing, and using mail covers are provided in Title 39, Code of Federal Regulations, section 233.3; and section 213 of the USPS Administrative Support Manual.

[9.4] 10.2.1  (07-29-1998)
Definitions Relating to Mail Covers

1. The following are USPS mail cover definitions:
   1. Mail cover is the process by which a nonconsensual record is made of any data appearing on the outside cover of sealed or unsealed mail, or by which a record is made of the contents of any unsealed mail as allowed by law, to obtain information in order to: protect national security; locate a fugitive; obtain evidence of commission or attempted commission of a crime; obtain evidence of a violation or attempted violation of a postal statute; or assist in the identification of property, proceeds, or assets forfeitable under law.
   2. Fugitive is any person who has fled from the United States (U.S.) or any State, the District of Columbia, territory, or possession of the U.S., to avoid prosecution for a crime, to avoid punishment for a crime, or to avoid giving testimony in a criminal proceeding.
   3. Crime , for purposes of this section, is any commission of an act or the attempted commission of any act that is punishable by imprisonment for a term exceeding 1 year.
   4. Law enforcement agency is any authority of the federal, state, or local government whose functions are to investigate the commission or attempted commission of acts constituting a crime, or protect the national security.
   5. Emergency situation refers to circumstances which require the immediate release of information to prevent the loss of evidence or in which there is a potential for immediate physical harm to persons or property.

[9.4] 10.2.2  (07-29-1998)
Mail Cover Requests

1. The Chief, Criminal Investigation (CI), is responsible for ensuring that requests for mail covers are made in accordance with established procedures. All mail cover requests must be signed by the Chief or the Branch Chief.
2. The mail cover requests should be addressed to the Manager, Inspection Service Operations Support Group (ISOSG), of the postal area involved (see Exhibit 19-1); and sent directly to that official, except for the fourth and subsequent renewal requests as provided for in 19.2.4 below.
3. Requests for mail covers should be made only in primary or subject investigations, and for the following reasons:
   1. for the purpose of locating a fugitive;
   2. when there is good reason to believe that a felony has been committed or attempted; or
   3. to assist in the identification of property, proceeds or assets forfeitable under law.
4. Mail covers are not to be used for "fishing" or exploratory purposes.
5. A mail cover should never be requested in an investigation involving a misdemeanor violation. Whenever an investigation has been elevated to a felony, case management records must be updated timely to support a subsequent request for a mail cover.
6. During legal proceedings, through appropriate discovery procedures, any information obtained by using mail covers may be required to be made available to the subject of the mail cover.

