Timeline: Feds Bust Massive Alphabay Vendor “HumboldtFarms”

On August 8, a Homeland Security Investigations officer signed a completed arrest warrant, signalling that he had arrested William James Farber in Los Angeles, California. Farber, a 37-year-old convicted felon, had operated—along with six co-conspirators—one of of the most successful Alphabay vendor accounts in existence. At the group’s peak, they shipped 1,000 packages every week. Not only had Farber sold on Alphabay, newly-released court documents explained, but on nearly every market since the original Silk Road. Back then, though, he used a different username: “PureFireMeds.”

Farber fell into law enforcement’s scope after a series of transactions with an unlicensed Bitcoin exchanger. Authorities redacted pages of the criminal complaint, and as a result, many critical pieces of information—pieces connecting the Bitcoin exchange to PureFireMeds and HumboldtFarms—are unavailable to the public. All the complaint revealed was that former DEA Task Force Officer Jared Gabbay sent California law enforcement information obtained in a search warrant. The government redacted the details, but left an address. We do know, from other parts of the document, that the federal investigators found the Bitcoin exchanger through a confidential informant, though.

A search for the address where the warrant was executed—150 Harvard St., Cambridge, Massachusetts—resulted in little useable information. According to the complaint, the warrant was executed by the Drug Enforcement Agency and Cambridge police on January 23, 2014. The single useful result from a Google search of the address is a news article from January 24, 2014. At that address, the DEA and Cambridge police found “items that they were concerned about” on January 23. One woman, Jan Visterfeld, was arrested and charged with drug distribution. Cambridge Police Deputy Superintendent Jack Albert said that authorities removed materials from the scene, but would not reveal any further details.

“They cleared the scene and said there was no danger to neighboring residents, and investigators came back today to remove some stuff they want to have analyzed,’’ Albert said. Visterfeld pleaded not guilty the following day. A spokesperson for the district attorney’s office would not reveal what drugs Visterfeld had been arrested for distributing.

Authorities had not redacted the name of one of the apartment’s residents: “Jay Best.” The “name” connected to the name of an online Bitcoin exchanger that traded cash—through the mail—for bitcoins. He was known online as “Cashguy,” and even known by international authorities.

Jay Best used the email addresses [email protected] and [email protected]

At the Cashguy apartment raid on January 23, law enforcement found a shipping label made out to Farber. The tracking number matched a tracking number in a message between PureFireMeds (PFM) and Cashguy. A connection was positively established between PFM and Farber, at that point in time. He connected the PFM vendor accounts on several darknet markets by checking the PGP key used on each account. The agent’s experience helped him deduce that because the accounts shared listings, usernames, and PGP keys, the same entity owned every one of the accounts. He said.

An analysis from the DEA:

“PFM finalized 5,486 narcotics orders between August 26, 2013, and October 28, 2014. PFM sold 10 different types of illegal narcotics, including marijuana, cocaine, norco hydrocodone, ‘mushrooms, ecstasy, MDMA, LSD, OxyCOdone, Xanax, and Ketamine. The total value of these finalized orders was estimated to be $1,183,904.60.”

September 30, 2016: The investigating agent found a post from a Reddit user that asked if HumboldtFarms was scamming users. Another Reddit user replied that HumboldtFarms (HF) “might be the vendor PureFireMeds.” He found the HF account on numerous darknet markets.

February 23, 2017: An undercover, controlled order was placed by a California detective and the HSI agent. Package arrived. The “leafy green substance” tested positive for marijuana.

March 1 – March 23, 2017: USPIS Inspectors profiled the packages. They were shipped, frequently, from the same address. The packages used fake return addresses or addresses missing various numbers. HF also shipped packages in USPS Flat Rate boxes, but instead of the usual label, the drug trafficking organization (referred to in the complaint as HumboldtFarmsDTO) used USPS stamps. A USPS employee explained that this was highly unusual. Inspectors identified a “heavyset” Hispanic male who had made routine deliveries of packages that matched the description given by law enforcement. They caught his vehicle on USPS footage.

After the suspect departed the post office one day, law enforcement made the first major moves on the ground:

• A Fresno police officer pulled the suspect over for driving without tags and illegal window tint. The suspect had no ID, but identified himself as “Michael Palma.”
• Postal inspectors identified four mail sacks containing 100-200 USPS Flat Rate boxes.
• With assistance from a K9 unit, postal inspectors opened two packages and found that they had contained marijuana cookies and brownies.

Palma was identified and subsequently found on Facebook where he was friends with Farber and Bryan Lemons. The next seven pages in the complaint were redacted.

