ATTACHMENT A2 DESCRIPTION OF ITEMS TO BE SEIZED From the office building located at 5500 Lonas Drive, Knoxville, Tennessee, all documents (defined below) relating to violations of 18 U.S.C. 371, 1341, 1343 and 1349, those violations involving a conspiracy among, and a scheme executed by, Pilot (defined below) employees to defraud Pilot Customers (defined below) by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers' knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008, including: 1. E-mails and any attachments thereto related to Rebate Fraud (defined below); 2. E-mails and any attachments thereto related to Rebate Amounts (defined below); 3. All documents related to Rebate Fraud; 4. All documents related to Rebate Amounts, including data sent from PRS; 5. Profit and Loss Statements for any Direct Billed Customer (defined below); 6. Profit and Loss Statements for any Restricted/Funded Customer (defined below); 7. Funded/Restricted Customer lists, including Funded/Restricted-related "Must 8. Direct Billed Customer lists, including Direct Billed-related "Must Lists"; 9. Customer (defined below) sales call, activity reports, or trip reports; 10. E-mails related to Customer sales calls; Lists"; In the Matter of the Search of the office building located at 5500 Lonas Drive, Knoxville, Tennessee Paget Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 1 of 55 PageID #: 160 Attachment A2 11. SalesForce-generated e-mails attaching or summarizing weekly sales call, activity reports, or trip reports; 12. Reports related to the profitability of Pilot's direct diesel sales employees or their Customers' accounts; 13. Agreements memorializing any diesel price discount between Pilot and a Pilot Customer; 14. Discount Addition/Change Form; 15. Documents stating or summarizing any diesel price discount agreement between Pilot and a Customer including data stored in and processed through Ascend; 16. Mail packaging or envelopes sent by Pilot employees to a Customer; 17. Rebate checks payable to Customers; 18. Invoices addressed to Customers; 19. Documents related to the wiring of Rebate Amounts to Customers; 20. Documents related to the calculation of Rebate Amounts for Customers; 21. Documents tracking what Rebate Amount a Customer should have been paid by Pilot compared with what Pilot actually paid the Customer; 22. Any document that states what Rebate Amount a Customer should be paid or should have been paid; 23. Any document to be used in the process of calculating a Customer's Rebate Amount; 24. All documents showing daily pricing information for Customers, including Price Fetch (defined below) and Reflection (defined below); In the Matter of the Search of the office building located at 5500 Lonas Drive} Knoxville} Tennessee Attachment A2 Page2 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 2 of 55 PageID #: 161 25. A complete imaging, or copying, of the entire contents of any computer devices used by Lori McFarland, so that the complete image, or copy, of the computers devices may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information; and 26. A complete imaging, or copying, of the entire contents of any computer device that contains any of the above-described documents, so that the complete image, or copy, of the computer device may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information. 27. The items listed above shall include electronically-stored data, including any form of computer device, including computer devices specifically named above, that can store data. As used both in the attached affidavit supporting the application for a search and seizure warrant and in this attachment, the term "computer device" includes all types of electronic, magnetic, optical, electrochemical, or other high speed data processing devices performing logical, arithmetic, or storage functions, including desktop computers, notebook computers, tablets, server computers, network hardware, hard disks, RAM, floppy disks, flash memory, CD-ROMs, and other magnetic or optical media upon which data can be stored. In the Matter of the Search of the office building located at 5500 Lonas Drive, Knoxville, Tennessee Attachment A2 Page3 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 3 of 55 PageID #: 162 28. For any computer device whose seizure is otherwise authorized by this warrant, and any computer device that contains or in which is stored records or information that is otherwise called for by this warrant: a) evidence of who used, owned, or controlled the computer device at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b) evidence of the attachment to the computer device of other storage devices or similar containers for electronic evidence; c) evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the computer device; d) evidence of the times the computer was used; e) passwords, encryption keys, and other access devices that may be necessary to access the computer device; f) documentation and manuals that may be necessary to access the computer device or to conduct a forensic examination of the computer device; and records of or information about the Internet Protocol addresses used by the computer device. In the Matter of the Search of the office building located at 5500 Lonas Drive, Knoxville, Tennessee Attachment A2 Page4 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 4 of 55 PageID #: 163 For the items listed above, the term "Pilot" refers collectively to Pilot Corporation, Pilot Travel Centers, LLC, PilotFlying J, and any other name under which Pilot Corporation sells diesel fuel to commercial customers through its direct sales team of Regional Sales Directors, Regional Sales Managers, Regional Account Representatives, and Inside Sales Representatives. For the items listed above, the term "Customer" and "Customers" refers to Pilot customers who purchase diesel fuel for commercial use from Pilot's stations and travel-plazas, and includes Direct Billed Customers and Funded/Restricted Customers, which are defined below. For the items listed above, the term "Direct Billed Customers" refers to Customers to whom Pilot has extended credit for the purchase of diesel fuel. Direct Billed Customers purchase their diesel from Pilot on credit extended by Pilot, and Pilot sends these Customers an invoice for the cost of the diesel purchased on credit, including any agreed upon discount, on a periodic basis, sometimes on a daily basis, but typically no longer than a weekly basis. For the items listed above, the term "Funded/Restricted Customers" refers to Customers who purchase their diesel fuel from Pilot using a credit source other than Pilot. Funded/Restricted Customers who receive an agreed upon discount from Pilot for the purchase of diesel fuel typically receive that discount in the form a monthly "rebate" check. For the items listed above, the term "Rebate Amount" refers to the amount of money that a Pilot Customer should be credited or refunded pursuant to terms of the diesel price discount deal and agreement between Pilot and the Customer. In the Matter of the Search of the office building located at 5500 Lonas Drive, Knoxville, Tennessee Attachment A2 PageS Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 5 of 55 PageID #: 164 For the items listed above, the term "Rebate Fraud" means the intentional and deceptive reduction of a Rebate Amount due to a Customer, without the Customer's knowledge or approval, for the purpose of increasing Pilot's profitability and the sales commissions of Pilot employees. For the items listed above, the term "Price Fetch" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to its Customers that shows the diesel fuel price that each Customer is supposed be receiving at each travel plaza specified. For the items listed above, the term "Reflection" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to a Customer's credit card billing company. For the items listed above, the term "documents" means and includes writings or records of every kind or character, conveying information by mechanical, electronic, photographic, or other means, whether encoded, taped, stored or coded electrostatically, electromagnetically, or otherwise, and includes, but is not limited to correspondence, e-mail, facsimiles, notes, memoranda, minutes, summaries, telephone records, telephone message logs or slips, calendars, date books, interoffice communications, results of investigations, videotapes, audiotapes, microfiche, microfilm, any electronic media, accounting and financial records of any kind (including checks (front and back), wire transfers, cash payments or receipts, and check requests), and refers to any record in the organization's possession, custody, or control, and includes all drafts, unfinished versions of documents, and material similar to any of the foregoing however denominated, by whomever prepared, and to whomever addressed that relate to the In the Matter of the Search of the office building located at 5500 Lonas Drive, Knoxville, Tennessee Attachment A2 Page6 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 6 of 55 PageID #: 165 violations of 18 U.S.C. ?? 371,1341, 1343, and 1349 involving a conspiracy among, and a scheme executed by, Pilot employees to defraud Pilot Customers by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008. In the Matter of the Search of the office building located at 5500 Lonas Drive, Knoxville, Tennessee Attachment A2 Page7 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 7 of 55 PageID #: 166 ATTACHMENT B2 DESCRIPTION OF ITEMS TO BE SEIZED From the office building located at 5508 Lonas Drive, Knoxville, Tennessee, all documents (defined below) relating to violations of 18 U.S.C. 371, 1341, 1343, and 1349, those violations involving a conspiracy among, and a scheme executed by, Pilot (defined below) employees to defraud Pilot Customers (defined below) by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers' knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008, including: 1. E-mails and any attachments thereto related to Rebate Fraud (defined below); 2. E-mails and any attachments thereto related to Rebate Amounts (defined below); 3. All documents related to Rebate Fraud; 4. All documents related to Rebate Amounts, including data sent from PRS; 5. Profit and Loss Statements for any Direct Billed Customer (defined below); 6. Profit and Loss Statements for any Restricted/Funded Customer (defined below); 7. Funded/Restricted Customer lists, including Funded/Restricted-related "Must 8. Direct Billed Customer lists, including Direct Billed-related "Must Lists"; 9. Customer (defined below) sales call, activity reports, or trip reports; 10. E-mails related to Customer sales calls; Lists"; In the Matter of the Search of the office building