Case: Document 1 Filed: 101151'14 Page 1 of 26 Page?) no we #10} Ai?ctavit for Search Warrant AUSA William Ridgw 33,1 (312) 459-5233 STATES DISTRICT COURTF NORTHERN DISTRICT OF ILLINOIS, EASTERN DIVISION at OCT 1 5 2014 I UNDER SEAL 18m 1 ATE JUDGE MARIA rates: In the Matter of the Search of: Um STATES mm The residence located at 6435 South Narragansett Avenue, Apartment 2A, Chicago, Illinois. further described in Attachment A case Number 5 5 2 APPLICATION AND AFFIDAVIT FOR A SEARCH WARRANT 1, Josh E. Sadowsky, a Special Agent of the Federal Bureau of Investigation, request a search warrant and state under penalty of perj ury thatl have reason to believe that on the following property or premises: See Attachment A located in the Northern District of Illinois. there is now concealed: See Attachment The basis for the search under Fed. R. Grim. P. 41(e) is evidence and instrumentalities. The search is related to a violation of: Code Section. Offense Description Title 18, United Statee Code. Sections 371., Conspiracy, computer fraud, fraud in connection with 1031', 1343. and 23153. and Title 1?7, United States Code, email. wire fraud. and copyright infringement Section 506(3) The application is based on these facts: See Attached Affi?avit, Continued on the attached sheet. . i r4 - "Nr? th -. 1? ?o Applicant?s Signature JOSH Ei?sADowsai-i special-ria??nt, FBI Printed name and. title Sworn to before me and signed in my presence. a . .J. 3?s? 'n at. wa?w- Date: _Qctober 15, 2614 ?g 3 ?u Judge?s signature a} City and State: RIAEALDEZ. US. Magistrate Judge Printed name and title Case: 1:14-mc-00552 Document 1 Filed: 10f15f14 Page 2 of 26 PagelD #22 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS i AFFIDAVIT Introduction and Agent Background I, Josh E. Sadowsky, being duly sworn, state as follows: 1. I am a Special Agent with the Federal Bureau of Investigation and have been so employed since 2009. I am currentiy assigned to the Cybercrimes Unit in Los Angeles, California, where I specialise in the investigation of computer and high-technology crimes, including computer intrusions, denial of service attacks and other types of maiicious computer activity. During my career at the FBI, 1 have participated in numerous computer crime investigations. In addition, I have received. both formal and informal training from the FBI and other institutions regarding computer-related investigations and computer technology. Prior to my work in the FBI, 1 was a self-empioyed computer consultant and Internet business owner for eight years. 2. This affidavit is made in support of an application for a warrant to search the residence Eocated at 6435 South Narragansett Avenue, Apartment 21%, Chicago, Iilinois, 60638, described farther in Attachment A (the ?Subject Premises?), for evidence and instrumentalities described further in Attachment B, concerning vioiations of Titie 18, United States Code, Sections 371 {conspiracy}, 1030(a) (computer fraud and abuse), 1037 (fraud and related activity in connection with electronic mail). and 1343 (wire fraud), and Title 18 United States Code Case: 1:14-mc-00552 Document 1 Filed: 10f15fl4 Page 3 of 26 PagelD Section 2319 and Title United States Code, Section 506(a) (criminal copyright (the ?Subject Offenses?). The statements in this af?davit are based on my personal knowledge, and on information I have received from other law en?orceinent personnel and from persons with knowledge regarding relevant facts. Because this affidavit is being submitted for the limited pnrpose of securing a search warrant, I have not included each and every fact known to me concerning this investigation. I have set forth facts that I believe are suf?cient to establish probable cause to believe that evidence and instrumentalities of vioiations of the Subject Offenses are located at the Subject Premises. FACTS SUPPORTING PROBABLE CAUSE TO SEARCH Dem 3. I know from my training and experience that the following definitions apply to the activity discussed in this af?davit: a. IP Address: The Internet Protocol address {or simply address) is a unique numeric address used by computers on the Internet. An IP address looks like a series of four numbers, each in the range 0-255, separated by periods 121.536.97.178)- Every computer attached to the Internet must be assigned an IP address so that Internet traf?c to and from that computer may be properlyr directed from its source to its destination. 1 Copyright protection attaches to ?original works of authorship ?xed in any tangible medium of expression,? Title 17, United States Code, Section 102, including photographs. 2 Case: Document 1 Filed: 10(151'14 Page 4 of 26 PagelD 13. Server: A server is a computer that provides services to other computers- Examples include web servers which provide content to web browsers and e-mail servers which act as a post of?ce to send and receive e-mail messages. c. Phishing: Phishing occurs when a fraudulent e?mail or text message is sent to the victim and purports to be from a legitimate Internet provider seeking the victim?s login and password information. The victim is then directed to an illicit website, or is asked to respond with their username and password, which the criminal then uses to gain access to the victim?s account. 4. I know from my training and experience that Apple, located in Cupcrtino, California, operates computers used by subscribers all over the world in interstate and foreign commerce and communications. One of the services that Apple provides to its customers is ?iCloud,? a ?cloud? computing back-up system for subscriber data. Photos and videos taken on Apple iPhones can be automaticain backed up to the iCloud, making them accessible to users on the Internet. 5. I know From my training and experience that Google, located in Northern California, operates computers used by subscribers ali over the world in interstate and foreign commerce and communications. One of the services that Googie provides to its customers is Gmaii, an e-maii service. Overview 6. The FBI is currently investigating online leaks of private photographs, including nude and sexually explicit photographs of dozens of female and some male Case: 1:14-mc-00552 Document 1 Filed: 10115114 Page 5 of 26 PagelD #25 celebrities?including Victims J.L., J.V., EU. and A.L.?that began on or about August 31, 2014, and which are ongoing. Based on interviews with several victims, the FBI currently believes that many of the photographs were obtained without authorization from the Apple iCloud account of either the victim or hisiher signi?cant other. Based on victim account records obtained from Googie and Apple, one or more computers used at the Subject Premises accessed or attempted to access without authorization multiple celebrities? e-mail and iCloud accounts over the course of several months. The FBI has identi?ed ED as one person using one or more computers at the Subject Premises to engage in the above-described unauthorized access to the celebrities? accounts. As further described below, or another resident of the Subject Premises is believed to be violating the Subject Offenses from the Subject Premises. Summarv of the Evidence Celebgote 7. Beginning on or about August 31, 2014, I read news reports about the leak of private photographs of female celebrities and conducted Google searches to discover that nude and sexually-explicit photographs of numerous female and some male celebrities. including J.L., J.V., FLU, and AL, had been posted on or about August 31, 2014, to the websites 4chan.org and Redditcom. This 1ea3? of private photographs was labeled online as ?Celebgate? or ?The Fappening.? Case: 1:14-mo-00552 Document 1 Filed: 10f15l14 Page 6 of 26 PagelD 8. On September 1, 2014, I interviewed victim J.L. and learned the following information: a. .L. is a female celebrity who has appeared in numerous feature ?lms 1). On or about August 31, 2014, private and personal photographs were published online on various websites, including 4Chan.com and Redditcom without her permission.2 .L. herself had not seen all of the photographs, but her attorney con?rmed that they were of .L. J.L. was completely nude in some of the photographs, and they were never shared publicly. The photographs were taken with iPhone {a device sold by Apple that works in conjunction with Apple?s iCloud product), and were only shared between her and her then hovfriend. She sent the photographs to her boyfriend through text message over a 2-4 year period, and she recalls deleting the photos after they were sent. c. During my interview with J.L., she became veryr distraught and I had to stop the interview at one point because of her emotional reaction to the information being discussed. .L. stated she was having an anxiety attack, and was visiny shaken. 