AccessibilitySkip to Top NavigationSkip to Main ContentHome  |  Contact IRS  |  About IRS  |  Site Map  |  Español  |  Help  

Part 9. Criminal Investigation

Chapter 4. Investigative Techniques

Section 10. MISCELLANEOUS INVESTIGATIVE TECHNIQUES

9.4.10  MISCELLANEOUS INVESTIGATIVE TECHNIQUES

9.4.10.1  (03-26-2002)
OVERVIEW

  1. The following will be discussed in this section:

    1. Mail Covers

    2. Trash Pickup

    3. Emergency Driving

    4. Computer Searches and Seizures

9.4.10.2  (07-21-2004)
MAIL COVERS

  1. The United States Postal Service (USPS) regulations constitute the sole authority and procedure for initiating, processing, placing, and using mail covers, and are contained in Title 39, Code of Federal Regulations, Section 233.3 (39 CFR §233.3); and Section 213 of the USPS Administrative Support Manual.

9.4.10.2.1  (03-26-2002)
Definitions Relating to Mail Covers

  1. The following are USPS mail cover definitions:

    1. Mail cover is the process by which a nonconsensual record is made of any data appearing on the outside cover of sealed or unsealed mail; or by which a record is made of the contents of any unsealed mail, as allowed by law, to obtain information to protect national security; locate a fugitive; obtain evidence of the commission or attempted commission of a crime; obtain evidence of a violation or attempted violation of a postal statute; or assist in the identification of property, proceeds, or assets forfeitable under law.

    2. Fugitive is any person who has fled from the United States or any state, the District of Columbia, territory, or possession of the United States to avoid prosecution for a crime, to avoid punishment for a crime, or to avoid giving testimony in a criminal proceeding.

    3. Crime for purposes of this section, is any commission of an act or the attempted commission of any act that is punishable by imprisonment for a term exceeding one year.

    4. Law enforcement agency is any federal, state, or local governmental entity whose functions are to investigate the commission or attempted commission of acts constituting a crime, or protect the national security.

    5. Emergency situation refers to a set of circumstances that require the immediate release of information to prevent the loss of evidence or when there is potential for immediate physical harm to persons or to property.

9.4.10.2.2  (07-21-2004)
Mail Cover Requests

  1. The Supervisory Special Agent (SSA) is responsible for ensuring that requests for mail covers are made in accordance with established USPS procedures. A mail cover request must be signed at the SSA level or higher.

    1. For investigations involving national security, the mail cover request must be approved by the Chief, Criminal Investigation (CI), or his/her designee at the Headquarters (HQ) level. The Chief, CI, shall notify the Chief Postal Inspector in writing of such designee to sign the national security requests. (39 CFR §233.3(g)8)).

  2. The mail cover requests should be addressed to the Manager, Inspection Service Operations Support Group (ISOSG), of the postal area involved (see Exhibit 9.4.10–1, US Postal Inspection Service Managers, Inspection Operations Support Group (ISOSG) Office Addresses and Areas Covered) and sent directly to that official, except for the fourth and subsequent renewal requests as provided for in subsection 9.4.10.2.4 below.

  3. Requests for mail covers should be made only in primary (PI) or subject investigations (SCI) and for the following reasons:

    1. for the purpose of locating a fugitive

    2. when there is good reason to believe that a felony has been committed or attempted

    3. to assist in the identification of property, proceeds, or assets forfeitable under law

  4. Mail covers are not to be used for "fishing" or exploratory purposes. A mail cover should not be used as merely a routine "investigative tool." Special agents should specify how information from the mail cover will assist the criminal investigation and provide reasonable grounds that demonstrate the basis of the criminal investigation and the need to obtain this information from the mail. (For example, reasonable grounds might be based on information from a confidential informant, public complaint, previous investigation, etc.) Be specific and concise in outlining the reasonable grounds element. See subsection 9.4.10.2.2.1(2)(d), below.

  5. A mail cover should never be requested in an investigation involving a misdemeanor violation. Whenever an investigation has been elevated to felony status, case management records must be updated to support a subsequent request for a mail cover.