located at 5508 Lonas Drive, Knoxville, Tennessee Attachment B2 Page1 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 8 of 55 PageID #: 167 11. SalesForce-generated e-mails attaching or summarizing weekly sales calls, activity reports, or trip reports; 12. Reports related to the profitability of Pilot's direct diesel sales employees or their Customers' accounts; 13. Agreements memorializing any diesel price discount between Pilot and a Pilot Customer; 14. Discount Addition/Change Form; 15. Documents stating or summarizing any diesel price discount agreement between Pilot and a Customer including data stored in and processed through Ascend; 16. Mail packaging or envelopes sent by Pilot employees to a Customer; 17. Rebate checks payable to Customers; 18. Invoices addressed to Customers; 19. Documents related to the wiring of Rebate Amounts to Customers; 20. Documents related to the calculation of Rebate Amounts for Customers; 21. Documents tracking what Rebate Amount a Customer should have been paid by Pilot compared with what Pilot actually paid the Customer; 22. Any document that states what Rebate Amount a Customer should be paid or should have been paid; 23. Any document to be used in the process of calculating a Customer's Rebate Amount; 24. All documents showing daily pricing information for Customers, including Price Fetch (defined below) and Reflection (defined below). In the Matter of the Search of the office building located at 5508 Lonas Drive, Knoxville, Tennessee Attachment B2 Page2 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 9 of 55 PageID #: 168 25. A complete imaging, or copying, of the entire contents of any computer devices (defined below) used by any employee working in Pilot's diesel direct sales department, including Katy Bibee, Vickie Borden, Karen Crutchman, Campbell Dillion, John Freeman, Wendy Hamilton, Kevin Herman, Lexie Holden, Heather Jones, Karen Mann, Holly Radford, Janet Welch, Scott Wombold, Andrea Woodall, so that the complete image, or copy, of any such computer devices may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information; 26. A complete imaging, or copying, of the entire contents of any computer devices used by, or at the direction of, or by the support staff for, James E. "Jimmy" Haslam III, Mark Hazelwood, Jay Stinnett, and Mitch Steenrod, so that the complete image, or copy, of the computers devices may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information; 27. A complete imaging, or copying, of the entire contents of any computer device that contains any of the above-described documents, so that the complete image, or copy, of the computer device may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may In the Matter of the Search of the office building located at 5508 Lonas Drive, Knoxville, Tennessee Attachment 82 Page3 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 10 of 55 PageID #: 169 be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information; and 28. Items to be Seized from General Counsel and Associate General Counsel's Offices - From the offices of Pilot general counsel and any associate general counsel, only the following: a. Documents related to the calculation of Rebate Amounts for Customers, including all documents tracking what Rebate Amount a Customer should have been paid by Pilot compared with what Pilot actually paid the Customer; any pricing information that was sent to a Customer, any document that evidences an agreed upon diesel discount price for a Customer, any document that states what Rebate Amount a Customer should be paid or should have been paid; any document to be used in the process of calculating a Customer's Rebate Amount. 29. The items listed above shall include electronically-stored data, including any form of computer device, including computer devices specifically named above, that can store data. As used both in the attached affidavit supporting the application for a search and seizure warrant and in this attachment, the term "computer device" includes all types of electronic, magnetic, optical, electrochemical, or other high speed data processing devices performing logical, arithmetic, or storage functions, including desktop computers, notebook computers, tablets, server computers, network hardware, hard disks, RAM, floppy disks, flash memory, CD-ROMs, and other magnetic or optical media upon which data can be stored. In the Matter of the Search of the office building located at 5508 Lonas Drive, Knoxville, Tennessee Attachment 82 Page4 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 11 of 55 PageID #: 170 30. For any computer device whose seizure is otherwise authorized by this warrant, and any computer device that contains or in which is stored records or information that is otherwise called for by this warrant: a) evidence of who used, owned, or controlled the computer device at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usemames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b) evidence of the attachment to the computer device of other storage devices or similar containers for electronic evidence; c) evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the computer device; d) evidence of the times the computer was used; e) passwords, encryption keys, and other access devices that may be necessary to access the computer device; f) documentation and manuals that may be necessary to access the computer device or to conduct a forensic examination of the computer device; and records of or information about the Internet Protocol addresses used by the computer device. In the Matter of the Search of the office building located at 5508 Lonas Drive, Knoxville, Tennessee Attachment 82 PageS Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 12 of 55 PageID #: 171 For the items listed above, the term "Pilot" refers collectively to Pilot Corporation, Pilot Travel Centers, LLC, PilotFlying J, and any other name under which Pilot Corporation sells diesel fuel to commercial customers through its direct sales team of Regional Sales Directors, Regional Sales Managers, Regional Account Representatives, and Inside Sales Representatives.For the items listed above, the term "Customer" and "Customers" refers to Pilot customers who purchase diesel fuel for commercial use from Pilot's stations and travel-plazas, and includes Direct Billed Customers and Funded/Restricted Customers, which are defined below. For the items listed above, the term "Direct Billed Customers" refers to Customers to whom Pilot has extended credit for the purchase of diesel fuel. Direct Billed Customers purchase their diesel from Pilot on credit extended by Pilot, and Pilot sends these Customers an invoice for the cost of the diesel purchased on credit, including any agreed upon discount, on a periodic basis, sometimes on a daily basis, but typically no longer than a weekly basis. For the items listed above, the term "Funded/Restricted Customers" refers to Customers who purchase their diesel fuel from Pilot using a credit source other than Pilot. Funded/Restricted Customers who receive an agreed upon discount from Pilot for the purchase of diesel fuel typically receive that discount in the form a monthly "rebate" check. For the items listed above, the term "Rebate Amount" refers to the amount of money that a Pilot Customer should be credited or refunded pursuant to terms of the diesel price discount deal and agreement between Pilot and the Customer. For the items listed above, the term "Rebate Fraud" means the intentional and deceptive reduction of a Rebate Amount due to a Customer, without the Customer's knowledge or In the Matter of the Search of the office building located at 5508 Lonas Drive, Knoxville, Tennessee Attachment B2 Page6 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 13 of 55 PageID #: 172 approval, for the purpose of increasing Pilot's profitability and the sales commissions of Pilot employees. For the items listed above, the term "Price Fetch" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to its Customers that shows the diesel fuel price that each Customer is supposed be receiving at each travel plaza specified. For the items listed above, the term "Reflection" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to a Customer's credit card billing company. For the items listed above, the term "documents" means and includes writings or records of every kind or character, conveying information by mechanical, electronic, photographic, or other means, whether encoded, taped, stored or coded electrostatically, electromagnetically, or otherwise, and includes, but is not limited to correspondence, e-mail, facsimiles, notes, memoranda, minutes, summaries, telephone records, telephone message logs or slips, calendars, date books, interoffice communications, results of investigations, videotapes, audiotapes, microfiche, microfilm, any electronic media, accounting and financial records of any kind (including checks (front and back), wire transfers, cash payments or receipts, and check requests), and refers to any record in the organization's possession, custody, or control, and includes all drafts, unfinished versions of documents, and material similar to any of the foregoing however denominated, by whomever prepared, and to whomever addressed that relate to the violations of 18 U.S.C. ?? 