5* In another FBI investigation, in or abont Maj,r 2013, FBI agents seized a laptop computer that contained a large number of the nude celebrity photographs. The defendant in that investigation had obtained the photos from someone else. Thus, although the ?leak? of the photos that are the subject of this investigation occurred on August 31, 2014, they were illegally obtained at least once prior to May 2013. a. 0 Case: 1:14-mc-00552 Document 1 Filed: 10f15I14 Page of 26 PagelD #17 d. On or about August 9, 2014, password was not working in Apple iTunes, and she advised that her iCloud services, including iMessage, were ?acting up.? Around the same time, she lost access to her current email account and received notice that her password had been reset. 9. Approximately one week after J.L. was having the issues with her account described above, she received a phishing iMessage on her iPhone.3 I reviewed the phishing iMessage and found that it was sent to iCloud account from The message read as follows: Your Apple ID was used to iogin into iCioud from an unrecognized device on Wednesday, August 20m, .2014. Operating System: 1208 5.4 Location: Moscow, Russia If this was you please disregard this message. If this wasn?t you, for your protection we recommend you change your password immediately. In order to make sure it is you changing the password, we have given you a one time passcode, 0184 73 37, to use when resetting your password at We apologise for the inconvenience and any concerns about your privacy. Apple Privacy Protection?. J.L did not recall whether she clicked on the phishing link contained in the iMessage, although at the time she thought it was a legitimate message, and subsequently forwarded it to her assistant. Her assistant recalls not clicking on the phishing link and knew it was not legitimate. 3 iMessage is a service offered by Apple which is equivalent to a cell phone text message. One difference between a traditional text. message and an iMessage is that an iMessage can, be addressed to someone?s Apple iCloud account, not just to hisfher cell phone number. 6 Case: Document #2 1 Filed: 10115114 Page 7 of 26 PagelD d. On or about August 9, 2014, J.L.'s password was not working in Apoie iTunes, and she advised that her iCioud services, including iMessage, were ?acting up-? Around the same time, she lost access to her current e-mail account and received notice that her password had been reset. 9. Approximately one week after J.L. was having the issues with her account described above, she received a phishing Message on her iljhone.3 I reviewed the phishing iMessage and found that it was sent to iC]oud account from The message read as follows: ?Your Apple ID Iroas used to togin into iCioad from an unrecognized device on Wednesday, August 2035, 2014. Operating System: 1203 5.4 Location: Moscow, Russia If this was you please disregard this message. If this wasn?t yon, for your protection we recommend you change your password immediateiy. In order to make sure it is yon changing the password, we have given you a one time passcode, 0184?37, to use when resetting your password at We apologise for the inconvenience and any concerns aboat your privacy. Apple Privacy Protection?. .L did not recall Whether she clicked on the phishing ?nk contained in the iMessage, although at the time she thought it was a legitimate message: and subsequently forwarded it to her assistant. Her assistant recalis not clicking on the phishing link and knew it was not legitimate. 3 iMessage is a service offered by Apple which is equivalent. to a cell phone text message. One difference between a traditional text message and an Message is that an iMessage can he addressed to someone?s Apple iCloud account, not just to hisfher ceii phone number. 6 Case: 1:14-mc-00552 Document #2 1 Filed: 1011514 Page 8 of 26 PagelD #28 10. Also on September 1, 2014, I interviewed 3.13s err-boyfriend, NH, and learned the following information: NH. recalls receiving various private and personal photos of J-L- on his phone. looked through his laptop and phone prior to my interview, and could not ?nd any of the photos which had been pubiished online. NH. did not send the photos to anybody, and only kept them on his phone and laptop. 11. On September 2. 2014, I interviewed victim J.V. and learned the foilowing information: a. JV. is a professional athlete. b. JV. was in a relationship with victim KU. Photographs of J.V., EU. and other women were leaked online and came from phone. Many of the photographs were taken by JV. and never sent to anyone else. In addition to photos of K.U.. there were aiso photos of .V previous girlfriends leaked online, including Victim?s LN. and LB. 0. Approximately two weeks prior to my interview with .V., he received a phishing iMessage on his iPhone, which he subsequently forwarded to his manager. The message read as follows: Your Apple ID was used to iogin into iCioud from an. unrecognized device on Sunday, August 2014. Operating System: 5.4 Location Moscow, Russia (IP595.108.142.138) If this was you please disregard this message. If this tease? you, for your protection we recommend you change your password immediately. In. order to make sure it is you changing the password, we HI Case: 1:14-mc-00552 Document 1 Filed: 10115114 Page 9 of 26 PagelD have given you a one time posscode, 0184737, to use when resetting your password or http:Happieid.serveuser.comf. We apologize for the inconvenience and any concerns about your privacy. Apple Privacy Hotection?. Immediately after sending the phishing message to his manager, J.V. instructed his manager to ?verify? the message. .V. stated that he believed the message was sent from Apple and foliowed through with the instructions on the phishing iMessage- Minutes later, JV. reaiized it. was a phishing message, reset his iClond password and changed his e-mail address. 12. On October 1, 2014, I interviewed victim AL- and learned the following inform ation: a. AL. is a professional singer and musician. b. In September 2014, severai private photographs were leaked- online which were taken with iPhone. The photographs were only shared between her and her husband. One photograph was ofAL. partiaiiy nude, and some were taken several years prior to my interview with her. 13. On or about August 7, 2014, AL. received a phishing iMessage on her iPhone, which she subsequently forwarded to her brother. 1 reviewed the phishing iMess-age and found that it was sent to Al?e iCEoud account from The message read as follows: ?Your Appie ID was used to login into iCiouti from on unrecognized cieuice on Thursday, August 2014. Operating System: 5.4 Location: Moscow, Russia If Case: 1:14-mc-00552 Document 1 Filed: 10115114 Page 10 01?26 PagelD #:10 this was you please disregard this message. If this wasn?t you, for your protection we recommend you change your password immediateiy. In order to make sure it is you changing the password, we have given you a one time passcode, 0184?3?, to use when resetting your password at We apologize for the inconvenience and any concerns about your privacy. Apple Privacy Protection.? Immediately foiiowing AL. sending the phishing iMessage to her brother, he replied went in and changed your passWOrd. We will get you a new e- mail address in apan.? 14. Based on several commonalities among the phishing iMessages received by victims JV. and AL. summarized above, I beiieve that it is the same person perpetrating this phishing activity. First, the phishing messages themselves are almost identical with the exception of the date and phishing used. While the RL does change they bear a simiiar format, for example sent to J.L is similar to which was sent to AL. The phishing iMessage sent to JV. contained the URL http:ffappleidserveuser-coma which contained the same domain name ?serveusercom? as the phishing message sent to All. The phishing messages sent to .L. and AL. were both sent from the same iClond ID, appiepriv acysecurity@icion (1 .com. A (an abbreviation of Uniform Resource Locator) is the global address of documents and other resources on the internet. 