Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 1 of 13 SEALED DOCUMENT UNITED STATES DISTRICTCOURTUQJsDT1R1TcRTIC0TFCNQ^RtT FOR THE DISTRICT OF NEW HAMPSHIRE FILED 2014 AUG - 5 P 2= 2 3 IN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER AUTHORIZING THE INSTALLATION AND USE OF PEN REGISTERS AND TRAP AND TRACE DEVICES ON WHATSAPP COMMUNICATIONS ON (978) 387-5180 No. l;i<-t-rt>c-31- Z^CT Filed Under Seal APPLICATION The United States of America, moving by and through John J. Farley, its undersigned counsel, respectfully submits under seal this ex parte application for an order pursuant to 18 U.S.C §§ 3122 and 3123, authorizing the installation and use of pen registers and trap and trace devices ("pen-trap devices") on the wire or electronic communications transmitted via WhatsApp Inc. ("WhatsApp") on telephone number (978) 387-5180, which is subscribed to in the name of of TracFone, 3503 College Dr., Louisville, Kentucky, and which is believed to be used by Samuel Garcia. In support of this application, the United States asserts: 1. This is an application, made under 18 U.S.C. § 3122(a)(1), for an order under 18 U.S.C. § 3123 authorizing the installation and use of a pen register and a trap and trace device. 2. Such an application must include three elements: (1) "the identity of the attorney for the Government or the State law enforcement or investigative officer making the application": (2) "the identity of the law enforcement agency conducting the investigation"; and (3) "a certification by the applicant that the information likely to be obtained is relevant to an ongoing criminal investigation being conducted by that agency." 18 U.S.C. § 3122(b). Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 2 of 13 3. The undersigned applicant is an "attorney for the government" as defined in Rule 1(b)(1) of the Federal Rules of Criminal Procedure. 4. The law enforcement agency conducting the investigation is the Drug Enforcement Administration ("DEA"). 5. The applicant hereby certifies that the information likely to be obtained by the requested pen-trap devices is relevant to an ongoing criminal investigation being conducted by the DEA. ADDITIONAL INFORMATION 6. Other than the three elements described above, federal law does not require that an application for an order authorizing the installation and use of a pen register and a trap and trace device specify any facts. The following additional information is provided to demonstrate that the order requested falls within this Court's authority to authorize the installation and use of a pen register or trap and trace device under 18 U.S.C. § 3123(a)(1). 7. A "pen register" is "a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted." 18 U.S.C. § 3127(3). A "trap and trace device" is "a device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing, and signaling information reasonably likely to identify the source of a wire or electronic communication." 18 U.S.C. § 3127(4). 8. In the traditional telephone context, pen registers captured the destination phone numbers of outgoing calls, while trap and trace devices captured the phone numbers of incoming calls. Similar principles apply to other kinds of wire and electronic communications, as described below. 2 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 3 of 13 9. The Internet is a global network of computers and other devices. Devices directly connected to the Internet are identified by a unique number called an Internet Protocol, or "IP" address. This number is used to route information between devices. Generally, when one device requests information from a second device, the requesting device specifies its own IP address so that the responding device knows where to send its response. An IP address is analogous to a telephone number and can be recorded by pen-trap devices, and it indicates the online identity of the communicating device without revealing the communication's content. 10. A network is two or more computers or other devices connected to each other that can exchange information with each other via some transmission method, such as by wires, cables, or radio waves. The equipment that connects a computer or other device to the network is commonly referred to as a network adapter. Most network adapters have a Media Access Control ("MAC") address assigned by the manufacturer of the adapter that is designed to be a unique identifying number. An adapter's unique MAC address allows for proper routing of communications on a local area network and may be used for other purposes, such as authentication of customers by some network service providers. Unlike a device's IP address that often changes each time a device connects to the Internet, a MAC address is fixed at the time of manufacture of the adapter. Because the address does not change and is intended to be unique, a MAC address can allow law enforcement to identify whether communications sent or received at different times are associated with the same adapter. 11. On the Internet, data transferred between devices is not sent as a continuous stream, but rather it is split into discrete packets. Generally, a single communication is sent as a series of packets. When the packets reach their destination, the receiving device reassembles them into the complete communication. Each packet has two parts: a header with routing and 3 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 4 of 13 control information, and a payload, which generally contains user data. The header contains noncontent information such as the packet's source and destination IP addresses and the packet's size. 12. In addition, different Internet applications are associated with different "port numbers," or numeric identifiers. The port number is transmitted along with any communication using that application. For example, port 80 typically is associated with communications involving the World Wide Web. 13. A cellular telephone, or cell phone, is a mobile device that transmits and receives wire and electronic communications. Individuals using cell phones contract with cellular service providers, who maintain antenna towers covering specific geographic areas. In order to transmit or receive calls and data, a cell phone must send a radio signal to an antenna tower that, in turn, is connected to a cellular service provider's network. 