371,1341, 1343, and 1349 involving a conspiracy among, and a scheme executed by, Pilot employees to defraud Pilot Customers by deceptively reducing In the Matter of the Search of the office building located at 5508 Lonas Drive, Knoxville, Tennessee Attachment 82 Page7 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 14 of 55 PageID #: 173 discounts and rebates due to Pilot Customers, without the Customers knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008. In the Matter of the Search of the office building located at 5508 Lonas Drive, Knoxville, Tennessee Attachment B2 PageS Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 15 of 55 PageID #: 174 Attachment Cl LOCATION TO BE SEARCHED The property to be searched is an commercial building located at 1339 East Weisgarber Road, Knoxville, 11 Tennessee which is a single story, red ish brick office building with the number 1339" centered above a the door under a green awning. The property also is idetified as having on the outside what appe? r to be Pilot fuel pumps, backup generators and air handlers. Pilot Fuel Pumps Attachment Cl Page 1 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 16 of 55 PageID #: 175 ATTACHMENT C2 DESCRIPTION OF ITEMS TO BE SEIZED From the commercial building located at 1339 E. Weisgarber Road, Knoxville, Tennessee, all documents (defined below) relating to violations of 18 U.S.C. 371, 1341, 1343, and 1349, those violations involving a conspiracy among, and a scheme executed by, Pilot (defined below) employees to defraud Pilot Customers (defined below) by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers' knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008, including: 1. E-mails and any attachments thereto related to Rebate Fraud (defined below); 2. E-mails and any attachments thereto related to Rebate Amounts (defined below); 3. All documents related to Rebate Fraud; 4. All documents related to Rebate Amounts, including data sent from PRS; 5. Profit and Loss Statements for any Direct Billed Customer (defined below); 6. Profit and Loss Statements for any Restricted/Funded Customer (defined below); 7. Funded/Restricted Customer lists, including Funded/Restricted-related "Must 8. Direct Billed Customer lists, including Direct Billed-related "Must Lists"; 9. Customer (defined below) sales call, activity reports, or trip reports; 10. E-mails related to Customer sales calls; Lists"; In the Matter of the Search of the commercial building located at 1339 E. Weisgarber Road, Knoxville, Tennessee Attachment C2 Paget Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 17 of 55 PageID #: 176 11. SalesForce-generated e-mails attaching or summarizing weekly sales calls, activity reports, or trip reports; 12. Reports related to the profitability of Pilot's direct diesel sales employees or their ?, Customers' accounts; 13. Agreements memorializing any diesel price discount between Pilot and a Pilot Customer; 14. Discount Addition/Change Form; 15. Documents stating or summarizing any diesel price discount agreement between Pilot and a Customer including data stored in and processed through Ascend; 16. Mail packaging or envelopes sent by Pilot employees to a Customer; 17. Rebate checks payable to Customers; 18. Invoices addressed to Customers; 19. Documents related to the wiring of Rebate Amounts to Customers; 20. Documents related to the calculation of Rebate Amounts for Customers; 21. Documents tracking what Rebate Amount a Customer should have been paid by Pilot compared with what Pilot actually paid the Customer; 22. Any document that states what Rebate Amount a Customer should be paid or should have been paid; 23. Any document to be used in the process of calculating a Customer's Rebate Amount; 24. All documents showing daily pricing information for Customers, including Price Fetch (defined below) and Reflection (defined below). In the Matter of the Search of the commercial building located at 1339 E. Weisgarber Road, Knoxville, Tennessee Attachment C2 Page2 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 18 of 55 PageID #: 177 25. A complete imaging, or copying, of the entire contents of any computer devices (defined below) that contain any e-mail sent by or received from, or any files or folders shared by and among any employee working in connection with Pilot's diesel direct sales department, including Chris Andrews, Katy Bibee, Vickie Borden, Ron Carter, Kevin Clark, Karen Crutchman, Campbell Dillion, Jonathan Duvall, Scott Fenwick, John Freeman, Cathy Giesick, Vincent Greco, Wendy Hamilton, Kevin Hanscomb, Jimmy Haslam, Mark Hazelwood, Kevin Herman, Kevin Hite, Lexie Holden, James Holland, Heather Jones, Karen Mann, Brian Mosher, Jacquelyn Pearl, Holly Radford, Arnie Ralenkotter, Andrew Schimmel, Cathy Sokalowski, Joe Sigurdson, John Spiewak, Mitch Steenrod, Jay Stinnett, James Studor, Janet Welch, Scott Wombold, Andrea Woodall, and Rob Yuronich, so that the complete image, or copy, of any such computer devices may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information; 26. A complete imaging, or copying, of the entire contents of any computer device that contains any of the above-described documents, so that the complete image, or copy, of the computer device may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information; In the Matter of the Search of the commercial building located at 1339 E. Weisgarber Road, Knoxville, Tennessee Attachment C2 Page3 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 19 of 55 PageID #: 178 27. The items listed above shall include electronically-stored data, including any form of computer device, including computer devices specifically named above, that can store data. As used both in the attached affidavit supporting the application for a search and seizure warrant and in this attachment, the term "computer device" includes all types of electronic, magnetic, optical, electrochemical, or other high speed data processing devices performing logical, arithmetic, or storage functions, including desktop computers, notebook computers, tablets, server computers, network hardware, hard disks, RAM, floppy disks, flash memory, CD-ROMs, and other magnetic or optical media upon which data can be stored. 28. For any computer device whose seizure is otherwise authorized by this warrant, and any computer device that contains or in which is stored records or information that is otherwise called for by this warrant: a) evidence of who used, owned, or controlled the computer device at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b) evidence of the attachment to the computer device of other storage devices or similar containers for electronic evidence; c) evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the computer device; d) evidence of the times the computer was used; In the Matter of the Search of the commercial building located at 1339 E. Weisgarber Road, Knoxville, Tennessee Attachment C2 Page4 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 20 of 55 PageID #: 179 e) passwords, encryption keys, and other access devices that may be necessary to access the computer device; f) documentation and manuals that may be necessary to access the computer device or to conduct a forensic examination of the computer device; and records of or information about the Internet Protocol addresses used by the computer device. For the items listed above, the term "Pilot" refers collectively to Pilot Corporation, Pilot Travel Centers, LLC, PilotFlying J, and any other name under which Pilot Corporation sells diesel fuel to commercial customers through its direct sales team of Regional Sales Directors, Regional Sales Managers, Regional Account Representatives, and Inside Sales Representatives .. For the items listed above, the term "Customer" and "Customers" refers to Pilot customers who purchase diesel fuel for commercial use from Pilot's stations and travel-plazas, and includes Direct Billed Customers and Funded/Restricted Customers, which are defined below. For the items listed above, the term "Direct Billed Customers" refers to Customers to whom Pilot has extended credit for the purchase of diesel fuel. Direct Billed Customers purchase their diesel from Pilot on credit extended by Pilot, and Pilot sends these Customers an invoice for the cost of the diesel purchased on credit, including any agreed upon discount, on a periodic basis, sometimes on a daily basis, but typically no longer than a weekly basis. In the Matter of the Search of the commercial building located at 1339 E. Weisgarber Road, Knoxville, Tennessee Attachment C2 PageS Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 21 of 55 PageID #: 180 For the items listed above, the term "Funded/Restricted Customers" refers to Customers who purchase their diesel fuel from Pilot using a credit source other than Pilot. Funded/Restricted Customers who receive an agreed upon discount from Pilot for the purchase of diesel fuel typically receive that discount in the form a monthly "rebate" check. For the items listed above, the term "Rebate Amount" refers to the amount of money that a Pilot Customer should be credited or refunded pursuant to terms of the diesel price discount deal and agreement between Pilot and the Customer. For the items listed above, the term "Rebate Fraud" means the intentional and deceptive reduction of a Rebate Amount due to a Customer, without the Customer's knowledge or approval, for the purpose of increasing Pilot's profitability and the sales commissions of Pilot employees. For the items listed above, the term "Price Fetch" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to its Customers that shows the diesel fuel price that each Customer is supposed be receiving at each travel plaza specified. For the items listed above, the term "Reflection" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to a Customer's credit card billing company. For the items listed above, the term "documents" means and includes writings or records of every kind or character, conveying information by mechanical, electronic, photographic, or other means, whether encoded, taped, stored or coded electrostatically, electromagnetically, or In the Matter of the Search of the commercial building located at 1339 E. Weisgarber Road, Knoxville, Tennessee Attachment C2 Page6 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 22 of 55 PageID #: 181 otherwise, and includes, but is not limited to correspondence, e-mail, facsimiles, notes, memoranda, minutes, summaries, telephone records, telephone message logs or slips, calendars, date books, interoffice communications, results of investigations, videotapes, audiotapes, microfiche, microfilm, any electronic media, accounting and financial records of any kind (including checks (front and back), wire transfers, cash payments or receipts, and check requests), and refers to any record in the organization's possession, custody, or control, and includes all drafts, unfinished versions of documents, and material similar to any of the foregoing however denominated, by whomever prepared, and to whomever addressed that relate to the violations of 18 U.S.C. ?? 371,1341, 1343, and 1349 involving a conspiracy among, and a scheme executed by, Pilot employees to defraud Pilot Customers by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008. In the Matter of the Search of the commercial building located at 1339 E. Weisgarber Road, Knoxville, Tennessee Attachment C2 Page7 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 23 of 55 PageID #: 182 Attachment 01 LOCATION TO BE SEARCHED The property to be searched is a residence located at 4302 Dakota Avenue, Nashville, Tennesee which is a multi-story, mustard colored home with the number "4302" located on the wooden mailbox support next to the street. Attachment 01 Page 1 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 24 of 55 PageID #: 183 ATTACHMENT D2 DESCRIPTION OF ITEMS TO BE SEIZED From the residence located at 4302 Dakota Avenue, Nashville, Tennessee, all documents (defined below) relating to violations of 18 U.S.C. 371, 1341, 1343, and 1349, those violations involving a conspiracy among, and a scheme executed by, Pilot (defined below) employees to defraud Pilot Customers by deceptively reducing discounts and rebates due to Pilot Customers (defined below), without the Customers' knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008, including: 1. E-mails and any attachments thereto related to Rebate Fraud (defined below); 2. E-mails and any attachments thereto related to Rebate Amounts (defined below); 3. All documents related to Rebate Fraud; 4. All documents related to Rebate Amounts, including data sent from PRS; 5. Profit and Loss Statements for any Direct Billed Customer (defined below); 6. Profit and Loss Statements for any Restricted/Funded Customer (defined below); 7. Funded/Restricted Customer lists, including Funded/Restricted-related "Must 8. Direct Billed Customer lists, including Direct Billed-related "Must Lists"; 9. Customer (defined below) sales call, activity reports, or trip reports; 10. E-mails related to Customer sales calls; 11. SalesForce-generated e-mails attaching or summarizing weekly sales calls, Lists"; activity reports, or trip reports; In the Matter of the Search of the residence located at 4302 Dakota Avenue, Nashville, Tennessee Attachment D2 Pagel Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 25 of 55 PageID #: 184 12. Reports related to the profitability of Pilot's direct diesel sales employees or their Customers' accounts; 13. Agreements memorializing any diesel price discount between Pilot and a Pilot Customer; 14. Discount Addition/Change Form; 15. Documents stating or summarizing any diesel price discount agreement between Pilot and a Customer including data stored in and processed through Ascend; 16. Mail packaging or envelopes sent by Pilot employees to a Customer; 17. Rebate checks payable to Customers; 18. Invoices addressed to Customers; 19. Documents related to the wiring of Rebate Amounts to Customers; 20. Documents related to the calculation of Rebate Amounts for Customers; 21. Documents tracking what Rebate Amount a Customer should have been paid by Pilot compared with what Pilot actually paid the Customer; 22. Any document that states what Rebate Amount a Customer should be paid or should have been paid; 23. Any document to be used in the process of calculating a Customer's Rebate Amount; 24. All documents showing daily pricing information for Customers, including Price Fetch (defined below) and Reflection (defined below); 25. A complete imaging, or copying, of the entire contents of any computer devices (defined below) issued to Kevin Hanscomb by Pilot, including the laptop and Ipad issued by In the Matter of the Search of the residence located at 4302 Dakota Avenue, Nashville, Tennessee Attachment D2 Page2 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 26 of 55 PageID #: 185 28. For any computer device whose seizure is otherwise authorized by this warrant, and any computer device that contains or in which is stored records or information that is otherwise called for by this warrant: a) evidence of who used, owned, or controlled the computer device at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b) evidence of the attachment to the computer device of other storage devices or similar containers for electronic evidence; c) evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the computer device; d) evidence of the times the computer was used; e) passwords, encryption keys, and other access devices that may be necessary to access the computer device; f) documentation and manuals that may be necessary to access the computer device or to conduct a forensic examination of the computer device; and records of or information about the Internet Protocol addresses used by the computer device. In the Matter of the Search of the residence located at 4302 Dakota Avenue, Nashville, Tennessee Attachment D2 Page4 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 27 of 55 PageID #: 186 For the items listed above, the term "Pilot" refers collectively to Pilot Corporation, Pilot Travel Centers, LLC, PilotFlying J, and any other name under which Pilot Corporation sells diesel fuel to commercial customers through its direct sales team of Regional Sales Directors, Regional Sales Managers, Regional Account Representatives, and Inside Sales Representatives. For the items listed above, the term "Customer" and "Customers" refers to Pilot customers who purchase diesel fuel for commercial use from Pilot's stations and travel-plazas, and includes Direct Billed Customers and Funded/Restricted Customers, which are defined below. For the items listed above, the term "Direct Billed Customers" refers to Customers to whom Pilot has extended credit for the purchase of diesel fuel. Direct Billed Customers purchase their diesel from Pilot on credit extended by Pilot, and Pilot sends these Customers an invoice for the cost of the diesel purchased on credit, including any agreed upon discount, on a periodic basis, sometimes on a daily basis, but typically no longer than a weekly basis. For the items listed above, the term "Funded/Restricted Customers" refers to Customers who purchase their diesel fuel from Pilot using a credit source other than Pilot. Funded/Restricted Customers who receive an agreed upon discount from Pilot for the purchase of diesel fuel typically receive that discount in the form a monthly "rebate" check. For the items listed above, the term "Rebate Amount" refers to the amount of money that a Pilot Customer should be credited or refunded pursuant to terms of the diesel price discount deal and agreement between Pilot and the Customer. In the Matter of the Search of the residence located at 4302 Dakota Avenue, Nashville, Tennessee Attachment D2 PageS Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 28 of 55 PageID #: 187 For the items listed above, the term "Rebate Fraud" means the intentional and deceptive reduction of a Rebate Amount due to a Customer, without the Customer's knowledge or approval, for the purpose of increasing Pilot's profitability and the sales commissions of Pilot employees. For the items listed above, the term "Price Fetch" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to its Customers that shows the diesel fuel price that each Customer is supposed be receiving at each travel plaza specified. For the items listed above, the term "Reflection" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to a Customer's credit card billing company. For the items listed above, the term "documents" means and includes writings or records of every kind or character, conveying information by mechanical, electronic, photographic, or other means, whether encoded, taped, stored or coded electrostatically, electromagnetically, or otherwise, and includes, but is not limited to correspondence, e-mail, facsimiles, notes, memoranda, minutes, summaries, telephone records, telephone message logs or slips, calendars, date books, interoffice communications, results of investigations, videotapes, audiotapes, microfiche, microfilm, any electronic media, accounting and financial records of any kind (including checks (front and back), wire transfers, cash payments or receipts, and check requests), and refers to any record in the organization's possession, custody, or control, and includes all drafts, unfinished versions of documents, and material similar to any of the foregoing however denominated, by whomever prepared, and to whomever addressed that relate to the In the Matter of the Search of the residence located at 4302 Dakota Avenue, Nashville, Tennessee Attachment D2 Page6 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 29 of 55 PageID #: 188 violations of 18 U.S.C. ?? 371,1341, 1343, and 1349 involving a conspiracy among, and a scheme executed by, Pilot employees to defraud Pilot Customers by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008. In the Matter of the Search of the residence located at 4302 Dakota Avenue, Nashville, Tennessee Attachment D2 Page7 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 30 of 55 PageID #: 189 Attachment El .LOCATION TO BE SEARCHED The property to be searched is a residence located at 2211 Blair Drive, Hebron, Kentucky which is a multi-story, redish brick home with the number 11 2211" located on the brick enclosed mailbox next to the street. ? Attachment El Page 1 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 31 of 55 PageID #: 190 ATTACHMENT E2 DESCRIPTION OF ITEMS TO BE SEIZED From the residence located at 2211 Blair Drive, Hebron, Kentucky, all documents (defined below) relating to violations of 18 U.S.C. 371, 1341, 1343, and 1349, those violations involving a conspiracy among, and a scheme executed by, Pilot (defined below) employees to defraud Pilot Customers (defined below) by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers' knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008, including: 1. E-mails and any attachments thereto related to Rebate Fraud (defined below); 2. E-mails and any attachments thereto related to Rebate Amounts (defined below); 3. All documents related to Rebate Fraud; 4. All documents related to Rebate Amounts, including data sent from PRS; 5. Profit and Loss Statements for any Direct Billed Customer (defined below); 6. Profit and Loss Statements for any Restricted/Funded Customer (defined below); 7. Funded/Restricted Customer lists, including Funded/Restricted-related "Must 8. Direct Billed Customer lists, including Direct Billed-related "Must Lists"; 9. Customer (defined below) sales call, activity reports, or trip reports; 10. E-mails related to Customer sales calls; 11. SalesForce-generated e-mails attaching or summarizing weekly sales calls, Lists"; activity reports, or trip reports; In the Matter of the Search of the residence located at 2211 Blair Drive, Hebron, Kentucky Attachment E2 Page 1? Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 32 of 55 PageID #: 191 12. Reports related to the profitability of Pilot's direct diesel sales employees or their Customers' accounts; 13. Agreements memorializing any diesel price discount between Pilot and a Pilot Customer; 14. Discount Addition/Change Form; 15. Documents stating or summarizing any diesel price discount agreement between Pilot and a Customer including data stored in and processed through Ascend; 16. Mail packaging or envelopes sent by Pilot employees to a Customer; 17. Rebate checks payable to Customers; 18. Invoices addressed to Customers; 19. Documents related to the wiring of Rebate Amounts to Customers; 20. Documents related to the calculation of Rebate Amounts for Customers; 21. Documents tracking what Rebate Amount a Customer should have been paid by Pilot compared with what Pilot actually paid the Customer; 22. Any document that states what Rebate Amount a Customer should be paid or should have been paid; 23. Any document to be used in the process of calculating a Customer's Rebate Amount; 24. All documents showing daily pricing information for Customers, including Price Fetch (defined below) and Reflection (defined below); 25. A complete imaging, or copying, of the entire contents of any computer devices (defined below) issued to Arnold Ralenkotter by Pilot, including the laptop and Ipad issued by In the Matter of the Search of the residence located at 2211 Blair Drive, Hebron, Kentucky Attachment E2 Page2 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 33 of 55 PageID #: 192 Pilot, so that the complete image, or copy, of any such computer devices may be searched offsite, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information; and 26. A complete imaging, or copying, of the entire contents of any computer device that contains any of the above-described documents, so that the complete image, or copy, of the computer device may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information. 27. The items listed above shall include electronically-stored data, including any form of computer device, including computer devices specifically named above, that can store data. As used both in the attached affidavit supporting the application for a search and seizure warrant and in this attachment, the term "computer device" includes all types of electronic, magnetic, optical, electrochemical, or other high speed data processing devices performing logical, arithmetic, or storage functions, including desktop computers, notebook computers, tablets, server computers, network hardware, hard disks, RAM, floppy disks, flash memory, CD-ROMs, and other magnetic or optical media upon which data can be stored. In the Matter of the Search of the residence located at 2211 Blair Drive, Hebron, Kentucky Attachment E2 Page3 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 34 of 55 PageID #: 193 28. For any computer device whose seizure is otherwise authorized by this warrant, and any computer device that contains or in which is stored records or information that is otherwise called for by this warrant: a) evidence of who used, owned, or controlled the computer device at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b) evidence of the attachment to the computer device of other storage devices or similar containers for electronic evidence; c) evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the computer device; d) evidence of the times the computer was used; e) passwords, encryption keys, and other access devices that may be necessary to access the computer device; t) documentation and manuals that may be necessary to access the computer device or to conduct a forensic examination of the computer device; and records of or information about the Internet Protocol addresses used by the computer device. In the Matter of the Search of the residence located at 2211 Blair Drive, Hebron, Kentucky Attachment E2 Page4 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 35 of 55 PageID #: 194 For the items listed above, the term "Pilot" refers collectively to Pilot Corporation, Pilot Travel Centers, LLC, PilotFlying J, and any other name under which Pilot Corporation sells diesel fuel to commercial customers through its direct sales team of Regional Sales Directors, Regional Sales Managers, Regional Account Representatives, and Inside Sales Representatives. For the items listed above, the term "Customer" and "Customers" refers to Pilot customers who purchase diesel fuel for commercial use from Pilot's stations and travel-plazas, and includes Direct Billed Customers and Funded/Restricted Customers, which are defined below. For the items listed above, the term "Direct Billed Customers" refers to Customers to whom Pilot has extended credit for the purchase of diesel fuel. Direct Billed Customers purchase their diesel from Pilot on credit extended by Pilot, and Pilot sends these Customers an invoice for the cost of the diesel purchased on credit, including any agreed upon discount, on a periodic basis, sometimes on a daily basis, but typically no longer than a weekly basis. For the items listed above, the term "Funded/Restricted Customers" refers to Customers who purchase their diesel fuel from Pilot using a credit source other than Pilot. Funded/Restricted Customers who receive an agreed upon discount from Pilot for the purchase of diesel fuel typically receive that discount in the form a monthly "rebate" check. For the items listed above, the term "Rebate Amount" refers to the amount of money that a Pilot Customer should be credited or refunded pursuant to terms of the diesel price discount deal and agreement between Pilot and the Customer. In the Matter of the Search of the residence located at 2211 Blair Drive, Hebron, Kentucky Attachment E2 Page 5 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 36 of 55 PageID #: 195 For the items listed above, the term "Rebate Fraud" means the intentional and deceptive reduction of a Rebate Amount due to a Customer, without the Customer's knowledge or approval, for th~ purpose of increasing Pilot's profitability and the sales commissions of Pilot employees. For the items listed above, the term "Price Fetch" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to its Customers that shows the diesel fuel price that each Customer is supposed be receiving at each travel plaza specified. For the items listed above, the term "Reflection" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to a Customer's credit card billing company. For the items listed above, the term "documents" means and includes writings or records of every kind or character, conveying information by mechanical, electronic, photographic, or other means, whether encoded, taped, stored or coded electrostatically, electromagnetically, or otherwise, and includes, but is not limited to correspondence, e-mail, facsimiles, notes, memoranda, minutes, summaries, telephone records, telephone message logs or slips, calendars, date books, interoffice communications, results of investigations, videotapes, audiotapes, microfiche, microfilm, any electronic media, accounting and financial records of any kind (including checks (front and back), wire transfers, cash payments or receipts, and check requests), and refers to any record in the organization's possession, custody, or control, and includes all drafts, unfinished versions of documents, and material similar to any of the foregoing however denominated, by whomever prepared, and to whomever addressed that relate to the In the Matter of the Search of the residence located at 2211 Blair Drive, Hebron, Kentucky Attachment E2 Page6 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 37 of 55 PageID #: 196 violations of 18 U.S.C. ?? 371,1341, 1343, and 1349 involving a conspiracy among, and a scheme executed by, Pilot employees to defraud Pilot Customers by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008. In the Matter of the Search of the residence located at 2211 Blair Drive, Hebron, Kentucky Attachment EZ Page7 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 38 of 55 PageID #: 197 Attachment Fl . LOCATION TO BE SEARCHED The property to be searched is a residence located at 3317 Westminster Road, Bettendorf, Iowa which is a multi-story, grey colored home with the number "3317" located on the front of the house. Attachment Fl Page 1 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 39 of 55 PageID #: 198 ATTACHMENT F2 DESCRIPTION OF ITEMS TO BE SEIZED From the residence located at 3317 Westminster Road, Bettendorf, Iowa, all documents (defined below) relating to violations of 18 U.S.C. 371, 1341, 1343, and 1349, those violations involving a conspiracy among, and a scheme executed by, Pilot (defined below) employees to defraud Pilot Customers (defined below) by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers' knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008, including: 1. E-mails and any attachments thereto related to Rebate Fraud (defined below); 2. E-mails and any attachments thereto related to Rebate Amounts (defined below); 3. All documents related to Rebate Fraud; 4. All documents related to Rebate Amounts, including data sent from PRS; 5. Profit and Loss Statements for any Direct Billed Customer (defined below); 6. Profit and Loss Statements for any Restricted/Funded Customer (defined below); 7. Funded/Restricted Customer lists, including Funded/Restricted-related "Must 8. Direct Billed Customer lists, including Direct Billed-related "Must Lists"; 9. Customer (defined below) sales call, activity reports, or trip reports; Lists"; ? 10. 11. E-mails related to Customer sales calls; SalesForce-generated e-mails attaching or summarizing weekly sales calls, activity reports, or trip reports; In the Matter of the Search of the residence located at 3317 Westminster Road, Bettendorf, Iowa Attachment F2 Page 1 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 40 of 55 PageID #: 199 12. Reports related to the profitability of Pilot's direct diesel sales employees or their Customers' accounts; 13. Agreements memorializing any diesel price discount between Pilot and a Pilot Customer; 14. Discount Addition/Change Form; 15. Documents stating or summarizing any diesel price discount agreement between Pilot and a Customer including data stored in and processed through Ascend; 16. Mail packaging or envelopes sent by Pilot employees to a Customer; 17. Rebate checks payable to Customers; 18. Invoices addressed to Customers; 19. Documents related to the wiring of Rebate Amounts to Customers; 20. Documents related to the calculation of Rebate Amounts for Customers; 21. Documents tracking what Rebate Amount a Customer should have been paid by Pilot compared with what Pilot actually paid the Customer; 22. Any document that states what Rebate Amount a Customer should be paid or should have been paid; Any document to be used in the process of calculating a Customer's Rebate 23. Amount; 24. All documents showing daily pricing information for Customers, including Price Fetch (defined below) and Reflection (defined below); 25. A complete imaging, or copying, of the entire contents of any computer devices (defined below) issued to Kevin Hanscomb by Pilot, including the laptop and Ipad issued by In the Matter of the Search of the residence located at 3317 Westminster Road, Bettendorf, Iowa Attachment F2 Page2 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 41 of 55 PageID #: 200 Pilot, so that the complete image, or copy, of any such computer devices may be searched offsite, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information; and 26. A complete imaging, or copying, of the entire contents of any computer device that contains any of the above-described documents, so that the complete image, or copy, of the computer device may be searched off-site, consistent with the search warrant, for any of the above-described documents, and, in the event that any such documents are found, that they may be seized along with any contextual information necessary to understand and preserve the authenticity and provenance of the document seized, including but not limited to, document metadata, or similar information. 27. The items listed above shall include electronically-stored data, including any form of computer device, including computer devices specifically named above, that can store data. As used both in the attached affidavit supporting the application for a search and seizure warrant and in this attachment, the term "computer device" includes all types of electronic, magnetic, optical, electrochemical, or other high speed data processing devices performing logical, arithmetic, or storage functions, including desktop computers, notebook computers, tablets, server computers, network hardware, hard disks, RAM, floppy disks, flash memory, CD-ROMs, and other magnetic or optical media upon which data can be stored. In the Matter of the Search of the residence located at 3317 Westminster Road, Bettendorf, Iowa Attachment F2 Page3 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 42 of 55 PageID #: 201 28. For any computer device whose seizure is otherwise authorized by this warrant, and any computer device that contains or in which is stored records or information that is otherwise called for by this warrant: a) evidence of who used, owned, or controlled the computer device at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usemames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b) evidence of the attachment to the computer device of other storage devices or similar containers for electronic evidence; c) evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the computer device; d) evidence of the times the computer was used; e) passwords, encryption keys, and other access devices that may be necessary to access the computer device; f) documentation and manuals that may be necessary to access the computer device or to conduct a forensic examination of the computer device; and records of or information about the Internet Protocol addresses used by the computer device. In the Matter of the Search of the residence located at 3317 Westminster Road, Bettendorf, Iowa Attachment F2 Page4 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 43 of 55 PageID #: 202 For the items listed above, the term "Pilot" refers collectively to Pilot Corporation, Pilot Travel Centers, LLC, PilotFlying J, and any other name under which Pilot Corporation sells diesel fuel to commercial customers through its direct sales team of Regional Sales Directors, Regional Sales Managers, Regional Account Representatives, and Inside Sales Representatives. For the items listed above, the term "Customer" and "Customers" refers to Pilot customers who purchase diesel fuel for commercial use from Pilot's stations and travel-plazas, and includes Direct Billed Customers and Funded/Restricted Customers, which are defined below. For the items listed above, the term "Direct Billed Customers" refers to Customers to whom Pilot has extended credit for the purchase of diesel fuel. Direct Billed Customers purchase their diesel from Pilot on credit extended by Pilot, and Pilot sends these Customers an invoice for the cost of the diesel purchased on credit, including any agreed upon discount, on a periodic basis, sometimes on a daily basis, but typically no longer than a weekly basis. For the items listed above, the term "Funded/Restricted Customers" refers to Customers who purchase their diesel fuel from Pilot using a credit source other than Pilot. Funded/Restricted Customers who receive an agreed upon discount from Pilot for the purchase of diesel fuel typically receive that discount in the form a monthly "rebate" check. For the items listed above, the term "Rebate Amount" refers to the amount of money that a Pilot Customer should be credited or refunded pursuant to terms of the diesel price discount deal and agreement between Pilot and the Customer. In the Matter of the Search of the residence located at 3317 Westminster Road, Bettendorf, Iowa Attachment F2 PageS Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 44 of 55 PageID #: 203 For the items listed above, the term "Rebate Fraud" means the intentional and deceptive reduction of a Rebate Amount due to a Customer, without the Customer's knowledge or approval, for the purpose of increasing Pilot's profitability and the sales commissions of Pilot employees. For the items listed above, the term "Price Fetch" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to its Customers that shows the diesel fuel price that each Customer is supposed be receiving at each travel plaza specified. For the items listed above, the term "Reflection" is what Pilot internally refers to as the daily diesel price information that Pilot has the capability of sending to a Customer's credit card billing company. For the items listed above, the term "documents" means and includes writings or records of every kind or character, conveying information by mechanical, electronic, photographic, or other means, whether encoded, taped, stored or coded electrostatically, electromagnetically, or otherwise, and includes, but is not limited to correspondence, e-mail, facsimiles, notes, memoranda, minutes, summaries, telephone records, telephone message logs or slips, calendars, date books, interoffice communications, results of investigations, videotapes, audiotapes, microfiche, microfilm, any electronic media, accounting and financial records of any kind (including checks (front and back), wire transfers, cash payments or receipts, and check requests), and refers to any record in the organization's possession, custody, or control, and includes all drafts, unfinished versions of documents, and material similar to any of the foregoing however denominated, by whomever prepared, and to whomever addressed that relate to the In the Matter of the Search of the residence located at 3317 Westminster Road, Bettendorf, Iowa Attachment F2 Page6 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 45 of 55 PageID #: 204 violations of 18 U.S.C. ?? 371,1341, 1343, and 1349 involving a conspiracy among, and a scheme executed by, Pilot employees to defraud Pilot Customers by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008. In the Matter of the Search of the residence located at 3317 Westminster Road, Bettendorf, Iowa Attachment F2 Page7 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 46 of 55 PageID #: 205 ATTACHMENT G "PILOT PARK" Office Park *The building located at 5500 Lonas Drive, Knoxville, Tennessee, is referred to on "Pilot Park" office park signage as "Building 1 5500" and "Building 1 5500 Lonas Road." Attachment G Page 1 of 1 Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 47 of 55 PageID #: 206 ATTACHMENT H Special Conditions Your affiant, Special Agent Robert H. Root, FBI, requests approval for the following special conditions of the requested search and seizure warrants: 1. Documents The term "documents" means and includes writings or records of every kind or character, conveying information by mechanical, electronic, photographic, or other means, whether encoded, taped, stored or coded electrostatically, electromagnetically, or otherwise, and includes, but is not limited to correspondence, e-mail, facsimiles, notes, memoranda, minutes, summaries, telephone records, telephone message logs or slips, calendars, date books, interoffice communications, results of investigations, videotapes, audiotapes, microfiche, microfilm, any electronic media, accounting and financial records of any kind (including checks (front and back), wire transfers, cash payments or receipts, and check requests), and refers to any re~ord in the organization's possession, custody, or control, and includes all drafts, unfinished versions of documents, and material similar to any of the foregoing however denominated, by whomever prepared, and to whomever addressed that relate to the violations of 18 U.S.C. ?? 371,1341, 1343, and 1349 involving a conspiracy among, and a scheme executed by, Pilot employees to defraud Pilot Customers by deceptively reducing discounts and rebates due to Pilot Customers, without the Customers knowledge or approval, for the dual purposes of increasing Pilot's profitability and the sales commissions of the Pilot employees participating in the conspiracy and scheme to defraud, and occurring after January 1, 2008. 2. 5508 Lonas Drive, Knoxville, Tennessee ("the 5508 Lonas Drive Property") Potential Attorney-Client Information and Material Subject to Attorney Work Product Doctrine It is possible that documents potentially falling within the categories of the attorney-client privilege or the attorney work product doctrine (collectively referred to herein as "any Privilege") may be found at the 5508 Lonas Drive Property. Accordingly, the following procedures will be employed: Non-electronic Documents and Records (except those contained in General Counsel or Associate Counsel's Office): The government will establish a "filter team" to deal with documents potentially covered by any Privilege. The filter team will consist of a special agent(s) and a federal attorney(s), neither of Attachment H Page 1 In the matter of the search warrants for the following: the office building located at 5500 Lonas Drive, Knoxville, Tennessee; the office building located at 5508 Lonas Drive, Knoxville, Tennessee; the commercial building located at 1339 East Weisgarber Road, Knoxville, Tennessee the residence located at 4302 Dakota Avenue, Nashville, Tennessee; the residence located at 2211 Blair Drive, Hebron, Kentucky; and the residence located at 3317 Westminster Road, Bettendorf, Iowa. Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 48 of 55 PageID #: 207 whom will be involved in any prosecution of this matter. A) The filter team special agent(s) will participate in the execution of the search warrant. Other members of the search team will be instructed that upon determining that a document may contain communication between an attorney and a client or may contain the work product of an attorney, they are to cease reading the document and provide it to the filter team special agent(s). To facilitate this process, all agents who are involved in the search will be provided with a list of the names of attorneys who are believed to be affiliated with the companies. B) The filter team special agent(s) will place any potentially privileged materials into a specially designated and sealed container that is marked "potential attorney-client privilege or attorney work product." The filter team special agent(s) will be directed not to discuss or share such documents with anyone, except other members of the filter team. The filter special agent(s) is to deliver such documents to the filter team attorney(s). The filter team attorney( s), upon receiving such documents, shall maintain them in a secure location separate and apart from any other evidence seized during the search. C) The filter team special agent(s) will have the potentially privileged material scanned and placed in a searchable database that is walled-off in an environment that is inaccessible from the prosecution team. After the filter attorney(s) has received the container of potentially privileged material, the filter attorney(s) will make the potentially privileged documents available to defense counsel. The filter attorney(s) will work with defense counsel toward obtaining a list of search terms from defense counsel to be used by the filter team to sort privileged material from non-privileged material. If the filter attorney(s) cannot reach a mutually agreeable method with defense counsel for the filter team to sort privileged material from non-privileged material, the filter attorney will schedule a status conference with the Court before beginning review of the potentially privileged material. Electronically stored documents and records: Electronically stored documents (excluding those contained on any email and file servers) will be subject to a similar procedure to that outlined above. Other members of the search team will be instructed that upon determining that an electronically stored document or record may contain communication between an attorney and a client, they are to cease reading the document. The document should then be segregated into an electronic folder marked "potential attorney-client privilege." The folder will be provided to a member of the filter team, and it will be handled in the same manner as that set forth above for non-electronic documents for separating privileged material from non-privileged material. Attachment H Page2 In the matter of the search warrants for the following: the office building located at 5500 Lonas Drive, Knoxville, Tennessee; the office building located at 5508 Lonas Drive, Knoxville, Tennessee; the commercial building located at 1339 East Weisgarber Road, Knoxville, Tennessee the residence located at 4302 Dakota Avenue, Nashville, Tennessee; the residence located at 2211 Blair Drive, Hebron, Kentucky; and the residence located at 3317 Westminster Road, Bettendorf, Iowa. Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 49 of 55 PageID #: 208 Non-electronic and electronic documents found in Pilot general counsel or associate general counsel's office: Pilot general counsel's and associate general counsel's office will be searched exclusively by the filter team and will be searched for only those items specifically listed under the heading "Items to be Seized from General Counsel and Associate General Counsel's Offices" in Attachment B2 to the Search and Seizure Warrant for the property located at 5508 Lonas Drive, Knoxville, Tennessee. All documents found in Pilot general counsel's or associate general counsel's office will be segregated from anyone who is not on the filter team. A copy of all the documents seized from Pilot general counsel's or associate general counsel's office, whether electronic or nonelectronic, will be provided to defense counsel as soon as practicable following the completion of the search of the 5508 Lonas Drive Property. Defense counsel shall maintain a privilege log to document the materials over which the defense is asserting privilege that were seized from Pilot general counsel's or associate general counsel's offices. Defense counsel and the filter attorney(s) will then discuss an appropriate procedure to review the documents and determine whether they are privileged and/or fall within any exceptions to privilege. If the filter attorney(s) agrees with defense counsel's assertion of privilege over a document, the document will be returned to defense counsel and not made known to the grand jury and/or the prosecution team. If the filter attorney(s) and defense counsel have a disagreement regarding whether a document is privileged, the matter shall be brought to the court's attention for in camera adjudication. Electronic images of entire computers: All electronic images of entire computers that are seized from the 5508 Lonas Drive Property will be segregated in an environment that is inaccessible by the investigation/prosecution team until a privilege review of the entire image can be completed by the filter team. The filter attorney(s) will work with defense counsel toward obtaining a list of search terms from defense counsel to be used by the filter team to sort privileged material from non-privileged material If the filter attorney(s) cannot reach a mutually agreeable method with defense counsel for the filter team to sort privileged material from non-privileged material, the filter attorney will schedule a status conference with the Court before beginning review of the potentially privileged material. Email and File Servers: Any portion of email and file servers that is copied will be reviewed on site only by Computer Analysis Response Team agents and Digital Evidence Technicians to the extent necessary to ensure that a readable copy of any such seized portion of an email and file servers has in fact been seized. Any such review will be a random sampling of data. In the event that during any such random data sampling, a document is called up that appears to contain communication between an attorney and a client or may contain the work product of an attorney, the Computer Analysis Response Team agent or Digital Evidence Technician conducting the random data sampling will cease reading the document and notify the filter team special agent(s), and proceed to randomly selecting another document. Attachment H Page3 In the matter of the search warrants for the following: the office building located at 5500 Lonas Drive, Knoxville, Tennessee; the office building located at 5508 Lonas Drive, Knoxville, Tennessee; the commercial building located at 1339 East Weisgarber Road, Knoxville, Tennessee the residence located at 4302 Dakota Avenue, Nashville, Tennessee; the residence located at 2211 Blair Drive, Hebron, Kentucky; and the residence located at 3317 Westminster Road, Bettendorf, Iowa. Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 50 of 55 PageID #: 209 Any portion of email and file servers that is copied from the 5508 Lonas Drive Property will be segregated in an environment that is inaccessible by the investigation/prosecution team until a privilege review of the entire image can be completed by the filter team. The filter attorney( s) will work with defense counsel toward obtaining a list of search terms from defense counsel to be used by the filter team to sort privileged material from non-privileged material If the filter attorney(s) cannot reach a mutually agreeable method with defense counsel for the filter team to sort privileged material from non-privileged material, the filter attorney will schedule a status conference with the Court before beginning review of the potentially privileged material. The search for and seizure of non-electronic and electronic documents within the individual offices ofPilot CEO Jimmy Haslam, Pilot President Mark Hazelwood, and Pilot CFO Mitch Steenrod: The search for and seizure of non-electronic and electronic documents within the individual offices of Pilot CEO Jimmy Haslam, Pilot President Mark Hazelwood, and Pilot CFO Mitch Steenrod will be conducted exclusively by filter agents. 3. 5500 Lonas Drive, Knoxville, Tennessee ("the 5500 Lonas Drive Property") and 1339 E. Weisgarber Road, Knoxville, Tennessee ("the 1339 E. Weisgarber Road Property") Potential Attorney-Client Information and Material Subject to Attorney Work Product Doctrine: It is possible that documents potentially falling within the categories of the attorney-client privilege or the attorney work product doctrine (collectively referred to herein as "any Privilege") may be found at the 5500 Lonas Drive Property and the 1339 E. Weisgarber Road Property. Accordingly, the following procedures will be employed: Non-electronic Documents and Records: The government will establish a "filter team" to deal with documents potentially covered by any Privilege. The filter team will consist of a special agent(s) and a federal attorney(s), neither of whom will be involved in any prosecution of this matter. A) The filter team special agent(s) will participate in the execution of the search warrant. Other members of the search team will be instructed that upon determining that a document may contain communication between an attorney and a client or may contain the work product of an attorney, they are to cease reading the document and provide it to the filter team special agent(s). To facilitate this process, all agents who are involved in the search will be provided with a list of the names of attorneys who are believed to be affiliated with the companies. B) The filter team special agent(s) will place any potentially privileged materials into a specially designated and sealed container that is marked "potential attorney-client Attachment H Page4 In the matter of the search warrants for the following: the office building located at 5500 Lonas Drive, Knoxville, Tennessee; the office building located at 5508 Lonas Drive, Knoxville, Tennessee; the commercial building located at 1339 East Weisgarber Road, Knoxville, Tennessee the residence located at 4302 Dakota Avenue, Nashville, Tennessee; the residence located at 2211 Blair Drive, Hebron, Kentucky; and the residence located at 3317 Westminster Road, Bettendorf, Iowa. Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 51 of 55 PageID #: 210 privilege or attorney work product." The filter team special agent(s) will be directed not to discuss or share such documents with anyone, except other members of the filter team. The filter special agent(s) is to deliver such documents to the filter team attorney(s). The filter team attorney(s), upon receiving such documents, shall maintain them in a secure location separate and apart from any other evidence seized during the search. C) The filter team special agent(s) will have the potentially privileged material scanned and placed in a searchable database that is walled-off in an environment that is inaccessible from the prosecution team. After the filter attorney( s) has received the container of potentially privileged material, the filter attorney(s) will make the potentially privileged documents available to defense counsel. The filter attorney(s) will work with defense counsel toward obtaining a list of search terms from defense counsel to be used by the filter team to sort privileged material from non-privileged material If the filter attorney( s) cannot reach a mutually agreeable method with defense counsel for the filter team to sort privileged material from non-privileged material, the filter attorney will schedule a status conference with the Court before beginning review of the potentially privileged material. Electronically stored documents and records Electronically stored documents (excluding those contained on any email and file servers) will be subject to a similar procedure to that outlined above. Other members of the search team will be instructed that upon determining that an electronically stored document or record may contain communication between an attorney and a client, they are to cease reading the document. The document should then be segregated into an electronic folder marked "potential attorney-client privilege." The folder will be provided to a member of the filter team, and it will be handled in the same manner as that set forth above for non-electronic documents for separating privileged material from non-privileged material. Electronic images of entire computers All electronic images of entire computers that are seized from the 5500 Lonas Drive Property and the 13 39 E. Weisgarber Road Property will be segregated in an environment that is inaccessible by the investigation/prosecution team until a privilege review of the entire image can be completed by the filter team. The filter attorney(s) will work with defense counsel toward obtaining a list of search terms from defense counsel to be used by the filter team to sort privileged material from non-privileged material If the filter attorney(s) cannot reach a mutually agreeable method with defense counsel for the filter team to sort privileged material from non-privileged material, the filter attorney will schedule a status conference with the Court before beginning review of the potentially privileged material. Attachment H PageS In the matter of the search warrants for the following: the office building located at 5500 Lonas Drive, Knoxville, Tennessee; the office building located at 5508 Lonas Drive, Knoxville, Tennessee; the commercial building located at 1339 East Weisgarber Road, Knoxville, Tennessee the residence located at 4302 Dakota Avenue, Nashville, Tennessee; the residence located at 2211 Blair Drive, Hebron, Kentucky; and the residence located at 3317 Westminster Road, Bettendorf, Iowa. Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 52 of 55 PageID #: 211 Email and File Servers: Any portion of email and file servers that is copied will be reviewed on site only by Computer Analysis Response Team agents and Digital Evidence Technicians to the extent necessary to ensure that a readable copy of any such seized portion of an email and file servers has in fact been seized. Any such review will be a random sampling of data. In the event that during any such random data sampling, a document is called up that appears to contain communication between an attorney and a client or may contain the work product of an attorney, the Computer Analysis Response Team agent or Digital Evidence Technician conducting the random data sampling will cease reading the document and notify the filter team special agent(s), and proceed to randomly selecting another document. Any portion of email and file servers that is copied from the 5500 Lonas Drive Property will be segregated in an environment that is inaccessible by the investigation/prosecution team until a privilege review of the entire image can be completed by the filter team. The filter attorney(s) will work with defense counsel toward obtaining a list of search terms from defense counsel to be used by the filter team to sort privileged material from non-privileged material If the filter attorney(s) cannot reach a mutually agreeable method for the filter team to sort privileged material from nonprivileged material, the filter attorney will schedule a status conference with the Court before beginning review of the potentially privileged material. 4. 4302 Dakota Avenue, Nashville, Tennessee ("the 4302 Dakota Avenue Property"), 2211 Blair Drive, Hebron Kentucky ("the 2211 Blair Drive Property"), and 3317 Westminster Road, Bettendorf, Iowa ("the 3317 Westminster Road Property") Potential Attorney-Client Information and Material Subject to Attorney Work Product Doctrine: While it is unlikely that documents to or from Pilot corporate counsel to the mid-level managers whose remote home offices are located within these properties could be considered privileged, it is possible that Pilot could try to assert that documents potentially falling within the category of the attorney-client privilege (collectively referred to herein as "any Privilege") may be found at the 4302 Dakota Avenue Property, the 2211 Blair Drive Property, and 3317 Westminster Road Property. Accordingly, out of an abundance of caution, the following procedures will be employed: Non-electronic Documents and Records: The government will establish a "filter team" to deal with documents potentially covered by any Privilege. The filter team will consist of a special agent(s) and a federal attorney(s), neither of whom will be involved in any prosecution of this matter. Attachment H Page6 In the matter of the search warrants for the following: the office building located at 5500 Lonas Drive, Knoxville, Tennessee; the office building located at 5508 Lonas Drive, Knoxville, Tennessee; the commercial building located at 1339 East Weisgarber Road, Knoxville, Tennessee the residence located at 4302 Dakota Avenue, Nashville, Tennessee; the residence located at 2211 Blair Drive, Hebron, Kentucky; and the residence located at 3317 Westminster Road, Bettendorf, Iowa. Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 53 of 55 PageID #: 212 A) The filter team special agent(s) will participate in the execution of the search warrant. Other members of the search team will be instructed that upon determining that a document may contain communication between an attorney and a client or may contain the work product of an attorney, they are to cease reading the document and provide it to the filter team special agent(s). To facilitate this process, all agents who are involved in the search will be provided with a list of the names of attorneys who are believed to be affiliated with the compan1es. B) The filter team special agent(s) will place any potentially privileged materials into a specially designated and sealed contqiner that is marked "potential attorney-client privilege or attorney work product." The filter team special agent(s) will be directed not to discuss or share such documents with anyone, except other members of the filter team. The filter special agent(s) is to deliver such documents to the filter team attorney(s). The filter team attorney( s), upon receiving such documents, shall maintain them in a secure location separate and apart from any other evidence seized during the search. C) The filter team special agent(s) will have the potentially privileged material scanned and placed in a searchable database that is walled-off in an environment that is inaccessible from the prosecution team. After the filter attorney(s) has received the container of potentially privileged material, the filter attorney(s) will make the potentially privileged documents available to defense counsel. The filter attorney( s) will work with defense counsel toward obtaining a list of search terms from defense counsel to be used by the filter team to sort privileged material from non-privileged material If the filter attorney(s) cannot reach a mutually agreeable method with defense counsel for the filter team to sort privileged material from non-privileged material, the filter attorney will schedule a status conference with the Court before beginning review of the potentially privileged material. Electronically stored documents and records Electronically stored documents (excluding those contained on any email and file servers) will be subject to a similar procedure to that outlined above. Other members of the search team will be instructed that upon determining that an electronically stored document or record may contain communication between an attorney and a client, they are to cease reading the document. The document should then be segregated into an electronic folder marked "potential attorney-client privilege." The folder will be provided to a member of the filter team, and it will be handled in the same manner as that set forth above for non-electronic documents for separating privileged material from non-privileged material. Attachment H Page7 In the matter of the search warrants for the following: the office building located at 5500 Lonas Drive, Knoxville, Tennessee; the office building located at 5508 Lonas Drive, Knoxville, Tennessee; the commercial building located at 1339 East Weisgarber Road, Knoxville, Tennessee the residence located at 4302 Dakota Avenue, Nashville, Tennessee; the residence located at 2211 Blair Drive, Hebron, Kentucky; and the residence located at 3317 Westminster Road, Bettendorf, Iowa. Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 54 of 55 PageID #: 213 Electronic images of entire computers All electronic images of entire computers that are seized from the 4302 Dakota Avenue Property, the 2211 Blair Drive Property, and 3317 Westminster Road Property will be segregated in an environment that is inaccessible by the investigation/prosecution team until a privilege review of the entire image can be completed by the filter team. The filter attorney( s) will work with defense counsel toward obtaining a list of search terms from defense counsel to be used by the filter team to sort privileged material from non-privileged material If the filter attomey(s) cannot reach a mutually agreeable method with defense counsel for the filter team to sort privileged material from non-privileged material, the filter attorney will schedule a status conference with the Court before beginning review of the potentially privileged material. Attachment H PageS In the matter of the search warrants for the following: the office building located at 5500 Lonas Drive, Knoxville, Tennessee; the office building located at 5508 Lonas Drive, Knoxville, Tennessee; the commercial building located at 1339 East Weisgarber Road, Knoxville, Tennessee the residence located at 4302 Dakota Avenue, Nashville, Tennessee; the residence located at 2211 Blair Drive, Hebron, Kentucky; and the residence located at 3317 Westminster Road, Bettendorf, Iowa. Case 3:13-mj-02028 Document 4-1 Filed 04/18/13 Page 55 of 55 PageID #: 214