[9.4] 10.2.2.1  (07-29-1998)
Written Requests

1. Requests for mail covers should be made in writing, stating therein which of the purposes specified in (3) above is applicable. A separate request must be made for each Post Office which must conduct the mail cover.
2. The mail cover request must also specify, and stipulate:
   1. That an official investigation is in progress.
   2. The name and address of each individual or business to be covered.
   3. The federal statute alleged to have been violated and the criminal penalty, if convicted. Requesters should provide a brief explanation of the statute, including in the investigation of money laundering offenses (i.e., 18 USC 1956) the identification of any specified unlawful activity which precipitated the money laundering investigation, and the criminal penalty which could be asserted if convicted under that statute. For example: "We are conducting an investigation in which the taxpayer is allegedly attempting to evade personal income tax for calendar years 19- through 19- in violation of Section 7201 of the Internal Revenue Code. Conviction under this statute could result in the taxpayer's imprisonment for not more than 5 years and or fined not more than $100,000 for each of the years for which convicted" . Title 18 U.S.C. Section 3571 increased the maximum permissible fines for felony offenses set forth in Section 7201. The maximum permissible fine is $250,000 for individuals. Unless otherwise determined under Subsection (d) of Section 3571. (United States Sentencing Guideline Section 5E1.2).
   4. The reasonable ground that exists which demonstrates that the mail cover is necessary. This should include a brief description of the manner in which the alleged tax evasion or other violation is believed to have been committed (for example, by omitting income from drug trafficking or from interest on bank savings accounts or laundering of monetary instruments with the intent of concealing the proceeds of drug trafficking).
   5. How the mail cover will assist in obtaining information concerning the alleged violation (for example, by uncovering assets or identifying possible sources of unreported income through the taxpayer's receipt of correspondence from banks or other financial
      institutions).
   6. The name and address of any attorney for each person or company in which a mail cover is requested or that the attorney for each person or company in which a mail cover is requested is not known. (No mail cover shall include matter mailed between the mail cover subject and the subject's known attorney.)
   7. That each person or company in which a mail cover is requested, if not a fugitive, is not under indictment in connection with the matter under investigation.
   8. That if the mail cover is authorized and an information is filed against the subject or the subject is indicted for any cause during the mail cover period, the Regional Chief Postal Inspector must be immediately notified.
   9. If the subject is under investigation for further criminal violations, or a mail cover is requested to assist in the identification of property, proceeds or assets forfeitable because of a violation of criminal law, a new mail cover order must be requested consistent with these regulations.
   10. If the information or indictment is for an offense that is not part of the CI primary or subject investigation, the notification should be made in writing and should state that the information or indictment concerns a matter that is not related to the CI investigation. The notification should request that the mail cover be continued without interruption.
   11. If the indictment returned is a sealed indictment in a CI investigation, the Regional Chief Postal Inspector will be requested to cancel the mail cover. There should be no mention of an indictment to the Regional Chief Postal Inspector, thus avoiding making an unlawful disclosure by violating the secrecy rules that govern federal grand juries.
   12. A statement that only first class mail should be covered, unless it is specifically necessary that other classes of mail be included. If other classes of mail are to be included, a statement must be made establishing the necessity to include all mail.
3. Following is a brief description of various classes:
   1. First Class: Letters, postal cards, express mail, etc. Mail sealed against Postal inspection.
   2. Second Class: Newspapers, periodicals, publications, catalogs, etc.
   3. Third Class: Small parcels weighing less than 16 ounces, mail not sealed against Postal inspection such as, bulk rate items, and circulars.
   4. Fourth Class: Parcels and mail not sealed against Postal
      inspection.
4. The mail cover request should be sufficiently detailed to establish the need for the mail cover. Disclosure of return information to the Postal Service must be limited to the extent necessary to obtain the mail cover.

[9.4] 10.2.2.2  (07-29-1998)
Oral Requests

1. The request for mail covers can be made orally, with approval, by the Chief or Branch Chief in emergency situations. The written request must, however, follow within 3 calendar days.

[9.4] 10.2.2.3  (07-29-1998)
Subjects of the Mail Covers

1. The reasonable grounds for a mail cover should be established on each person or company who is the subject of a mail cover. For instance, a person may be named as the subject of an investigation but a mail cover may also be necessary on his or her spouse (or associate). The request should explain the necessity for the mail cover on the spouse (or associate).
2. A request to include a spouse should include information for Postal officials to authorize the mail cover. This could include, for example, that we learned of a spouse's involvement in the evasion scheme from an informant or other third party witness. It is not sufficient to say that ``because the taxpayer is married, we have reason to expect that the spouse may hold assets. . , or that ``Based on our experience in other investigations, we anticipate that the spouse. . .
3. The request should stipulate and specify the necessity for the requested mail cover, such as:
   1. The taxpayer uses aliases.
   2. The taxpayer is known to use nominee ownership in bank accounts or assets.
   3. The mail cover is expected to uncover assets, liabilities, and/or expenditures.
   4. The mail cover should reveal the taxpayer's contacts or clientele, etc.
4. Mail covers are usually requested on a stated individual or company at a given address. Mail arriving for others who happen to receive mail at the mail cover address are not included in the mail cover.
5. In instances where the primary or subject investigation requires a cover on mail addressed to the known occupant and fictitious names that may be used by the occupant, the following must also be included in the request:
   1. A statement establishing the necessity for covering all mail intended for delivery at the particular address.
   2. A statement that it is known through the investigation that only the subject of the cover resides and receives mail at the address.
   3. A statement that all mail received for delivery at the address is intended for the subject of the mail cover.
   4. If persons other than the subject of the mail cover reside at the address, a list of their names must be furnished, and all mail addressed to them is to be excluded from the cover.
6. If a liaison has been established with a local Postal Inspector, the name of the Inspector should be provided in the request.

