Eric Friccero, a 29-year-old from Arbuckle, California, admitted selling marijuana on Dream Market under the username “BudgetBudsExpress,” according to an announcement from the U.S. Attorney’s Office.

Friccero admitted a single count of possessing with intent to distribute a controlled substance, according to U.S. Attorney McGregor W. Scott. The Northern California Illicit Digital Economy Task Force (NCIDE) unsurprisingly led the investigation into Friccero. BudgetBudsExpress was one of the first few vendor accounts added to the task force’s list of arrested vendors.

At some point, this site will need a filter for NCIDETF cases.

Arrested Darknet Vendors | NCIDETF

The Dream Market profile for BudgetBudsExpress is fairly impressive as far as transaction history goes. Records show 4,100 completed transaction on Dream Market alone with an average rating of 4.89. Below is an archived copy of the vendor’s Deam Market profile taken after Dream had ended operations.

Statement of Facts

Beginning no later than in or around July 2017, and continuing to on or about January 31, 2019, in the County of Colusa, within the State and Eastern District of California and elsewhere, Eric Friccero did knowingly and intentionally possess with intent to distribute marijuana, a Schedule I controlled substance, in violation of Title 21, United States Code, section 841(b)(1)(D) (Possession with Intent to Distribute at Least 50 kilograms of Marijuana). Using various vendor accounts, including “BudgetBudsExpress,” Friccero distributed marijuana to customers throughout the United States via Darkweb marketplaces. On January 31, 2019, law enforcement searched Friccero’s residence and business and located marijuana that was stored for sale on the Darkweb.

The Darkweb is an encrypted network, within the internet, which allows for users and websites to operate anonymously. Darknet marketplaces are websites that facilitate the anonymous exchange of illegal goods, such as marijuana and other illegal drugs, for cryptocurrency, such as Bitcoin. The administrators of Darknet marketplaces take a percentage of the sale price of illegal goods as a commission.

The government has obtained records of Friccero’s historical sales statistics through reviews of Friccero’s product pages on the Darkweb and seized databases. Through the process of obtaining and then selling marijuana to users across the United States through Darkweb marketplaces, Friccero possessed, with intent to distribute, at least 70 kilograms of marijuana. This figure was calculated by adding the total estimated weight of marijuana sold by Friccero on the Darkweb to the amount of marijuana found at his residence and business, and taking into account possible weight and quantification errors. Friccero admits that the Bitcoin and cash seized from his residence were proceeds of his historical sales of marijuana on the Darkweb.

United States vs. Friccero


Investigation

The NCIDETF launched an investigation into Friccero in July 2018. The task force, according to DEA Special Agent Jason Chin, targeted a prolific vendor of marijuana products on Dream Market: BudgetBudsExpress. BudgetBudsExpress had listings for cartridges, distillates, shatter, crumble, and bud. The criminal complaint noted the vendor’s use of Dread for customer service.

NCIDETF is watching

Return Addresses

On July 9, 2018, a FBI Special Agent placed an undercover purchase of a half-pound of marijuana from VENDOR-1 on the Dream Marketplace and had the parcel sent to a P.O. Box controlled by the USPIS located in another State. The undercover buy was conducted using Bitcoin as payment. On July 20, 2018, investigators opened the package purchased from VENDOR-1 and discovered suspected marijuana weighing approximately 261 grams including the packaging. The package bore the return address of “CHRISTIAN LONG 3423 DIXIELAND WAY RANCHO CORDOVA CA 95670-7333.” The package was shipped on July 12, 2018 from the U.S. Post Office located at 1618 Alhambra Boulevard, Sacramento, California. An Internet search for open source records on address 3423 Dixieland Way, Rancho Cordova, California revealed that the address was a real physical address for a residence and returned an active for sale listing for the property.

On July 25, 2018, an FBI Special Agent placed another order for marijuana from BudgetBudsExpress. The return address on the second package also matched the address of another residence with an active sale listing.