  6. Through appropriate discovery procedures, the subject of the mail cover may be able to compel the government to disclose information obtained by using mail covers.

9.4.10.2.2.1  (07-21-2004)
Written Requests

  1. Requests for mail covers should be made in writing, stating the reason(s) for requesting the mail cover. A separate request must be made for each post office involved in conducting the mail cover.

  2. The mail cover request must also specify and stipulate the following:

    1. That an official investigation has been opened.

    2. The name and address of each individual or business to be covered.

    3. The Federal statute that is alleged to have been violated, resulting in the imposition of a criminal penalty, if convicted. Requesters should provide a brief explanation of the statute, including in the investigation of money laundering offenses (i.e.18 USC §1956) the identification of any specified unlawful activity (SUA) which precipitated the money laundering investigation, and the criminal penalty that could be asserted if convicted under that statute. For example: "We are conducting an investigation in which the taxpayer is allegedly attempting to evade personal income tax for calendar years ___ through __ in violation of section 7201 of the Internal Revenue Code. Conviction under this statute could result in the taxpayer's imprisonment for not more than 5 years and/or fined not more than $100,000 for each of the years for which convicted."

    4. Reasonable grounds to demonstrate that the mail cover is necessary. This should include a brief description of the manner in which the alleged tax evasion or other violation is believed to have been committed (for example, by omitting income from drug trafficking, or from interest on bank savings accounts or laundering of monetary instruments with the intent of concealing the proceeds of drug trafficking).

      Note:

      Although the request should be specific and sufficiently detailed to enable USPS authorities to determine the need for a mail cover, disclosure of return information must be limited to the extent necessary to obtain the mail cover. (See IRM 9.3.1, Disclosure)

    5. A statement that the mail cover will assist in obtaining information concerning the alleged violation (for example, by uncovering assets or identifying possible sources of unreported income through the taxpayer's receipt of correspondence from banks or other financial institutions).

    6. The name and address of any attorney for each person or company for which a mail cover is requested or that the attorney for each person or company for which a mail cover is requested is not known. (No mail cover shall include material(s) mailed between the mail cover subject and the subject's known attorney.)

    7. A statement that each person or company for which a mail cover is requested, if not a fugitive, is not under indictment in connection with the matter under investigation.

    8. A statement that only first class mail should be covered will be made unless it is specifically necessary that other classes of mail be included. If other classes of mail are to be included, a statement must be made establishing the necessity to include all mail. Following is a brief description of various classes:

    9. A statement should be made specifying the time interval for the results of the mail cover to be forwarded to the special agent (ex: daily, weekly, or biweekly.)

    10. If a liaison has been established with a local Postal Inspector, the name of the Inspector should be provided in the request.

    (1) If the mail cover is authorized and an information is filed against the subject or the subject is indicted for any cause during the mail cover period, the Regional Chief Postal Inspector must be immediately notified.

    (2) If the subject is under investigation for further criminal violations, or a mail cover is requested to assist in the identification of property, proceeds, or assets forfeitable because of a violation of criminal law, a new mail cover order must be requested consistent with these regulations.

    (3) If the information or indictment is for an offense that is not part of the PI or SCI, the notification should be made in writing and should state that the information or indictment concerns a matter that is not related to the CI investigation. The notification should request that the mail cover be continued without interruption.

    (4) If the indictment returned is a sealed indictment in a CI investigation, the Regional Chief Postal Inspector will be requested to cancel the mail cover. There should be no mention of an indictment to the Regional Chief Postal Inspector to avoid making an unlawful disclosure by violating the secrecy rules that govern Federal grand juries.


    • First Class: Letters, postal cards, express mail, priority mail, etc., mail sealed against postal inspection.
    • Second Class: Newspapers, periodicals, publications, catalogs, etc.
    • Third Class: Small parcels weighing less than 16 ounces, mail not sealed against postal inspection such as, bulk rate items, and circulars.
    • Fourth Class: Parcels and mail not sealed against postal inspection.

  3. The mail cover request should be sufficiently detailed to establish the need for the mail cover. Disclosure of tax return information to the Postal Service must be limited to the extent necessary to obtain the mail cover. (IRM 9.3.1, Disclosure)

9.4.10.2.2.2  (07-21-2004)
Oral Requests

  1. In emergency situations, a request for a mail cover may be made orally by the SSA or higher. A written request must follow within three calendar days.