[9.4] 10.2.3  (07-29-1998)
Time Frame for Mail Cover Requests

1. Requests for mail covers should be limited to not more than 30 days and canceled if the information is obtained from other sources prior to the expiration of the period.
2. Cancellations should be sent by the originating office and addressed to the Manager, ISOSG, of the Postal area involved.

[9.4] 10.2.4  (07-29-1998)
Renewal of Mail Cover Requests

1. Mail cover requests can be renewed 3 times, not to exceed 120 days. A request for renewal, when warranted, should be made in accordance with the procedures set forth in 19.2.2 and 19.2.2.1 above.
2. The request must contain a statement regarding the investigative benefit of the mail cover and the anticipated benefits to be derived from the extension.
3. A fourth renewal request and all subsequent renewals must be submitted to the Assistant Commissioner, CI, for approval, together with a memorandum detailing the need to continue the mail cover.

[9.4] 10.2.5  (07-29-1998)
Result of Mail Cover Requests

1. The results of a mail cover will be documented daily by the Postal Service on Form 2009, Information Concerning Mail Matter, and forwarded to CI. A need for daily, weekly, or biweekly forwarding should be specified in the original request.
2. All Forms 2009, received from the Postal Inspection Service are the property of the Postal Service and must be returned within 60 days.
3. Mail cover documents must be treated with confidentiality; reproduction of mail cover documents is prohibited.

[9.4] 10.3  (07-29-1998)
TRASH PICKUP

1. Many investigations have been made from evidence special agents retrieved from a taxpayer's trash.
2. The Supreme Court has held that the Fourth Amendment does not prohibit the warrantless search and seizure of garbage left for collection outside the curtilage of the home.
3. A person who has thrown records into a trash can and left the trash can at the side of a public street cannot claim that special agents who later take the records have violated his or her rights under the Fourth Amendment, because any expectation of privacy in the garbage is not objectively reasonable.
4. The First Circuit has held that the Fourth Amendment does not prohibit the warrantless seizure and reconstruction of shredded documents found in trash bags located outside the curtilage of a subject's house; the mere fact that the subject shredded his or her garbage before it was placed in the trash outside did not create a reasonable heightened expectation of privacy.
5. Special agents can legally conduct a warrantless search and seizure of a taxpayer's trash when it is found in a common area for pick-up by a trash collector or with the trash collector's consent, when it has already been picked up by the trash collector.

   ---

[9.4] 10.4  (07-29-1998)
Emergency Driving

1. CI Special Agents may engage in emergency driving only when the seriousness of the emergency outweighs the danger created by such driving. When engaging in emergency driving, special agents must continually evaluate the need to engage in such driving when balanced against safety considerations.
2. Directive No. 7 establishes guidelines consistent with a uniform Treasury standard for Law Enforcement Officers to use in making decisions regarding emergency driving.
3. The goal of this directive is to ensure the safety of Law Enforcement Officers, other persons involved, and the general public by balancing the seriousness of the emergency with safety considerations.
4. Directive No. 7 applies when a suspect is being followed to make an apprehension, surveillance is being conducted, or exigent circumstances exist. It encompasses driving situations in which the posted speed limit or other traffic laws are disregarded. The directive also notes that some driving maneuvers with a vehicle, referred to as offensive tactics (i.e. blocking, ramming, forcing vehicles off the road), may constitute the use of deadly force and may only be used in compliance with Treasury's Policy on the Use of Force, Treasury Order 105-12.

[9.4] 10.4.1  (07-29-1998)
Definitions

1. Emergency Driving: Driving in a manner that disregards the posted legal speed limits or other traffic laws for one or more of the following purposes:
   1. following a suspect vehicle to make an apprehension,
   2. conducting surveillance, or
   3. responding to other exigent circumstances.
2. Offensive Tactics: Offensive tactics are maneuvers made while pursuing a vehicle that are likely to cause deliberate physical contact between the vehicles. Examples of offensive tactics may include blocking (except for slow moving vehicles), cutting off, ramming, and forcing vehicles off the roadway.
3. Deadly Force: Deadly force is the use of any force that is likely to cause death or serious physical injury. Deadly force does not include force that is not likely to cause death or serious physical injury but unexpectedly results in such death or injury.