9 Case: 1:14-mc-00552 Document 1 Filed: 10f15ll4 Page 11 of 26 PagelD #:ll 15. Based on my training and experience, it is common for hackers to use various tools to assist in downloading and storing victims? iCloud data, including their photos and videos. At least two subjects who I have investigated in the past, who have also hacked celebrity iCioud accounts, used a tool called Elcorasoft Phone Password Breaker. This tool that can be downloaded and purchased online by? anyone, and aliows a user to downioad the contents of a victim?s iCloud account if the username and password are known, 16. On or about September 12, 2014, I reviewed Comcast Cable Communications? subscriber information for the IP address 50.178.228.252 (?Subject Premises which showed that for the period of June 1, 2014, through September 12, 2014, the Subject Premises IP was assigned to ?Gloria at the Subject Premises? 17. Between on or about September 3 and October 12, 2014, FBI Special Ages Jeff Kirkpatrick and I reviewed Apple records related to the accounts of .V-, A.L., and The Apple records showed the following: a. An Apple iPad with Seriai Number was purchased on December 16, 2010 and registered to at the Subject Premises. The iPad was later used to register the email address 5 Based on public records checks, Gloria is believed to be Ed mother, and appears to have a middle initial of This is the likely reason Corncast displays her last name differently in its subscriber records. 10 Case: 1:14-mc-06552 Document 1 Filed: 10(15?4 Page 12 of 26 PageiD #:12 edzee?gmaiicom with Apple iCZoud on October 22, 2011, an account also associated with The iCloud account the phishing account mentioned above, was createci 'on June 24, 2014, using the same Apple iPad device with Serial Number On June 25, 2014, the ciay after the account was created, was accessed 6 times from the Subject Premises IP. The account was listed as a ?rescue? account for h. The. iCioud account edzeez@gmail.con1 accessed Appie?s servers from the Subject Premises 1P approximater 71 times between April 26, 2014, and September 2014. c. The iCloud account appleprivacy?icioudcosi was accessed approximately 7 times on August 19, 2014, from the Subject Premises IP. Although did not discover phishing activity related to this account, I believe based on that name of the account and the nature of other activity perpetrated from the Subject Premises IP, this account was Iikeiy used for phishiug activity. d. Between August 2014, and August 18, 2014, the Subject Premises IP accessed the iCloud account of victim JV. The Subject Premises IP was also seen on august 17, 2014, attempting to reset the password of account by answering his account security questions. 11 Case: 1:14-mc-00552 Document 1 Filed: 10f15il4 Page 13 of 25 PagelD #:13 e. Between August 2014, and August 25, 2014, the Subject- Premises IP also accessed the iCloud account of victim AL. The Subject Premises was also seen on August 7, 2014, attempting to reset the password of account by answering'her account security questions. f. Between the dates of May 2, 2014, and August 31. 2014, approximater 330 unique Apple iCloud accounts were accessed from the Subject Premises IP. Approximately 291 of that total were for peeple whose iCloud accounts were registered outside of Illinois, the state where resides. Of the 291 accounts, the Subject Premises was seen amessing them over 600 times in total. Victims 0.8., C.P., D.C., E.R., G.U., K11, LIL, L.M.W., and VJ. were some of the victims whose photographs were leaked online as part of Celebgate and were also accessed from the Subject Premises EP. 18. Between on or about October 3 and October 12, 2014, FBI Special Agent Jeff Kirkpatrick and I reviewed Google records related to The Googie records showed the foliowing: a. Google identi?ed approximately 22 Victim Gmail e-mail accounts which were accessed or attempted to be accessed from the Subject Premises IP. Of those, approximately 6 accounts were succession}: logged into from the Subject Premises IP. Googie was unable to determine how the usernames and passwords were obtained. 12 Case: 1:14-mc-00552 Document #2 1 Filed: 10115114 Page 14 of 26 PagelD #:14 b. Several of the accounts which were accessed or attempted to be accessed by the Subject Premises included high pro?le actresses in the entertainment including J.S-, NZ, E.W., M.L.. A.A., J.L., 13.0., and BM. c. Googie identi?ed as the ?Subject?, and determined he had logged into his own Gmaii account, edzee?gmailcom, extensively item the Subject Premises IP. d. Google identi?ed another e-rcaii, 1001001011?yahoo.com, as aiso being accessed from the Subject Premises IP, and believed that account to be associated with Google identi?ed a user with the same name ?xxleOlOOlGll? being referenced on an online web forum sailed ?DarkJB?. where users were discussing how to break into Photohucket accounts? One user on the forum references the ?3:35:1001001011? user as being a part of ?anemia??8 SPECIFICS REGARDING SEARCHES OF COMPUTER SYSTEMS 19. Based upon my training and experience, and the training and experience of speciain trained computer personnel whom I have consulted, searches ?5 DarkJB is a website located at the URL The website is a forum where users trade pictures of teenagers which are sexual in nature. 7 Anni-11B is a website located it is a website where users often post nude photographs anonymousiy. Based on my training and experience, AnonIB is often used by hackers to trade and post illegally obtained photographs. 3 FBI agents conducting surveillance on the Subject Premises on or about October 14, 2014, determined that an ?open? wireless access point was avaiiable in the vicinity of the Subject Premises. The presence of an open, unsecure at the Subject Premises does not tend to defeat probable cause, see United States v. Perez, 484 F.3d T35, 7-40 (5th Cir. 200?}, however. particulari}:r in this case where the Apple records identify a specific device belonging to as being used as part of the hacking scheme. 13 Case: 1:14-mc-00552 Document 1 Fired: 1011514 Page 15 of 26 PagelD #:15 of evidence from computers commoniy require agents to download or copy information from the computers and their components1 or remove most or all computer items (computer hardware, computer software. and computer-related documentation) to be processed later by a quali?ed computer expert in a iaboratory or other controlied environment. This is almost always true because of the foilowing: a. Computer storage devices can store the equivalent of thousands of pages of information. Especially when the user wants to conceal criminal evidence, he or she often stores it with deceptive ?ie names. This requires searching authorities to examine all the stored data to determine whether it is inciuded in the warrant. This sorting process can take days or weeks, depending on the volume of data stored, and it would be generally impossible to accomplish this kind of data search on site. b. Searching computer systems for criminal evidence is a highly;r technical process requiring expert shit] and a properly controlled environment. The vast array of computer hardware and software availabie requires even computer experts to speciaiizc in some systems and applications, so it is dif?cult to know before a search which expert should analyse the system and its data. The search of a computer system is an exacting scienti?c procedure which is designed to protect the integrity of the evidence and to recover even hidden, erased, compressed: password-protected, or ?les. Since computer evidence is extremely 14 Case: Document #2 1 Filed: 10:15:14 Page 15 01?26 PageiD #216 vulnerable to tampering or destruction (which may be caused by malicious code or normal activities of an operating system), the controlled environment of a laboratory is essential to its complete and accurate analysis. c. In order to fully retrieve data from a computer system, the analyst needs all storage media as well as the computer. The analyst needs all the system software (operating systems or interfaces, and hardware drivers} and any applications software which may have been used to create the data (whether stored on hard disk drives or on external media). d. In addition, a computer, its storage devices, peripherals, and Internet connection interface may be instrumentalities of the crime(s) and are subject to seizure as such if they contain contraband or 1were used to carry out criminal activity. PROCEDURES TO BE FOLLOWED IN SEARCHING COMPUTERS 20. The warrant. sought by this Application does not authorize the ?seizure? of computers and related media within the meaning of Rule 41(c) of the Federal Rules of Criminal Procedure. Rather the warrant sought by this Application authorizes the removal of computers and related media so that they may be searched in a secure environment. 