9.4.10.2.2.3  (07-21-2004)
Subjects of the Mail Covers

  1. Reasonable grounds for a mail cover should be established on each person or company who is the subject of a mail cover. For instance, a person may be named as the subject of an investigation, but a mail cover may also be necessary on his/her spouse or associate. The request should explain the necessity for the mail cover on the spouse or associate.

  2. A request to include a spouse or associate should provide information for Postal officials to authorize the mail cover. This could include, for example, that an informant or other third party provided information regarding the spouses or associates involvement in the evasion scheme. It is not sufficient to say "because the taxpayer is married, we have reason to believe the spouse may hold assets..." or, "based on our experience in other investigations, we anticipate that the spouse. . .."

  3. The request should stipulate and specify the necessity for the requested mail cover, such as:

    1. subject's use of aliases

    2. subject is known to use nominee ownership in bank accounts or assets

    3. mail cover is expected to uncover assets, liabilities, and/or expenditures

    4. mail cover should reveal the taxpayer's contacts or clientele, etc

  4. Mail covers are usually requested on a stated individual or company at a given address. Mail arriving for others who happen to receive mail at the mail cover address is not included in the mail cover.

  5. In instances where the PI or SCI requires a cover on mail addressed to the known occupant and fictitious names that may be used by the occupant, the following must also be included in the request:

    1. Statement establishing the necessity for covering all mail intended for delivery at the particular address.

    2. Statement that it is known through the investigation that only the subject of the cover resides and receives mail at the address.

    3. Statement that all mail received for delivery at the address is intended for the subject of the mail cover.

    4. If persons other than the subject of the mail cover reside at the address, a list of their names must be furnished, and all mail addressed to them is to be excluded from the cover.

9.4.10.2.3  (07-21-2004)
Time Frame for Mail Cover Requests

  1. Requests for mail covers should be limited to periods not to exceed 30 days and canceled if the information is obtained from other sources prior to the expiration of the period.

  2. Cancellations should be sent by the originating office and addressed to the Manager, ISOSG, of the postal area involved.

9.4.10.2.4  (07-21-2004)
Renewal of Mail Cover Requests

  1. Mail cover requests can be renewed up to three times at the initial request level; not to exceed 120 days. A request for renewal, when warranted, should be made in accordance with the procedures set forth in subsection 9.4.10.2.2 and subsection 9.4.10.2.2.1 above.

  2. The request must contain a statement regarding the investigative benefit of the mail cover to date and the anticipated benefits to be derived from the extension.

  3. A fourth renewal request and all subsequent renewals must be submitted to the Chief, CI, for approval, together with a memorandum detailing the need to continue the mail cover. Any request for a mail cover exceeding 120 continuous days must be approved for further extension by the Chief Postal Inspector or his/her designee at postal national Headquarters.

9.4.10.2.5  (07-21-2004)
Result of Mail Cover Requests

  1. The results of a mail cover will be documented daily by USPS on Form 2009, Information Concerning Mail Matter, and forwarded to CI.

  2. All Forms 2009, received from the Postal Inspection Service are the property of the USPS and must be returned within 60 days. It is the responsibility of the SSA to ensure all Forms 2009 are properly accounted for and timely returned by the special agent.

  3. Mail cover documents must be treated with confidentiality; reproduction of mail cover documents is prohibited.

9.4.10.2.6  (07-21-2004)
Criminal Investigation Management Information System Tracking

  1. Approved mail cover requests are tracked in the Criminal Investigation Management Information System (CIMIS). A Form 4930 is utilized to update the PI for all approved mail covers.

9.4.10.3  (07-21-2004)
TRASH PICKUP

  1. Many investigations have been completed with evidence that special agents have retrieved from a subject's trash.

  2. The Supreme Court has held that the Fourth Amendment does not prohibit the warrantless search and seizure of garbage left for collection outside the curtilage of the home (the enclosed space of ground and buildings immediately surrounding a dwelling house).