April 1: A postal inspector had previously noted that the stamps used on HF’s packages were the only stamps used by the DTO. USPS pulled recent transactions and found that someone had purchased the stamps in batches of $1,000-$3,000 per visit. Security footage revealed a woman that matched the pictures from Facebook and Instagram accounts of Annie Jagler. Jagler was friends with Lemon and Farber.

April 5: Law enforcement placed a tracker on Palma’s vehicle. His vehicle, notably with visible plates, led the authorities to the home of Michele Pickerell. She lived in a “gated community” where the security guard recognized and identified many members of the DTO. In addition to Pickerell, surveillance at this location added one more member of the DTO to the list of suspects: Richard Thomas Martinsen. (It was later discovered that postal inspectors had previously identified him as a suspect but not his full identity).

April 12: “Det. Kim found a picture on Facebook from 2015 that included Pickerell in a photo with three other women wearing a Stix Ride Shop hat (Stix Ride Shop is a skateboarding business owned by Farber); Farber’ “liked” this photo on Facebook,” the HSI agent explained.

April-May: Martinsen’s activities were dissected. Postal inspectors found vape cartridges with [email protected] branding. JustDabble was a company closely affiliated with the DTO. The company sells marijuana vape cartridges and closely connected to other known members or associates of Farber, including an edible company linked to Farber himself. Additionally, Martinsen’s banking activity had caught the eye of IRS inspectors for suspicious activity:

“Wells Fargo bank reported that the currency deposited into Martinsen’s accounts had an odor of marijuana and that multiple cash deposits were conducted at branches located in California, Illinois, Nevada, Florida, and Oregon by unknown subjects. ‘The cash deposits were then immediately followed by cash withdrawals in or near Hollywood, CA. The cash deposits were often in amounts just below the Currency Transaction Report filing threshold [$10,000].”

April-May 9: Fresno police placed a gps tracker on Farber’s vehicle and mapped his activities. They knew when he would be somewhere, when he got gas, when he purchased new clothing, etc. They also noticed that he made routine stops at a warehouse. Law enforcement “smelled” the building and reported a marijuana odor. They had obviously discovered what the warehouse contained at this point. Det. Kim reached out to the department of water and power to confirm the suspicion that Farber was using the warehouse to grow marijuana.

The warehouse used more kilowatt hours of power per month than the average Costco.

May 20: The agent discovered that HF had entered vacation mode on Alphabay.

May 22: HF started messaging other Alphabay vendor to sell the vendor account. The account operator requested $100,000 to $400,000. Alphabay admins then banned HF, Larsen reported. The message is below. Spacing added.

“Hello from HumboldtFarms!

You are receiving this message because you are a TRUSTED VENDOR WITH GOOD RATINGS and we would like give you a unique opportunity. After over 3 great years of being a Top level Cannabis vendor we have decided to get out of the business and we are selling our accounts on Alphabay and Dream. Since 2015 we have sold over $8 million in sales and have been trusted by our repeat customers again and again. This really is a big opportunity for someone to make a lot of money.

Please take a second to visit our stats or see them listed below and or find us our stats on grams. We are in good standing with not only our customers but also the site admins. Due to unforeseen issues with our staff we are forced to close and get out of the business even though we do not wish to do this. Our accounts can be easily taken over by anyone who sees the huge opportunity to buy the account and start generating some massive sales and income.

We are currently going on Vacation mode to get caught up with our current sales because of short staff.. We are currently taking offers starting no less then $100k USD but ideally we are looking to get 200k-400k (these numbers can easily be made back within a few weeks). We are only considering TRUSTED VENDORS WITH GOOD RATINGS and long stats history to sell to so we can continue to have a good name. Please take your time to study our stats and message me with the subject to read “BUYER INTERESTED” to make us an offer.”

The End: The IRS conducted an analysis of the funds received by every known HF bitcoin address. In total, Farber/HF had earned more than six million dollars from darknet or otherwise suspicious sources. The HF wallets were, like the PFM wallets, directly linked to Farber himself. Larsen called for the DTO’s arrest:

“Based upon my training and experience, and on the facts set forth in this affidavit, I believe there is probable cause that defendants [Farber, Palma, Martinsen, Lemons, and Pickerell], violated Title 21, United States Code, Sections 846 and 841(a)(1) (b)(1)(C) (Distribution of Controlled Substances and Conspiracy~ and Title 18, United States Code, Sections 1956 1957 (Money Laundering and Conspiracy). I therefore request that the Court authorize the attached complaints and arrest warrants.”

Farber and Lemons were picked up on conspiracy to distribute controlled substances and money laundering. According to the DoJ, the remainder were charged with only conspiracy to distribute controlled substances.