21. With respect to the search of any computers or electronic storage devices seized from the location identi?ed in Attachment A hereto, the search procedure of electronic data contained in any such computer may include the 15 Case: 1:14-mc-00552 Document 1 Filed: 1011514 Page 17 of 26 PagelD #:17 following techniques (the foliowing is a non-exclusive list, and the government may use other procedures that, like those listed below, minimize the review of information not within the list of items to be seized as set forth herein): a. examination of all of the data contained in such computer hardware. computer software, andfor memory storage devices to determine whether that data falls within the items to he seized as set forth herein; b. searching for and attempting to recover any deieted, hidden, or data to determine whether that data falls within the list of items to be seized as set forth herein (any data that is and unreadable will not be returned uniess law enforcement personnel have determined that the data is not (1) an instrumentality of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) otherwise unlawfully possessed, or (5) evidence of the offenses speci?ed above); c. surveying various ?le directories and the individual ?les they contain to determine whether they include data falling within the list of items to be seized as set forth herein: do opening or reading portions of ?les in order to determine whether their contents fall within the items to be seized as set forth herein: e. scanning storage areas to discover data falling within the list of items to be seised as set forth herein, to possibly recover any such recently deleted 16 Case: 1:14-mc-00552 Document a: 1 Filed: 10f15I14 Page 18 of 26 PagelD #:18 data! and to search for and recover de?berately hidden ?ies falling within the list of items to be seized; endan- f. performing key word searches through all storage media to determine whether occurrences of language contained in such storage areas exist that are likely to appear in the evidence Liescribed in Attachment B. 22. Any computer systems and electronic storage devices removed from the premises during the search will be returned to the premises within a reasonable period of time not to exceed 30 days, or unless otherwise ordered by the Court. Case: Document 1 Fiied: 10f15/14 Page 19 of 26 PageID #:19 CONCLUSION 23. Based on the above information, I respectfully submit that there is probable cause to believe that violations of the Subject Offenses have been committed, and that evidence and instrumentalities relating to this criminal conduct. as further described in Attachment B, will be found in the Subject Premises, as further described in Attachment A. I therefore respectfully request that this Court issae a search Warrant for the residence located at 6435 South Narragansett Avenue, Apartment 2A, Chicago, IL, 60638, more particularly described in Attachment A, authorizing the seizure of the items described in Attachment B. FURTHER SAYETH NOTdrew?. - . . ?if gJosh E. Sadowsk?? Special Agent Federal Bureau of Investigation Subscribed and sworn before me this 15th day of October, 2014 a, ?2 - a, a" i Honorable Maria Vaidez ?3 United States Magistrate Judge 18 Case: 1:14-mc-00552 Document #1 1 Filed: 1011514 Page 20 of 26 PagelD #:20 ATTACHMENT A DESCRIPTION OF PREMISES TO BE SEARCHED The premises to be searched is an apartment located at 6435 South Narragansett Avenue, Apartment 2A, Chicago, IL, 60638, and. is further described as foliows: The residence Apartment 2A is in a building iocated on the southeast corner of the intersection of Narragansett Avenue and West 64th Place? The entrance is on the north side of the building, and ?6485? is displayed on the upper right corner of the front door. The bu?ding is a white brick multi-unit dwelling with brown accents and a brown brick surround on the front foyer. After entering through the exterior door, there is a second locked cioor with a buzzer system- The buzzer system listeti GLORIA as the resident of Apartment 2A. Case: 1:14-mc-00552 Document 1 Filed: 10l15ll4 Page 21 of 26 PagelD #:21 ATTACHMENT LIST OF ITEMS TO BE SEIZED Evidence and instrumentalities concerning violations of Title 18, United States Code, Sections 371 (conspiracy), 1030(9) (computer fraud and abuse), 1037 (fraud and related activity in connection with electronic mail), 1343 (wire and 2319 and Title 17, United States Code, Section 506(a) {criminal copyright infringement) (the ?Subject Offenses?), as follows: 3. Any and all records, notes, documents, and materials related to e-mail and iCloud accounts accessed by Ed Majerceyk for the period of December 16, 2010 to present; Any and all records, notes, documents, and materials related to celebrities and women not af?liated with Ed or other residents of the Subject Premises, to include: i. Personally identifying information, such as date of birth and social security account number; ii. Contact information, such as addresses, telephone numbers, e- mail addresses, or online account names; Photographs in any format; and iv. Videos in any format. Any and all records, notes, documents, and materials related to ?phishing,? which may include accounts with names that imply they are from Ginail, Apple, or other potential phishing accounts, and used in an attempt to have users provide login information in response to an e?mail from the account, or the content of a phishing e-inail itself, which may appear to look like a legitimate e-mail from an Internet Service Provider with the purpose of obtaining private information from a recipient; Any and all records, notes, documents, and materials related to the e- mail accounts or appleprivacy@ic1oud.coni; Case: 1:14amc-00552 Document it: 1 Filed: 10I15114 Page 22 of 26 PagelD #:22 Any and all records, documents, images, logs, programs, applications and materials relating to hacking e-mail accounts, resetting e-mail password, hacking utilities, email forwarding, Elcomsoft Phone Password Breaker software, or compromising e?maii accounts or other secured Internet services; Any and all records, documents, images, logs, programs, applications and materials relating to the sharing, distributing, or posting of photographs, videos or personal information of celebrities, or personfs) that have no obvious relationship to Ed Majerceyk or other residents of the Subject Premises, including victims J.L., A-L., L.N., L.B., N.H., (3.8., C.P., 33.0., ER, G.U., K.D., L.R., L.M.W., V.J., J.S., N.Z., E.W., M.L., AA, J.L., 3.0., and and Evidence and contents of logs and files on a computer or storage device, such as those generated by the computer's operating system, which describes the history and use of the device, including but not limited to ?les indicating when ?les were written, were opened, were saved, or were deieted. Evidence tending to show the identity of the person using the computer at the time an}r actions relating to the above offenses were taken. Also, any malware resident on the computer. The following mayr be seized and searched for ail items listed above, and for any items speci?caliy noted in the paragraphs beiow: a. Computer hardware, meaning