  3. A person who has thrown records into a trash can and left the trash can at the side of a public street cannot claim that special agents who later take the records have violated his/her rights under the Fourth Amendment, because any expectation of privacy in the garbage is not objectively reasonable.

  4. The First Circuit has held that the Fourth Amendment does not prohibit the warrantless seizure and reconstruction of shredded documents found in trash bags located outside the curtilage of a subject's house; the mere fact that the subject shredded his/her garbage before it was placed in the trash outside did not create a reasonable heightened expectation of privacy.

  5. Special agents can legally conduct a warrantless search and seizure of a subject's trash when it is found in a common area for pick-up by a trash collector, or with the trash collector's consent if it has already been picked up by the trash collector.

9.4.10.4  (03-26-2002)
EMERGENCY DRIVING

  1. Criminal Investigation special agents may engage in emergency driving only when the seriousness of the emergency outweighs the danger created by such driving. When engaging in emergency driving, special agents must continually balance the need to engage in such driving against safety considerations.

  2. Directive No. 7 establishes guidelines consistent with a uniform Treasury standard for Law Enforcement Officers to use in making decisions regarding emergency driving.

  3. The goal of this directive is to ensure the safety of law enforcement officers, other persons involved, and the general public by balancing the seriousness of the emergency with safety considerations.

  4. Directive No. 7 applies when a suspect is being followed to make an apprehension, surveillance is being conducted, or exigent circumstances exist. It encompasses driving situations in which the posted speed limit or other traffic laws are disregarded. The directive also notes that some driving maneuvers with a vehicle, referred to as emergency driving tactics (i.e. blocking, ramming, forcing vehicles off the road), may constitute the use of deadly force and may only be used in compliance with Treasury's Policy on the Use of Force, Treasury Order 105–12.

9.4.10.4.1  (07-21-2004)
Definitions

  1. Emergency Driving: Driving in a manner that disregards the posted legal speed limits or other traffic laws for one or more of the following purposes:

    1. following a suspect vehicle to make an apprehension

    2. conducting surveillance

    3. responding to other exigent circumstances

  2. Emergency Driving Tactics: Emergency driving tactics are maneuvers made while pursuing a vehicle that are likely to cause deliberate physical contact between the vehicles. Examples of emergency driving tactics may include blocking (except for slow moving vehicles), cutting off, ramming, and forcing vehicles off the roadway.

  3. Deadly Force: Deadly force is the use of any force that is likely to cause death or serious physical injury. Deadly force does not include force that is not likely to cause death or serious physical injury but unexpectedly results in such death or injury.

9.4.10.4.2  (03-26-2002)
Factors To Consider

  1. When balancing the need for emergency driving with safety considerations, CI special agents should consider all relevant factors, including but not limited to the following:

    1. the nature of the emergency

    2. the imminent danger to public safety if a suspect is not
      apprehended

    3. the seriousness of the offense

    4. the probability of apprehending a suspect at a later time

    5. the location, weather, speed, traffic, and road conditions

    6. the time of day

    7. the presence of pedestrians

    8. the special agent's driving ability

    9. the condition of all the vehicles involved

    10. the availability of emergency equipment

    11. the availability of assistance from uniformed police officers in marked police vehicles

    12. the possibility of alternative courses of action

9.4.10.4.3  (07-21-2004)
Emergency Driving Tactics

  1. In some circumstances, emergency driving tactics may constitute the use of deadly force. Those emergency driving tactics that are likely to cause death or serious physical injury may constitute the use of deadly force. Special agents may use deadly force only when necessary; that is, when the special agent has a reasonable belief that the subject of such force poses an imminent danger of death or serious physical injury to the special agent or to another person.

  2. Deadly force may be used to prevent the escape of a fleeing subject if there is probable cause to believe:

    1. The subject has committed a felony involving the infliction or threatened infliction of serious physical injury or death; or

    2. The escape of the subject would pose an imminent danger of death or serious physical injury to the officer or to another person.

  3. If force, other than deadly force, reasonably appears to be sufficient to accomplish an arrest or otherwise accomplish the law enforcement purpose, the use of deadly force is not necessary. See Treasury Order 105–12, Policy on the Use of Force, for additional guidance.