14. In addition to a unique telephone number, each cell phone has one or more unique identifiers embedded inside it. Depending upon the cellular network and the device, the embedded unique identifiers for a cell phone could take several different forms, including an Electronic Serial Number ("ESN"), a Mobile Electronic Identity Number ("MEIN"), a Mobile Identification Number ("MIN"), a Subscriber Identity Module ("SIM"), an International Mobile Subscriber Identifier ("IMSI"), a Mobile Subscriber Integrated Services Digital Network Number ("MSISDN"), or an International Mobile Station Equipment Identity ("IMEI"). When a cell phone connects to a cellular antenna or tower, it reveals its embedded unique identifiers to the cellular antenna or tower, and the cellular antenna or tower records those identifiers as a matter of course. The unique identifiers—as transmitted from a cell phone to a cellular antenna or tower—are like the telephone number of an incoming call. They can be recorded by pen-trap 4 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 5 of 13 devices and indicate the identity of the cell phone device making the communication without revealing the communication's content. 15. In addition, a list of incoming and outgoing telephone numbers is generated when a cell phone is used to make or receive calls, or to send or receive text messages (which may include photographs, videos, and other data). These telephone numbers can be recorded by pentrap devices and then used to identify the parties to a communication without revealing the communication's contents. 16. A cell phone can also be used to exchange text messages with email accounts. The email addresses associated with those text messages can be recorded by pen-trap devices and then used to identify parties to a communication without revealing the communication's contents. 17. Cellular phones can connect to the Internet via the cellular network. When connecting through the cellular network, Internet communications sent and received by the cellular phone each contain the same unique identifier that identifies cellular voice communications, such as an ESN, MEIN, MIN, SIM, IMSI, MSISDN, or IMEI. Internet communications from a cellular phone also contain the IP address associated with that cellular phone at the time of the communication. Each of these unique identifiers can be used to identify parties to a communication without revealing the communication's contents. 18. WhatsApp is a software application, colloquially referred to as an "app," that can be downloaded for use on a variety of types of mobile phones, including the iPhone, BlackBerry, and Android. Once downloaded, the application allows users to exchange data without incurring the fees associated with traditional SMS (Short Message Service) or text messaging, as the data is exchanged via the users' internet data plans. Users type their messages, which are sent via 5 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 6 of 13 data service to WhatsApp servers and routed to the intended recipient (who must also be a WhatsApp user), if that recipient is online. If the recipient is not online, the undelivered message is held in WhatsApp's server until it can be delivered. The application allows for the exchange of not only basic textual messages but also the exchange of images, video and audio media messages. The application also offers a "group chat" feature, which allows users to create a group of other users who can then communicate simultaneously within that group. The application also offers users the ability to submit other data associated with their account, such as a profile photo and information about their location in the form of "Status Submissions." 19. The contents of messages that have been delivered by the WhatsApp service are not copied, kept, or archived by WhatsApp in the normal course of business. If the message is undelivered for thirty (30) days, the undelivered message is deleted from its servers. WhatsApp may retain date and time-stamp information associated with successfully delivered messages and the mobile phone numbers involved in the messages. However, WhatsApp has the ability to capture text messages themselves and information regarding the messaging with legal process. Specifically, WhatsApp has the ability to capture information pursuant to a pen register and trap and trace order. THE RELEVANT FACTS 20. The United States government, including the DEA, is investigating a group of individuals who are believed to be involved in the distribution of large quantities of controlled substances, including cocaine and oxycodone, as well as the laundering of the proceeds of drug trafficking. The investigation relates to drug trafficking activities of multiple individuals in and around Manchester, New Hampshire. These individuals include Jennifer Nunez, Jose Nunez, 6 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 7 of 13 Johanna Nunez, Samuel Garcia, and others. The investigation concerns possible violations of, inter alia, 21 U.S.C. §§ 846, 843(b), and 841(a)(1) and 18 U.S.C. §§ 1956 and 1957. 