[9.4] 10.4.2  (07-29-1998)
Factors To Consider

1. When balancing the need for emergency driving with safety considerations, CI Special Agents should consider all relevant factors, including but not limited to:
   1. the nature of the emergency;
   2. the imminent danger to public safety if a suspect is not
      apprehended;
   3. the seriousness of the offense;
   4. the probability of apprehending a suspect at a later time;
   5. the location, weather, speed, traffic and road conditions;
   6. the time of day;
   7. the presence of pedestrians;
   8. the special agent's driving abilities;
   9. the condition of all vehicles;
   10. the availability of emergency equipment;
   11. the availability of assistance from uniformed police officers in marked police vehicles; and
   12. the possibility of alternative courses of action.

[9.4] 10.4.3  (07-29-1998)
Offensive Tactics

1. In some circumstances, offensive tactics may constitute the use of deadly force. Those offensive tactics that are likely to cause death or serious physical injury may constitute the use of deadly force. Special agents may use deadly force only when necessary, that is, when the special agent has a reasonable belief that the subject of such force poses an imminent danger of death or serious physical injury to the special agent or to another person.
2. Deadly force may be used to prevent the escape of a fleeing subject if there is probable cause to believe:
   1. the subject has committed a felony involving the infliction or threatened infliction of serious physical injury or death; and
   2. the escape of the subject would pose an imminent danger of death or serious physical injury to the officer or to another person.
3. If force, other than deadly force, reasonably appears to be sufficient to accomplish an arrest or otherwise accomplish the law enforcement purpose, deadly force is not necessary. See Treasury Order 105-12, "Policy on the Use of Force," for additional guidance.

[9.4] 10.4.4  (07-29-1998)
Other Agencies

1. In the planning of Treasury-led joint operations involving other Federal, State, or local law enforcement agencies, each participant will be informed of this policy and that this policy will be controlling.

[9.4] 10.4.5  (07-29-1998)
Emergency Equipment

1. Criminal Investigation should review State requirements for emergency systems/equipment on vehicles engaged in emergency driving and comply when appropriate.

[9.4] 10.4.6  (07-29-1998)
Rights of Third Parties

1. Nothing in these guidelines is intended to create, or does create, an enforceable legal right or private right of action.

   ---

[9.4] 10.5  (07-29-1998)
COMPUTER SEARCHES AND SEIZURES

1. The search and seizure of data contained in computers, computer networks, and other electronic storage mediums (such as "e-mail" ) present special matters to consider in order to insure the legality of the search and seizure. Special agents should possess a working knowledge of the fundamental rules of evidence which are applicable to the execution of computer search warrants. This chapter covers the following topics:
   • Computer Evidence
   • Probable Cause and Preparation of Search Warrant
   • The Approach and Search
   • Custody and Storage of Seized Property

   ---

[9.4] 10.6  (07-29-1998)
COMPUTER EVIDENCE

1. Use the least intrusive means possible to obtain the evidence. Obtain electronic information by consent, subpoena, and search warrant.
2. Consent must be voluntarily given and may be limited in scope. Seek consent from the target, employer, or other party with authority established by law. Also see Searches Made With Consent located in 9.4.13, Search Warrants and Warrantless Searches.
3. Consider using a subpoena for computer information not under the control of the target. Subpoena computer records as they exist at the time of service of the subpoena. Direct the recipient to make and safeguard a copy of the requested information, even if they intend to contest the subpoena. Subpoena targets for passwords and encryption keys. A grant of act production immunity may be required.
4. When deciding whether to search and/or seize one or more computers, there are several issues to consider. Confront the issues early in the investigation if possible. Coordinate procedures relating to pre-search, search, and post search activities with the special agent/computer investigative specialist.