9.4.10.4.4  (03-26-2002)
Other Agencies

  1. In the planning of Treasury led joint operations involving other federal, state, or local law enforcement agencies, each participant will be informed of this policy and that this policy will be controlling.

9.4.10.4.5  (07-29-1998)
Emergency Equipment

  1. Criminal Investigation should review state requirements for emergency systems/equipment on vehicles engaged in emergency driving and comply when appropriate.

9.4.10.4.6  (07-29-1998)
Rights of Third Parties

  1. Nothing in these guidelines is intended to create, or does create, an enforceable legal right or private right of action.

9.4.10.5  (03-26-2002)
COMPUTER SEARCHES AND SEIZURES

  1. The search and seizure of data contained in computers, computer networks, and other electronic storage mediums (such as "e-mail" ) present special circumstances for consideration to insure the legality of the search and seizure. Special agents should possess a working knowledge of the fundamental rules of evidence, that are applicable to the execution of computer search warrants. This subsection covers the following topics:

    • Computer Evidence

    • Probable Cause and Preparation of Search Warrant

    • The Approach and Search

    • Custody and Storage of Seized Property

9.4.10.6  (07-21-2004)
Computer Evidence

  1. Special agents must use the least intrusive means possible to obtain evidence. Electronic information can be obtained by consent, subpoena, or search warrant.

  2. Consent searches must be voluntarily given and may be limited in scope. Seek consent from the target, employer, or other party with authority established by law. Also see Searches Made With Consent located in IRM 9.4.9, Search Warrants, Evidence, and Chain of Custody.

  3. Always consider the use of a subpoena for computer information not under the control of the target. Subpoena computer records as they exist at the time of service of the subpoena. Direct the recipient to make and safeguard a copy of the requested information, even if they intend to contest the subpoena. Subpoena targets for passwords and encryption keys. A grant of act production immunity may be required.

  4. When deciding whether to search and/or seize one or more computers, there are several issues to consider. Confront the issues early in the investigation if possible. Coordinate procedures relating to pre-search, search, and post search activities with the special agent/computer investigative specialist.

9.4.10.6.1  (07-21-2004)
Applicable Law

  1. Several laws and regulations govern obtaining evidence from electronic sources. These statutes impose restrictions and obligations on the special agent and any operator of public computer services. Review the following before attempting to obtain evidence from electronic sources:

    1. First Amendment to the Constitution

    2. Fourth Amendment to the Constitution

    3. Wiretap Act, 18 USC §2510–2521

    4. Electronic Communications Privacy Act of 1986, 18 USC
      §2701–2711

    5. Privacy Protection Act, 42 USC §2000aa

    6. Federal Rules of Criminal Procedure, Rule 41 (USCS Fed Rules Crim Proc R 41)

    7. Federal Rules of Evidence, Sections 901, 1001, and 1002

    8. IRM 9.4.9, Search Warrants, Evidence, and Chain of Custody

9.4.10.6.2  (03-26-2002)
Additional Information

  1. Obtain additional information to secure evidence from computers and other electronic media from the following sources:

    1. Internet Investigation Guidelines written by CI

    2. Computer Investigative Specialist

    3. Federal Guidelines for Searching and Seizing Computers published by the Department of Justice

    4. Internet Investigation Guidelines published by the Department of Justice

    5. Division Counsel/Associate Chief Counsel (Criminal Tax) available at (202) 622–4470 and fax (202) 622–6302

    6. Computer and Telecommunications Coordinators (CTCs) at the local US Attorney's Office or Assistant US Attorneys that have received special training in the computer crimes subject area

    7. Tax Division, Department of Justice: Senior Trial Attorney, available at (202) 514–2832 and Fax (202) 514–3081

    8. Computer Crime and Intellectual Property Section, Department of Justice at (202) 514–1026 and fax (202) 514–6113

9.4.10.7  (07-21-2004)
Probable Cause and Preparation of Search Warrant

  1. When it is anticipated that a computer is on site, the following issues should be considered when obtaining a search warrant. It is recommended that the special agent and special agent/computer investigative specialist discuss the following pre-search considerations:

    1. The best evidence is a paper document or paper computer print out.

    2. Obtain information about the subject'(s) use of computers before the search.

    3. Determine the role of the computer in the offense.

    4. Develop probable cause for evidence contained in computers.

    5. Develop probable cause for each component of the computer.

    6. Participate with the special agent/computer investigative specialist in technical interviews that include computer issues.