any and 3.11 computer equipment. Included within the de?nition of computer hardware are any electronic devices capable of data processing (such as central processing units, laptop or notebook or netbook or tablet computers, personal digital assistants, gaming consoles, and wireless communication devices to inciude ceilular telephone devices capable of internet access); peripheral inputfoutput devices {such as keyboards, printers, scanners, plotters, monitors, and drives intended for removable media); related communications devices (such as modems, wireless routers, cables and connections); storage media, de?ned below; and security devices, also de?ned below. Computer software, meaning any and all data, information, instructions, programs, or program codes, stored in the form of electronic, magnetic, opticai, or other media, which is capable of being interpreted by a computer or its related components. Computer software may also include data, data fragments, or control characters 2 Case: 1:14-mc-00552 Document 1 Filed: 10/1514 Page 23 of 26 Page?) #:23 integral to the operation of computer software, such as operating systems software, applications software, utility programs, compilers, interpreters, communications software, and other programming used or intended to he used to communicate with computer components. c. Computer related documentation, meaning any written, recorded, printed, or electronically stored material that explains or illustrates the configuration or use of any seized computer hardware, software, or related items. d. Data security devices, meaning any devices, programs, or data -- whether themselves in the nature of hardware or software that can be used or are designed to be used to restrict access to, or to facilitate concealment of, any computer hardware, computer software, computer related documentation, or electronic data records. Such items include, but are not limited to, user names and passwords; data security hardware (such as devices, chips, and circuit boards); data security software or information (Such as test keys and codes); and similar informatiOn that is required to access computer programs or date or to otherwise render programs or data into usable form. e. All storage media capable of collecting, storing, maintaining, retrieving, concealing, transmitting, and backing up electronic data. Included within this paragraph is any information stored in the form of electronic, magnetic, Optical, or other coding on computer media or on media capable of being read by a computer or computer related equipment, such as fixed hard disks, external hard disks, removable hard disks {including micro drives), ?oppy diskettes, compact disks (CDs), digital video disks (DVDs), tapes, optical storage devices, laser disks, thumb drives, ipods, digital cameras, memory cards (ag. CF or SD cards), Xboxes, flash drives, or other memory storage devices. This also includes areas with digital storage capability on devices such as printers, scanners, wireless routers, etc. Case: lzl4~mc?00552 Document 1 Filed: 10I15l14 Page 24 of 26 PagelD #224 ADDENDUM TO ATTACHMENT Cellular Phones With respect to the search of any information and records stored within hand?heid wireless communication devices, including cellular telephones, and any related memory cards or removable storage media, law enforcement personnel will locate the information to be seized according to the'following,r protocol: The search procedure may include the following techniques (the following is a non-exclusive list, and the government may use other procedures that, like those listed below, minimize the review of information not within the list of items to be seized as set forth herein): a. searching for and attempting to recover any hidden, or data to determine whether that data falls within the list of items to be seized as set forth herein; b. surveying various ?le directories, electronic mail, text messages, contact lists, address books, cal] logs, calendars, notes, appointments, task lists, voice mail, audio files, video ?les, or pictures, including attachments thereto, to determine whether they include data falling within the list of items to be seized as set forth herein; c. opening or reading portions of electronic mail or text messages, and attachments thereto, in order to determine whether their contents fall within the items to be seized as set forth herein; andfor d. performing key word searches through all electronic maii or text messages, and attachments thereto, to determine whether occurrences of language contained in such electronic mail or text messages, and attachments thereto, exist that are likely to appear in the information to be seized described in Attachment B. Law enforcement personnel are not authorized to conduct additional searches on any information beyond the scope of the items to be seized by this warrant. Case: Document 1 Filed: 10i15i14 Page 25 of 26 PageID #:25 Computer media This warrant does not authorize the ?seizure? of computers and related media within the meaning of Rule 41(c) of the Federal Rules of Criminal Procedure. Rather this warrant authorizes the removal of computers and related media so that they may be searched in a secure environment. The search shall be conducted pursuant to the following protocol: With respect to the search of any computers or electronic storage devices removed from the premises described in Attachment A hereto, the search procedure of electronic data contained in any such computer may include the following techniques (the following is a nonexclusive list, and the government may use other procedures that, like those listed below, minimize the review of information not within the list of items to be seized as set forth herein): a. examination of all the data contained in such computer hardware, computer software, andfor memory storage devices to determine whether that data falls within the items to be seized as set forth herein; searching for and attempting to recover any deleted, hidden, or data to determine whether that data falls within the list of items to be seized as set forth herein (any data that is and unreadable will not be returned unless law enforcement personnel have determined that the data is not (1) an instrumentalitv of the offenses, (2) a fruit of the criminal activity, (3) contraband, otherwise unlawfully possessed, or (5) evidence of the offenses speci?ed above); surveying various ?le directories and the individual ?les they contain to determine whether they include data falling within the list of items to be seized as set forth herein; opening or reading portions of ?les in order to determine whether their contents fall within the items to be seized as set forth herein; scanning storage areas to discover data falling within the list of ems to be seized as set forth herein, to possibly recover any such recently deleted data, and to search for and recover deliberately hidden ?les falling within the list of items to be seized; andfor Case: 1:14-mc-00552 Document #2 1 Filed: 10!15!14 Page 26 of 26 PagelD #126 f. performing key word searches through all eiectronic storage media to determine whether occurrences of language contained in such storage media exist that are likely to appear in the evidence described in Attachment B. The government will return any computers or electronic storage devices removed from the premises described in Attachment A hereto Within 30 days of the removal thereof, unless contraband is found on the removed computer andfor electronic storage device, or unless otherwise ordered by the Court. Case: Document 3 Filed: 1011514 Page 1 of 2 Fail) ED i, 88? 