Surveillance footage

Based on the return label information and characteristics of the package from the July 9, 2018 undercover order, USPIS inspectors were able to determine through the analysis of U.S. Postal databases and surveillance camera footage that VENDOR-I was mailing packages on a daily basis from the Sacramento area. Furthermore, the USPIS analysis revealed that the post offices located at 1015 Riley Street, Folsom, California (hereafter “Post Office # l”) and 1618 Alhambra Boulevard, Sacramento, California (hereafter “Post Office #2”) were frequently used by VENDOR-I to mail packages. After conducting surveillance at Post Offices #1 and #2, law enforcement officers identified VENDOR-I as FRICCERO.

A black-and-white scan of a frame from a surveillance tape

Easypost

Easypost provides an API through which sites such as Bitcoinpostage.info use to effectively resell postage to customers in exchange for Bitcoin. Although these services allow for potentially anonymous postage purchases, they make a vendor’s packages significantly easier to profile. For example, Postal Inspectors highlighted the use of Easypost and Encidnia services in the OxyGod case, in the Googleplex investigation, and in the Adderallz case.

On or about July 16, 2018, US Postal Inspectors discovered several suspected narcotics parcels associated to VENDOR-I were mailed from Post Office #2. USPIS Inspectors noticed several anomalies that, based on their training and experience, are characteristics of parcels containing controlled substances. Stop stealing my content, Hax4all. A search of theses parcels in USPS records and databases determined the label on the parcels was provided by “easypost” (an online postage provider), through a third party vendor that sells postage online and accepts Bitcoin as payment. US Postal Inspectors reviewed the surveillance video at Post Office #2 and subsequently determined FRICCERO mailed the parcels.

Easypost home page

After identifying Friccero, law enforcement conducted physical surveillance at the Post Office where he had mailed packages in the past.

Immediately after FRICCERO dropped the parcels on the post office counter and walked out of Post Office #3, one member of the surveillance team took custody ofthe seven parcels. USPIS Inspector Jason Bauwens responded to Post Office Inspector Bauwens took custody of the seven parcels dropped off by FRICCERO, which were consistent with other parcels mailed by FRICCERO throughout this investigation. Out of the seven parcels mailed by FRICCERO, Inspector Bauwens detained one of the parcels (hereinafter “Detained Parcel #2) for further investigation and placed the remaining six back into the mail stream.

Emerald Bay Extracts

Law enforcement, after obtaining logs from AT&T, saw that Friccero had regular contact with Emerald Bay Extracts.

The carrier for telephone number (907) 299-7936 was identified as AT&T. According to records from AT&T, telephone number (907) 299-7936 is subscribed to Eric FRICCERO with a service start date of September 9, 2010. Additionally, the toll records revealed that FRICCERO had been in contact with telephone number (530) 414-9624 on 239 occasions from July 23, 2018 through September 20, 2018. An open source Internet query on telephone number (530) 414-9624 returned a website for Emerald Bay Extracts. I conducted a review of the Emerald Bay Extracts website and located telephone number (530) 414-9624 listed as the contact telephone number for the business. As previously discussed in paragraph 24, the suspected THC vials that were found inside Detained Parcel #1 were branded Emerald Bay Extracts.

Robbery

A 2015 robbery involving four pounds of marijuana and budtrader.com was relevant to the NCIDETF’s investigation.

I obtained a Woodland Police Department report involving a November 24, 2015 incident where FRICCERO reported that he was a victim of a robbery of four pounds of marijuana. According to the police report, FRICCERO admitted to police that he was a marijuana grower and was engaged in selling marijuana over the Internet. Specifically, FRICCERO told police he had posted an advertisement on website budtrader.com seeking to sell marijuana for $1 ,600 per pound. FRICCERO met with four individuals at a Walmart in Woodland, California, with the intention of selling the marijuana to the individuals for cash. Instead, the individuals took the marijuana from FRICCERO and fled the scene.

Arrest and Plea

Law enforcement raided Friccero’s home in January 2019. Friccero told investigators that he operated a legitimate marijuana business. The criminal complaint listed his original charges as

  • Manufacture or Distribution of a Controlled Substance;

  • Conspiracy to Manufacture, to Distribute, and to Possess with Intent to Distribute a Controlled Substance

He pleaded guilty to intent to distribute a controlled substance and a faces a maximum statutory penalty of 20 years in prison and up to $1 million in fines. His sentencing hearing is scheduled for August 2020.