    7. Consult Counsel and/or the US Attorney's office on computer issues during the investigation.

    8. The warrant must describe with particularity the places to be searched and the items to be seized. Describe the hardware components of the computer and the software and data domiciled within the computer.

    9. Focus the search warrant affidavit on the evidence sought from the computer. The agent must articulate a factual basis to believe that the computer was used for the creation and/or storage of evidentiary records.

    10. Explain in the affidavit why an on-site search is not reasonable and seek permission to seize the computer and search it later, if applicable.

    11. Investigate the possibility of protected material on the computer. Include a positive statement in the warrant that no "work product material" exists on the computer.

    12. If protected material exists on the computer, state how the protection is not going to be violated. Magistrates can authorize a segregation plan.

    13. Investigate the possibility of e-mail on the computer. Indicate the e-mail status in the search warrant affidavit and the search warrant. Identify in the warrant whose e-mail is going to be read, and if it is subject to search. (See 18 USC §2703.)

    14. Obtain a "no-knock warrant" if destruction of stored computer data is a concern.

9.4.10.8  (03-26-2002)
The Approach and Search

  1. Consider the following search issues during the execution of the warrant when a computer is on site:

    1. Preserve the chain of custody and integrity of the evidence.

    2. Pre-programmed destructive software can alter and delete data.

    3. Determine where the information is being seized from: a local personal computer, a network computer, or a computer located outside the United States.

    4. Generally, do not seize electronic evidence located outside the United States.

    5. If applicable, work as directed by the Magistrate's segregation plan.

    6. Thoroughly document and photograph the area. Photograph the components of the computers and the cable connections.

    7. Obtain express authority to remove the computer from the site to conduct the search (if not previously granted.)

    8. Consult attorneys after encountering issues such as Privacy Protection Act material.

9.4.10.9  (07-21-2004)
Custody and Storage of Seized Property

  1. Consider the following search issues after the execution of the warrant in relation to computers:

    1. maintain the chain of custody

    2. maintain the integrity of the evidence

    3. follow court ordered segregation plans

    4. document examinations of the computer

    5. return seized items as quickly as possible (if applicable)

    6. obtain a receipt for returned items

Exhibit 9.4.10-1  (11-01-2004)
US Postal Inspection Service Managers, Inspection Operations Support Group (ISOSG) Office Addresses and Areas Covered

The mail cover program is consolidated into the Criminal Investigation Service Center located in Chicago, IL. In addition to the Chicago location, there will be another site located in San Francisco that will handle mail cover requests for specific states located in the western part of the United States.

Below is a breakdown of the locations and the addresses of the offices that will handle mail cover requests effectively October 1, 2003.

Address Area Covered

US Postal Inspection Service
Criminal Investigation Service Center
ATTN: Mail Covers
222 S. Riverdale Plaza, Suite 1250
Chicago, IL 60606-6100
Telephone: (312) 669-5673 		Alabama
Arkansas
Colorado
Connecticut
Delaware
Florida
Georgia
Hawaii
Illinois
Indiana
Iowa
Kansas
Kentucky
Louisiana
Maine
Maryland
Massachusetts
Michigan
Minnesota
Mississippi
Missouri
Nebraska
New Hampshire
New Jersey
New York
North Carolina
North Dakota
Ohio
Oklahoma
Pennsylvania
Puerto Rico
Rhode Island
South Carolina
South Dakota
Tennessee
Texas
Utah
Vermont
Virginia
Virgin Islands
Washington DC
West Virginia
Wisconsin
Wyoming

US Postal Inspection Service
ATTN: Mail Covers
PO Box 882168
San Francisco, CA 94188-2168
Telephone: (415) 778-5950 		Alaska
Arizona
California
Hawaii
Idaho
Nevada
New Mexico
Montana
Oregon
Washington

More Internal Revenue Manual