21. The conduct being investigated involves use of the cell phone number (978) 387- 5180, which is believed to be used by Samuel Garcia, who is one of the targets of this investigation. During the course of this investigation, the DEA has obtained court authorization to monitor the wire and electronic communications of cell phones believed to be used by Jennifer Nunez and Samuel Garcia. Intercepted communications have indicated that Garcia is using an additional cell phone. Investigators believe that the cell phone that is the subject of this request is an additional cell phone that is being used by Garcia. The cell phone was activated on or about July 16,2014. Intercepted calls also have indicated that Garcia is communicating with other individuals using the WhatsApp application. 22. The conduct being investigated involves use of the WhatsApp application on telephone number (978) 387-5180. To further the investigation, investigators need to obtain the dialing, routing, addressing, and signaling information associated with communications sent via WhatsApp to orfromthat telephone number. Such information may help to identity coconspirators who are assisting Garcia in his drug trafficking activities. 23. The pen-trap devices sought by this application will be installed at a location to be determined, and will collect dialing, routing, addressing, and signaling information associated with each communication sent via WhatsApp to orfromtelephone number (978) 387-5180, including the date, time, and duration of the communication, and the following, without geographic limit: • IP addresses associated with the cell phone device or devices used to send or receive electronic communications 7 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 8 of 13 • Any unique identifiers associated with the cell phone device or devices used to make and receive communications with cell phone number (978) 387-5180, or to send or receive other electronic communications, including the ESN, MEIN, IMSI, IMEI, SIM, MSISDN, or MIN • IP addresses of any websites or other servers to which the cell phone device or devices connected • Source and destination telephone numbers and email addresses GOVERNMENT REQUESTS 24. For the reasons stated above, the United States requests that the Court enter an Order authorizing the installation and use of pen-trap devices to record, decode, and/or capture the dialing, routing, addressing, and signaling information described above for each communication via WhatsApp to or from telephone number (978) 387-5180, along with the date, time, and duration of the communication, without geographic limit. The United States does not request and does not seek to obtain the contents of any communications, as defined in 18 U.S.C. §2510(8). 25. The United States further requests that the Court authorize the foregoing installation and use for a period of sixty days, pursuant to 18 U.S.C. § 3123(c)(1). 26. The United States further requests, pursuant to 18 U.S.C. §§ 3123(b)(2) and 3124(a)-(b), that the Court order WhatsApp Inc. and any other person or entity providing wire or electronic communication service in the United States whose assistance may facilitate execution of this Order to furnish, upon service of the Order, information, facilities, and technical assistance necessary to install the pen-trap devices, including installation and operation of the pen-trap devices unobtrusively and with minimum disruption of normal service. Any entity 8 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 9 of 13 providing such assistance shall be reasonably compensated by the DEA, pursuant to 18 U.S.C. § 3124(c), for reasonable expenses incurred in providing facilities and assistance in furtherance of this Order. 27. The United States further requests that the Court order WhatsApp Inc. and any other person or entity whose assistance may facilitate execution of this Order to notify the applicant and the DEA of any changes relating to the use of WhatsApp by cell phone number (978) 387-5180, including changes to subscriber information, and to provide prior notice to the applicant and the DEA before terminating or changing service to the cell phone number. 28. The United States further requests that the Court order that the DEA and the applicant have access to the information collected by the pen-trap devices as soon as practicable, twenty-four hours per day, or at such other times as may be acceptable to them, for the duration of the Order. 29. The United States further requests, pursuant to 18 U.S.C. § 3123(d)(2), that the Court order WhatsApp and any other person or entity whose assistance facilitates execution of this Order, and their agents and employees, not to disclose in any manner, directly or indirectly, by any action or inaction, the existence of this application and Order, the resulting pen-trap devices, or this investigation, except as necessary to effectuate the Order, unless and until authorized by this Court. 30. The United States further requests that this application and any resulting Order be sealed until otherwise ordered by the Court, pursuant to 18 U.S.C. § 3123(d)(1). 31. The United States further requests that the Clerk of the Court provide the United States Attorney's Office with three certified copies of this application and Order, and provide copies of this Order to the Drug Enforcement Administration and WhatsApp Inc. upon request. 9 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 10 of 13 32. The foregoing is based on information provided to me in my official capacity by agents or Task Force Officers of the DEA. I declare under penalty of perjury that the foregoing is true and correct. August 5, 2014 Respectfully submitted, JOHN P. KACAVAS United States Attorney 10 Case 1:14-mc-00037-AJ Document 1 Filed 08/05/14 Page 11 of 13 SEALED DOCUM T UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW HAMPSHIRE IN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER AUTHORIZING THE INSTALLATION AND USE OF PEN REGISTERS AND TRAP AND TRACE DEVICES ON WHATSAPP COMMUNICATIONS ON (978) 387-5180 No. in4-n)