1 5 29a UNITED STATES DISTRICT cooagkmm NORTHERN DISTRICT OF Sag?? MARIA vane: EASTERN DIVISION . In the Matter of the Search of: No. 5 5 The residence located at 6435 South Magistrate Judge MARIA VALDEZ Narragansett Avenue, Apartment 2A, Chicago, Illinois UNDER SEAL GOVERNMENTS MOTION TO SEAL SEARCH WARRANT, APPLICATION, AN AFFIDAVIT Now comes the UNITED STATES OF AMERICA, by ZACHARY T. FARDON, United States Attorney for the ?crthern District of Illinois, and states as follows in support of its Motion to Seal Search Warrant, Application, and Af?davit: 0n the 15th day of October, 2014, the government applieti for a Search Warrant in this matter, anti Submitted an Application and Af?davit in support. The Search Warrant Af?davit details the facts Supporting probable cause to believe that evidence anti instrumentalities concerning violations of Title 18, United States Code, Sections 371, 1030(a), 1037, 1343, and 2319 and Title 17, United States Code, Section 506(a), will be founti at 8435 South Narragansett Avenue, Apartment 253. Chicago, Illinois. The government will continue its investigation after execution of the Search Warrant, and disclosure of the Application and Affidavit would jeopardize the investigation by providing the subject of the investigation an opportunity to destroy evicience or ?ee and jeopardize the investigation by disclosing the details of facts known to investigators, the identities of witnesses, and the investigative strategy. Case: 1:14-mc-00552 Document 3 Filed: 101'151'14 Page 2 of 2 PagelD #:38 up For the foregoing reasons, the government respectfully requests that the Search Warrant, Application, and Af?davit be sealed for 60 days from the date of this Order, until December 14, 2014, except as necessary to facilitate the enforcement; of criminal law, including the execution of the search warrant, or to any federal of?cial to assist the of?cial receiving the information in the perfermance of that of?cial?s duties. Respectfully submitted, ZACHARY T. FARDON United States Attorney By: William E. Ridge?? Assistant United States Attorney 219 S. Dear-born Street, R111. 500 Chi-cage, Iilinois 60604 (812) 469-6238 DATE: October 15, 2014 Case: 1:14-mc-00552 Document 4 Filed: 101152'14 Page 1 of 2 Page?) #:39 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION . If; In the Matter of the Search of: No, 1 5 5 - The residence located at 6435 South Magistrate Judge MARIA VALDEZ Narragansett Avenue, Apartment :23, Chicago, illinois UNDER SEAL ORDER The UNITED STATES OF MERICA by its attorney, MUHARY T. FARDON, United States Elittor?ne}r for the Northern Bistriet of Illinois, having moved this Court. to Seal the Search Warrant, Application, and Af?davit, and having demonstrated good cause in support of its motion, speci?cally, that disclosure of the Search Warrant, Application, anti Af?davit weuid jeopardize the investigation by providing the subject of the investigation an opportunity to destroy evidence or ?ee and jeopardize the investigation by diselesing the details of facts known to investigators, the identities of witnesses, and the investigative strategy. IT IS HEREBY ORDERED THAT the Search Warrant, Application, and Af?davit be kept under seal for 60 days freni the date of this Order, until December 14, 2014. Case: Document 4 Filed: 10/1514 Page 2 of 2 PagelD #:40 This Order does not prohibit law enforcement personnel from disclosing the search warrant as necessary to facilitate the enforcement of criminai law, including the execution of the warrant, or to any federal of?cial to assist the of?cial receiving the infermation in the performance of that; of?cials duties. ENTER: .. A L- MARIA VALDEZ a United States Msgistrate??udge K. DATE: October 15, 2014 Case: 1:14-mc-00552 Document #2 2 Filed: 10l29l14 Page 1 of 10 PageID #:27 no 93 (Rev. use) Search and Seizure Warrant AUSA E. Ridgway, (312) 469-8233 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS, EASTERN DIVISION UNDER SEAL In the Matter oflthe Search of: The residence located at 6435 South Narragansett Case Number: . Avenue, Apartment 2A, Chicago, further 1 4 described in Attachment A 5 5 2 - 1 SEARCH AND SEIZURE WARRANT To: Josh E. Sadowsk}? and an}r authorized law enforcement of?cer An epp?cation by a federai Is or enforcement of?cer or an attorney.r for the government requests the search of the foliowing person or property ioceted in the Northern District of Illinois: See Attachment A I find that the af?davi?s}, or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal: See Attachment YOU ARE HEREBY COMMANDED to execute this warrant on or hefore October 29 my; in the daytime (6:66 am. to 10:00 pen). Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises. the property was taken, or leave the copy- and receipt at the place where property was taken. The of?cer erecuting this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to United States Magistrate edge MARIA RIALDEZ. .. It .1 3"5:1. 3, ?i Date and time issued: gctober 15 2011;"? ?3 a; 12 ?j triuwwh 4 ob?. Judge?s Signet-pg City and Sta to: Chicago. Illinois MARIA VALDEZ. US. Magistrate Judge Printed name and title A0 93 (REV. Search and Seizui'e Warrant (Page 2) Case: Document 2 Filed: 10!29f14 Page 2 of 10 PageED #:28 Return . Case No: Date and Time Warrant Executed: ?t @5906 of Warrant and 1mm ntory Left With: Zyli Whfo Invantory made in the presence of: 1M age C'Zx??'f S96 eJ Invenmry of the property taken am; name Of any pet's-Lima) seized: FILED GET 2 9 2814 MAGISTRAIE 1393s: MARIA UNITED STATES COURT Certi?catien i deciare under penalty of perjury that this inventory is crafted: and was returned along with the original warrant; to the tiesignated judge. Date: Executing officer?s signature Qui?{iok ?19an Mm Printed name and ?i?e Case: 1:14-me-00552 Document 2 Filed: 10f29f14 Page 3 of 10 PagelD #:29 ATTACHMENT 2% DESCRIPTION OF PREMISES TO BE SEARCHED The premises to be searched is an apartment located at 6435 South Narragansett Avenue, Apartment 2A, Chicago, IL, 60638, and is further described as follows: The residence Apartment 2A is in a building located on the southeast corner of the intersection of Narragansett Avenue and West 84th Place. The entrance is en the north side of the building, and ?6485? is displayed on the upper right corner of the front door. The building is a white brick multi~unit dwe?ing with brown accents and. a brown brick surround on the front foyer. After entering through the exterior door, there is a second locked door with a buzzer system. The buzzer system listed GLORIA as the resident of Apartment 2A. Case: 1:14-mc-00552 Document a: 2 Filed: 1099/14 Page 4 of 10 PageID #:30 ATTACHMENT LIST OF ITEMS TO BE SEIZED Evidence and instrumentalities concerning Violations of Title 18, United States Code, Sections 371 (conspiracy), 1030(a) (computer ?ned and abuse), 1037 (fraud and related activity in connection with electronic mail), 1343 (wire fraud), and 2319 and Title United States Code, Section 506(a) (criminal copyright infringement) (the ?Subject Offenses?), as follows: a. Any and all records, notes, documents, and materials related to e?mail and iCloud accounts accessed by Ed for the period of December 16, 2010 to present; Any and all records, notes, documents, and materials related to celebrities and women not af?liated with Ed or other residents of the Subject Premises, to include: i. Personally identifying information, such as date of birth and social security account number; ii. Contact information, such as addresses, telephone numbers, e- mail addresses, or online account names; Photographs in any format; and iv. Videos in any format. Any and all records, notes, documents, and materials related to ?phishing,? which may include accounts with names that imply they are from Gmail, Apple, or other potential phishing accounts, and used in an attempt to have users provide login information in response to an e-mail from the account, or the content of a phishing e?mail itself, which may appear to look like a legitimate e-mail from an Internet Service Provider with the purpose of obtaining private information from a recipient; {any and all records, notes, documents, and materials related to the e- mail accounts or appleprivacwicloudcom; Case: 1:14-mc-00552 Document 2 Filed: Page 5 of 10 PagelD #231 Any and ail records, documents, images, iogs, programs, applications and materials relating to hacking e-mail accounts, resetting e-mail password, hacking email forwarding, Elcomsoft Phone Password Breaker software, or compromising e-mail accounts or other secured Internet services; Any and all records, documents, images, logs, programs, applications and materials relating to the sharing, distributing, or posting of photographs, videos or personal information of celebrities, or person(s} that have no obvious relationship to Ed