[9.4] 10.6.1  (07-29-1998)
Applicable Law

1. Several laws and regulations govern obtaining evidence from electronic sources. These statutes impose restrictions and obligations on the special agent and any operator of public computer services. Review the following before attempting to obtain evidence from electronic sources:
   1. First Amendment to the Constitution
   2. Fourth Amendment to the Constitution
   3. Wiretap Act, 18 U.S.C. Sections 2510-2521
   4. Electronic Communications Privacy Act of 1986, 18 U.S.C.
      2701-2711
   5. Privacy Protection Act, 42 U.S.C Section 2000aa
   6. Federal Rules of Criminal Procedure, Rule 41
   7. Federal Rules of Evidence, Sections 901, 1001, and 1002
   8. Investigative Techniques Handbook, 9.4.13, Search Warrants and Warrantless Searches

[9.4] 10.6.2  (07-29-1998)
Additional Information

1. Obtain additional information to secure evidence from computers and electronic forums from:
   1. Internet Investigation Guidelines written by Criminal Investigation (CI);
   2. Computer Investigative Specialist;
   3. Federal Guidelines for Searching and Seizing Computers published by the Department of Justice;
   4. Internet Investigation Guidelines published by the Department of Justice;
   5. IRS, Office of Chief Counsel: Martin Klotz or Jeff Jordan are available at (202)622-7941 and fax (202)622-6302;
   6. Computer and Telecommunications Coordinators (CTCs) at the local United States Attorney's Office are Assistant United States Attorneys that received special training in the computer crimes subject area;
   7. Tax Division, Department of Justice: Tony Whitledge, Senior Trial Attorney, is available at (202)514-2832 and Fax (202)514-3081;
   8. Computer Crime and Intellectual Property Section, Department of Justice at (202)514-1026 and fax (202)514-6113.

   ---

[9.4] 10.7  (07-29-1998)
PROBABLE CAUSE AND PREPARATION OF SEARCH WARRANT

1. Consider the following issues while obtaining a search warrant when it is anticipated that a computer is on site. It is recommended that the special agent and special agent/computer investigative specialist discuss the following pre-search considerations:
   1. The best evidence is a paper document or paper computer print out.
   2. Obtain information about the target(s) use of computers before the search.
   3. Determine the role of the computer in the offense.
   4. Develop probable cause for evidence contained in computers.
   5. Develop probable cause for each component of the computer.
   6. Participate with the special agent/computer investigative specialist in technical interviews that include computer issues.
   7. Consult District Counsel and/or the U.S. Attorney's office on computer issues during the investigation.
   8. The warrant must describe with particularity the places to be searched and the items to be seized. Describe the hardware components of the computer and the software and data domiciled within the computer.
   9. Focus the search warrant affidavit on the evidence sought from the computer. The agent must articulate a factual basis to believe that the computer was used for the creation and/or storage of evidentiary records.
   10. If applicable, explain in the affidavit why an on-site search is not reasonable and seek permission to seize the computer and search it later.
   11. Investigate the possibility of protected material on the computer. Include a positive statement in the warrant that no "work product material" exists on the computer. 42 U.S.C. 2000aa
   12. If protected material exists on the computer, state how the protection is not going to be violated. Magistrates can authorize a segregation plan.
   13. Investigate the possibility of e-mail on the computer. Indicate the e-mail status in the search warrant affidavit and the search warrant. Identify in the warrant whose e-mail is going to be read and that it is subject to search. 18 USC 2703 et seq.
   14. Obtain a "no-knock warrant" if destruction of stored computer information is a concern.

   ---

[9.4] 10.8  (07-29-1998)
THE APPROACH AND SEARCH

1. Consider the following search issues during the execution of the warrant when a computer is on site:
   1. Preserve the chain of custody and integrity of the evidence.
   2. Pre-programmed destructive software can alter and delete data.
   3. Determine where the information is being seized from: a local personal computer; a network computer; or a computer located outside the United States.
   4. Generally, do not seize electronic evidence located outside the United States.
   5. If applicable, work as directed by the Magistrate's segregation plan.
   6. Thoroughly document and photograph the area. Photograph the components of the computers and the cable connections.
   7. Obtain express authority to remove the computer from the site to conduct the search (if not previously granted.)
   8. Consult attorneys after encountering issues such as Privacy Protection Act material.

   ---

[9.4] 10.9  (07-29-1998)
CUSTODY AND STORAGE OF SEIZED PROPERTY

1. Consider the following search issues after the execution of the warrant in relation to computers:
   1. Maintain the chain of custody.
   2. Maintain the integrity of the evidence.
   3. Follow court ordered segregation plans.
   4. Document examinations of the computer.
   5. Return seized items as quickly as possible (if applicable).
   6. Obtain a receipt for returned items.