or other residents of the Subject Premises, including victims J.L., J.V., K.U., A.L., L.L., L.B., 0-8., OR, 13.0., E.R., G.U., K.D., L.R., L.M.W-, VJ, J.S., E.W., M-L., AA, J.L., 13.0., and and Evidence and contents of logs and flies on a computer or storage device, such as those generated by the computer's operating system, which describes the history and use of the device, including but not limited to ?les indicating when ?les were written, were opened, were saved, or were deleted. Evidence tending to show the identity of the person using the computer at the time any actions relating to the above offenses were taken. Also, any maiware resident on the computer. The following may be seized and searched for all items listed above, and for any items specificain noted in the paragraphs below: a. Computer hardware, meaning any and all computer equipment. Included within the de?nition of computer hardware are any electronic devices capable of data processing (such as central processing units, iaptop or notebook or netbook or tablet computers, personal digital assistants, gaming consoies, and wireless communication devices to include cellular telephone devices capable of internet access); peripheral inputa'output devices (such as keyboards, printers, scanners, plotters, monitors, and drives intended for removable media); related communications devices (such as modems, wireless routers, cables and connections}; storage media, de?ned below; and security devices, also de?ned below. Computer software, meaning any and all data, information, instructions, programs, or program codes, stored in the form of. electronic, magnetic, optical, or other media, which is capable of being interpreted by a computer or its related components. Computer software may also include data, data fragments, or control characters 2 Case: 1:14-mc-00552 Document 2 Filed: 10(291'14 Page 5 of 10 PagelD #:31 Any and all records, documents, images, logs, programs, applications and materials relating to hacking e-mail acconnts, resetting e-mail password, hacking utilities, e?mail forwarding, Elcomsoft Phone Password Breaker software, or compromising e-mail accounts or other secured Internet services; Any and all records, documents, images, logs, programs, applications and materials relating to the sharing, distributing, or posting of photographs, videos or personal information of celebrities, or person(s) that have no obvious relationship to Ed or other residents of the Subject Premises, including victims J.L., J.V., K.U., AL, L.L., L.N., L.B., N.H., (3.8., GB, D.C., E.R., G-U., K.D., L.R., L.M.W., V.J., 3.8., Nil, E.W., M.L., A.A., J.L., 3.0., and and Evidence and contents of logs and flies on a computer or storage device, such as those generated by the computer?s operating system, which describes the history and use of the device, including but not limited to files indicating when ?les were written, were opened, were saved, or were deleted- Evidence tending to show the identity of the person using the computer at the time any actions relating to the above offenses were taken. Also, any malware resident on the computer. The following may be seized and searched for all items listed above, and for any items speci?cally noted in the paragraphs below: a. Computer hardware, meaning any and all computer equipment. Included within the definition of computer hardware are any electronic devices capable of data processing (such as central processing units, laptop or notebook or netbook or tablet computers, personal digital assistants, gaming consoles, and wireiess communication devices to include cellular telephone devices capable of internet access); peripheral inputioutput devices (such as keyboards, printers, scanners, plotters, monitors, and drives intended for removable media}; related communications devices (such as modems, wireless renters, cables and connections); storage media, defined below; and security devices, also defined below. Computer software, meaning any and all data, information, instructions, programs, or program codes, stored in the form of electronic, magnetic, optical, or other media, which is capable of being interpreted by a computer or its related. components. Computer software may also include data, data fragments, or control characters 2 Case: 1:14-mc-00552 Document 2 Filed: 10l29l14 Page 6 of 10 PagelD #:32 integral to the operation of computer software, such as operating systems software, applications software, utility programs, compilers, interpreters, communications software, and other programming used or intended to be used to communicate with computer components. Computer related documentation, meaning any written, recorded, printed, or electronically stored material that explains or illustrates the con?guration or use of an),r seized computer hardware, software, or related items. Data security devices, meaning any devices, programs, or data whether themselves in the nature of hardware or software -- that can be used or are designed to be used to restrict access to, or to facilitate concealment of, any computer hardware, computer software, computer related documentation, or electronic data records. Such items include, but are not limited to, user names and passwords; data security hardware (such as devices, chips, and circuit boards); data security software or information (such as test keys and codes); and similar information that is required to access computer programs or date or to otherwise render programs or data into usable form. All storage media capable of collecting, storing, maintaining, retrieving, concealing, transmitting, and backing up electronic data. Included within this paragraph is any information stored in the form of electronic, magnetic, optical, or other coding on computer media or on media capable of being read by a computer or computer related equipment, such as fixed hard disks, external hard disks, removable hard disks (including micro drives), ?oppy diskettes, compact disks (CDs), digital video disks (DVDs), tapes, optical storage devices, laser disks, thumb drives, ipods, digital cameras, memory cards (cg. CF or SD cards), Xboxes, ?ash drives, or other memory storage devices. This also includes areas with digital storage capability on devices such as printers, scanners, Wireless routers, etc. Case: Document 2 Filed: 10l29f14 Page 9 of 10 PagelD #235 f. performing key word searches through all electronic storage media to determine Whether occurrences of language contained in such storage media exist that are likely to appear in the evidence described in Attachment B. The government will return any computers or electronic storage devices removed from the premises described in Attachment A hereto within 30 days of the removal thereof, unless contraband is found on the removed computer andfor electronic storage device, or unless otherwise ordered by the Court. FD 5:1? 3 ?(232.53: 1:14-mc-00552 Document 2 Flied: 10I29I14 Page 10 of #36 UNITED STATES DEPARTMENT OF JUSTICE FEDERAL BUREAU OF INVESTIGATION Receipt for Property We? 0n (date) item(5) listed belew were: Receivad E3 Returned T9 {Name} 50% ?ilqiaased To Sezzed {Sirect Address} m? {City} .22., 0 'Gasc-rizfs?an 0f Itemis): 3 - 3mg germ: H"?me 1 mm: Mag. Wig)? 1:3??an {@241 4:4 3 @a?mwgi Q1 a :3 95M gm gmo??3?f t1Receiv?d Hy: Si nature? Case: 1:14-mc-00552 Document #2 5 Filed: llfi?lzt Page 1 of 3 Page?) #:41 i\ \jl, ,3 UNITED STATES DISTRICT COURT NORTHERN manner or ILLINOIS 8 EASTERN DIVISION 1 . {@536/03 In the Matter of the Search of: No. 14 552 423b?f?ry??f - 4 Narragansett Avenue, Apartment 2A, Chicago, Illinois UNDER SEAL GOVERNMENTS MOTION TO CONTINUE SEAL SEARCH WARRANT, APPLICATION, AND AFFIDAVIT AND EXTEND THE TIME FOR FORENSIC REVIEW Now comes the UNITED STATES OF AMERICA, by ZACHARY T. FARDON, United States Attorney for the Northern District of and states as follows in support of its Motion to Seal Search Warrant, Application, and Af?davit: On October 15, 2014, the government applied for a Search Warrant in this matter, and submitted an Application and Af?davit in support. The Search Warrant Affidavit detaiis the facts supporting prohabie cause to believe that evidence and instrumentalities concerning violations of Title 18, United States Code, Sections 371, 1630(a), 1037, 1343, and 2319 and Title 17, United States Code, Section 506(a), will be found at 6435 South Narragansett Avenue, Apartment 2A, Chicago, Illinois. This Court granted the government?s motion to sea} the search warrant and af?davit untii December 14, 2014. The government?s investigation continues after the execution of the Search Warrant, and disclosure of the Application and A??idavit would jeopardize the investigation by providing the subjects of the investigation an opportunity to destroy evidence or ?ee and jeopardize the investigation by disclosing the details of Case: Document #2 5 Filed: 11I17ll4 Page 2 of 3 PagelD #142 facts known to investigators, the identities of witnesses, and the investigative strategy. For the those reasons, the government respectfnily requests that the Search Warrant, Appiication, and Af?davit be sealed for 30 days from the date of this Order, until anuary 13, 2015, except as necessary to facilitate the enforcement of criminal law, including the execution of the search warrant, or to anyr fedora} of?cial to assist the of?cial receiving the information in the performance of that of?ciai?s duties. Also, pursuant the Addendum to Attachment of the search warrant, the government is to perform a forensic analysis of any computers or electronic storage devices removed from the premises and return these computers and electronic storage devices within 30 days of the search warrant, unless contraband is discovered on the computers. The government has not completed that review and seeks additional time to perform that anaiysis for two reasons. First, the investigation is being conducted by FBI agents in Los Angeles, and the transit of the computers and electronic storage devices to that location has caused some delay. Second, the search yielded many computers and electronic storage devices, inciuding at. least two desktop computers, ?ve laptop computers, and several external hard drives and thumb drives. According to the forensic exports, a careful forensic anaiysis of that media will be time consuming. Case: 1:14-mc-00552 Doeument 5 Filed: llfl7a'14 Page 3 of 3 PageID #:43 Accordingly, the government seeks to extend the deadiine to return the computer media to anuai?y 13, 2015- Respectfully submitted, ZACHARY T. FARDON United States Attorney 'r Bv: Wiliiem E. Ridgway i 3 Assistant United States ?ttorney 219 S. Dear-born Street, Rm. 500 Chicago. Illinois 60604 (312) 469-6233 DATE: November 34, 2014 Case: 1:14-mc-00552 Document 6 Filed: 11I17I14 Page 1 of 2 PagelD #244 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION In the Matter of the Search of: No. 14 552 The residence ioeated at 6485 South Magistrate Judge MARE. VALDEZ Narragansett Avenue, Apartment 2A, Chicago, Illinois SEAL ORDER The UNITED STATES OF AMERICA by its attorney, ZACHARY T. FARDON, United States Attorney for the Northern District of Illinois, having moved this Court to extend the seal of the Search Warrant, Application, and Af?davit and the time to return computers and electronic storage devices, and having demonstrated good cause in support of its motion, speci?cally, that disciesure of the Search Warrant, Application, and Af?davit would jeopardize the investigation by providing the subject of the investigation an opportunity to destroy evidence or ?ee and jeopardize the investigation by disclosing the details of facts known to investigators, the identities of witnesses, and the investigative strategy and that the forensic review W?i require additional time to complete. 5?18 HEREBY ORDERED THAT the Search Warrant, Appiicatioo, and Af?davit be kept under seai until January 13, 2015, and that the deadline to return the computers and electronic storage devices be extended to that date as well. Case: 1:14-mc-00552 Document #2 6 Filed: 11f17f14 Page 2 of 2 PageED #:45 This Order dees not prohibit law enforcement personnel from disclosing the search warrant as necessary to facilitate the enforcement of criminal law? including the execution of the warrant, or to any federal of?cial to assist the of?cial receiving the information in the performance of that of?cial?s duties. ENTE R: Mg? - MARIA VALDEZ United States Magistrate Judge Case: 1:14-mc-00552 Document 7 Filed: Page 1 of 2 Paw #:46 i {a 6 j? .5 UNITED STATES DISTRICT COURT gees? av; NORTHERN DISTRICT OF ILLINOIS ??ayj??xyg? 3% EASTERN DIVISION Wistg?gfe??g 5? 4(5) In the Matter of the Search of: No. 14 552 The residence located at 6435 South Magistrate Judge MARIA VALDEZ Narragansett Avenue, Apartment 2A, Chicago, Illinois UNDER SEAL GOVERNMENTS MOTION TO CONTINUE SEAL SEARCH WARRANT. APPLICATION. AND AFFIDAVIT Now comes the UNITED STATES OF AMERICA, by ZACHARY T. FARDON, United States Attorney for the Northern District of Illinois, and states as follows in support of its Motion to Seal Search Warrant, Application, and Af?davit: On October 15, 2014, the government appiied for a Search Warrant in this matter, and submitted an Appiication and Af?davit in support. The Search Warrant Af?davit details the facts supporting probahie cause to beiieve that evidence and instrumentalities concerning violations of Title 18, United States Code, Sections 3T1, 1030(a), 1037, 1343, and 2319 and Title 17, United States Code, Section 566%), will he found at 6435 South Narragansett Avenue, Apartment 2A, Chicago, Illinois. This Court granted the government?s motion to seal the search warrant and af?davit untii December 14, 2014 and January 13, 2015. Thereafter, this Court granted the government?s ?rst motion to extend the seal. The government?s investigation continues after the execution of the Search Warrant, and disclosure of the Application and Af?davit would jeopardize the investigation by providing the subjects of the investigation an opportunity to destroy evidence or ?ee and jeopardize the investigation by disclosing the details of 1o Case: 1:14-mc-00552 Document 7 Filed: Dill-M15 Page 2 of 2 PagelD #:47 facts known to investigators, the identities of witnesses, and the investigative strategy. or the those reasons, the government respectfully requests that the Search Warrant, Appiication, and Af?davit be eealed for 90 days from the date of this Order, until April 8, 2015, except as necessary to facilitate the enforcement of criminal law, including the execution of the search warrant, or to any},r federal of?cial to assist the of?cial receiving the information in the performance of that o?ieial.?s entries. Respectfully submitted, ZACHARY T. FARDON United States Attorney By: 23??3?3: 925342," William E. Ridgway Assistant United States Attorney 219 S. Dearborn Street, Rm. 500 Chicago, Illinois 60604 (312) 469-6233 DATE: November 14, 2014 Case: 1:14-mc-00552 Document 8 Filed: 01f14f15 Page 1 of 2 PagelD #:48 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION In the Matter of the Search of; No. 14 5'52 The residence located at 6435 South Magistrate Judge MARIA Narragansett Avenue, Apartment 2A, Chicago, Illinois UNDER SEA ORDER The STATES OF AMERICA by its attorney, ZACHARY T. FARDON, United States Attorney for the Northern District of Illinois, having moved this Court to extend the seal of the Search Warrant, Application, and having demonstrated good cause in support of its motion, speci?cally, that disclosure of the Search Warrant, application, and Af?davit would jeopardize the investigation by providing the subject of the investigation an opportunity to destroy evidence or flee and jeopardize the investigation by disclosing the details of facts known to investigators. IT IS HEREBY ORDERED THAT the Search Warrant, Application. and Af?davit. be kept under seal until Aprii 8, 2015, and that the deadline to return the computers and electronic storage devices be extended to that date as well. 69 Case: 1:14-mc-00552 Document 8 Filed: 01114I15 Page 2 of 2 PageED #:49 This Order does not prohibit law enforcement personnel from disclosing the search warrant as necesear}r to facilitate the enforcement of criminal law, including the execution of the warrant, or to any federal of?cial to assist the of?cial receiving the information in the performance of that of?cial?s duties. ENTER: yum?; MAR A VALDEZ United States Magistrate Judge JAN 1 4 2015 DATE: