Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 1 of 13 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW HAMPSHIRE IN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER AUTHORIZING THE INSTALLATION AND USE OF PEN REGISTERS AND TRAP AND TRACE DEVICES ) ) ) ) ) ) ) ) No. Filed Under Seal APPLICATION The United States of America, moving by and through John Farley, its undersigned counsel, respectfully submits under seal this ex parte application for an order pursuant to 18 U.S.C §§ 3122 and 3123, authorizing the installation and use of pen registers and trap and trace devices (“pen-trap devices”) on the wire or electronic communications transmitted via WhatsApp Inc. (“WhatsApp”) on telephone number 52 33 3724 5939, whose listed subscriber is not known, and which is believed to be used by Oswaldo Contreras-Reyes. In support of this application, the United States asserts: 1. This is an application, made under 18 U.S.C. § 3122(a)(1), for an order under 18 U.S.C. § 3123 authorizing the installation and use of a pen register and a trap and trace device. 2. Such an application must include three elements: (1) “the identity of the attorney for the Government or the State law enforcement or investigative officer making the application”: (2) “the identity of the law enforcement agency conducting the investigation”; and (3) “a certification by the applicant that the information likely to be obtained is relevant to an ongoing criminal investigation being conducted by that agency.” 18 U.S.C. § 3122(b). Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 2 of 13 3. The undersigned applicant is an “attorney for the government” as defined in Rule 1(b)(1) of the Federal Rules of Criminal Procedure. 4. The law enforcement agency conducting the investigation is the Drug Enforcement Administration (“DEA”). 5. The applicant hereby certifies that the information likely to be obtained by the requested pen-trap devices is relevant to an ongoing criminal investigation being conducted by the DEA. ADDITIONAL INFORMATION 6. Other than the three elements described above, federal law does not require that an application for an order authorizing the installation and use of a pen register and a trap and trace device specify any facts. The following additional information is provided to demonstrate that the order requested falls within this Court’s authority to authorize the installation and use of a pen register or trap and trace device under 18 U.S.C. § 3123(a)(1). 7. A “pen register” is “a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted.” 18 U.S.C. § 3127(3). A “trap and trace device” is “a device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing, and signaling information reasonably likely to identify the source of a wire or electronic communication.” 18 U.S.C. § 3127(4). 8. In the traditional telephone context, pen registers captured the destination phone numbers of outgoing calls, while trap and trace devices captured the phone numbers of incoming calls. Similar principles apply to other kinds of wire and electronic communications, as described below. 2 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 3 of 13 9. The Internet is a global network of computers and other devices. Devices directly connected to the Internet are identified by a unique number called an Internet Protocol, or “IP” address. This number is used to route information between devices. Generally, when one device requests information from a second device, the requesting device specifies its own IP address so that the responding device knows where to send its response. An IP address is analogous to a telephone number and can be recorded by pen-trap devices, and it indicates the online identity of the communicating device without revealing the communication’s content. 10. A network is two or more computers or other devices connected to each other that can exchange information with each other via some transmission method, such as by wires, cables, or radio waves. The equipment that connects a computer or other device to the network is commonly referred to as a network adapter. Most network adapters have a Media Access Control (“MAC”) address assigned by the manufacturer of the adapter that is designed to be a unique identifying number. An adapter’s unique MAC address allows for proper routing of communications on a local area network and may be used for other purposes, such as authentication of customers by some network service providers. Unlike a device’s IP address that often changes each time a device connects to the Internet, a MAC address is fixed at the time of manufacture of the adapter. Because the address does not change and is intended to be unique, a MAC address can allow law enforcement to identify whether communications sent or received at different times are associated with the same adapter. 11. On the Internet, data transferred between devices is not sent as a continuous stream, but rather it is split into discrete packets. Generally, a single communication is sent as a series of packets. When the packets reach their destination, the receiving device reassembles them into the complete communication. Each packet has two parts: a header with routing and 3 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 4 of 13 control information, and a payload, which generally contains user data. The header contains noncontent information such as the packet’s source and destination IP addresses and the packet’s size. 12. In addition, different Internet applications are associated with different “port numbers,” or numeric identifiers. The port number is transmitted along with any communication using that application. For example, port 80 typically is associated with communications involving the World Wide Web. 13. A cellular telephone, or cell phone, is a mobile device that transmits and receives wire and electronic communications. Individuals using cell phones contract with cellular service providers, who maintain antenna towers covering specific geographic areas. In order to transmit or receive calls and data, a cell phone must send a radio signal to an antenna tower that, in turn, is connected to a cellular service provider’s network. 14. In addition to a unique telephone number, each cell phone has one or more unique identifiers embedded inside it. Depending upon the cellular network and the device, the embedded unique identifiers for a cell phone could take several different forms, including an Electronic Serial Number (“ESN”), a Mobile Electronic Identity Number (“MEIN”), a Mobile Identification Number (“MIN”), a Subscriber Identity Module (“SIM”), an International Mobile Subscriber Identifier (“IMSI”), a Mobile Subscriber Integrated Services Digital Network Number (“MSISDN”), or an International Mobile Station Equipment Identity (“IMEI”). When a cell phone connects to a cellular antenna or tower, it reveals its embedded unique identifiers to the cellular antenna or tower, and the cellular antenna or tower records those identifiers as a matter of course. The unique identifiers—as transmitted from a cell phone to a cellular antenna or tower—are like the telephone number of an incoming call. They can be recorded by pen-trap 4 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 5 of 13 devices and indicate the identity of the cell phone device making the communication without revealing the communication’s content. 15. In addition, a list of incoming and outgoing telephone numbers is generated when a cell phone is used to make or receive calls, or to send or receive text messages (which may include photographs, videos, and other data). These telephone numbers can be recorded by pentrap devices and then used to identify the parties to a communication without revealing the communication’s contents. 16. A cell phone can also be used to exchange text messages with email accounts. The email addresses associated with those text messages can be recorded by pen-trap devices and then used to identify parties to a communication without revealing the communication’s contents. 17. Cellular phones can connect to the Internet via the cellular network. When connecting through the cellular network, Internet communications sent and received by the cellular phone each contain the same unique identifier that identifies cellular voice communications, such as an ESN, MEIN, MIN, SIM, IMSI, MSISDN, or IMEI. Internet communications from a cellular phone also contain the IP address associated with that cellular phone at the time of the communication. Each of these unique identifiers can be used to identify parties to a communication without revealing the communication’s contents. 18. WhatsApp is a software application, colloquially referred to as an “app,” that can be downloaded for use on a variety of types of mobile phones, including the iPhone, BlackBerry, and Android. Once downloaded, the application allows users to exchange data without incurring the fees associated with traditional SMS (Short Message Service) or text messaging, as the data is exchanged via the users’ internet data plans. Users type their messages, which are sent via 5 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 6 of 13 data service to WhatsApp servers and routed to the intended recipient (who must also be a WhatsApp user), if that recipient is online. If the recipient is not online, the undelivered message is held in WhatsApp’s server until it can be delivered. The application allows for the exchange of not only basic textual messages but also the exchange of images, video and audio media messages. The application also offers a “group chat” feature, which allows users to create a group of other users who can then communicate simultaneously within that group. The application also offers users the ability to submit other data associated with their account, such as a profile photo and information about their location in the form of “Status Submissions.” 19. The contents of messages that have been delivered by the WhatsApp service are not copied, kept, or archived by WhatsApp in the normal course of business. If the message is undelivered for thirty (30) days, the undelivered message is deleted from its servers. WhatsApp may retain date and time-stamp information associated with successfully delivered messages and the mobile phone numbers involved in the messages. However, WhatsApp has the ability to capture text messages themselves and information regarding the messaging with legal process. Specifically, WhatsApp has the ability to capture information pursuant to a pen register and trap and trace order. THE RELEVANT FACTS 20. The United States government, including the DEA, is investigating drug trafficking activities. The investigation had produced evidence indicated that an individual known as Oswaldo Contreras-Reyes, a/k/a “Cano,” is involved in the distribution of large quantities of controlled substances, including cocaine, and that he has made efforts to distribute controlled substances in New Hampshire and elsewhere. This investigation concerns possible violations of, inter alia, 21 U.S.C. §§ 846 and 841(a)(1). As part of the investigation, law 6 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 7 of 13 enforcement officers have learned that Contreras-Reyes is using the WhatsApp application on the telephone that is the subject of this request to communicate with other individuals about drug trafficking activities. 21. The conduct being investigated involves use of the WhatsApp application on telephone number 52 33 3724 5939. To further the investigation, investigators need to obtain the dialing, routing, addressing, and signaling information associated with communications sent via WhatsApp to or from that telephone number. Such information may help to identity coconspirators who are assisting Contreras-Reyes in his drug trafficking activities. 22. The pen-trap devices sought by this application will be installed at location(s) to be determined, and will collect dialing, routing, addressing, and signaling information associated with each communication sent via WhatsApp to or from telephone number 52 33 3724 5939, including the date, time, and duration of the communication, and the following, without geographic limit:  IP addresses associated with the cell phone device or devices used to send or receive electronic communications  Any unique identifiers associated with the cell phone device or devices used to make and receive communications with cell phone number 52 33 3724 5939, or to send or receive other electronic communications, including the ESN, MEIN, IMSI, IMEI, SIM, MSISDN, or MIN  IP addresses of any websites or other servers to which the cell phone device or devices connected  Source and destination telephone numbers and email addresses 7 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 8 of 13 GOVERNMENT REQUESTS 23. For the reasons stated above, the United States requests that the Court enter an Order authorizing the installation and use of pen-trap devices to record, decode, and/or capture the dialing, routing, addressing, and signaling information described above for each communication via WhatsApp to or from telephone number 52 33 3724 5939, along with the date, time, and duration of the communication, without geographic limit. The United States does not request and does not seek to obtain the contents of any communications, as defined in 18 U.S.C. § 2510(8). 24. The United States further requests that the Court authorize the foregoing installation and use for a period of sixty days, pursuant to 18 U.S.C. § 3123(c)(1). 25. The United States further requests, pursuant to 18 U.S.C. §§ 3123(b)(2) and 3124(a)-(b), that the Court order WhatsApp Inc. and any other person or entity providing wire or electronic communication service in the United States whose assistance may facilitate execution of this Order to furnish, upon service of the Order, information, facilities, and technical assistance necessary to install the pen-trap devices, including installation and operation of the pen-trap devices unobtrusively and with minimum disruption of normal service. Any entity providing such assistance shall be reasonably compensated by the DEA, pursuant to 18 U.S.C. § 3124(c), for reasonable expenses incurred in providing facilities and assistance in furtherance of this Order. 26. The United States further requests that the Court order WhatsApp Inc. and any other person or entity whose assistance may facilitate execution of this Order to notify the applicant and the DEA of any changes relating to the use of WhatsApp by cell phone number 52 8 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 9 of 13 33 3724 5939, including changes to subscriber information, and to provide prior notice to the applicant and the DEA before terminating or changing service to the cell phone number. 27. The United States further requests that the Court order that the DEA and the applicant have access to the information collected by the pen-trap devices as soon as practicable, twenty-four hours per day, or at such other times as may be acceptable to them, for the duration of the Order. 28. The United States further requests, pursuant to 18 U.S.C. § 3123(d)(2), that the Court order WhatsApp and any other person or entity whose assistance facilitates execution of this Order, and their agents and employees, not to disclose in any manner, directly or indirectly, by any action or inaction, the existence of this application and Order, the resulting pen-trap devices, or this investigation, except as necessary to effectuate the Order, unless and until authorized by this Court. 29. The United States further requests that this application and any resulting Order be sealed until otherwise ordered by the Court, pursuant to 18 U.S.C. § 3123(d)(1). 30. The United States further requests that the Clerk of the Court provide the United States Attorney’s Office with three certified copies of this application and Order, and provide copies of this Order to the Federal Bureau of Investigation and WhatsApp Inc. upon request. 9 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 10 of 13 31. The foregoing is based on information provided to me in my official capacity by agents or Task Force Officers of the DEA. I declare under penalty of perjury that the foregoing is true and correct. Executed on _________________. JOHN P. KACAVAS UNITED STATES ATTORNEY /s/ John J. Farley John J. Farley Assistant U.S. Attorney 53 Pleasant Street, 4th Floor Concord, NH 03301 10 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 11 of 13 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW HAMPSHIRE IN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER AUTHORIZING THE INSTALLATION AND USE OF PEN REGISTERS AND TRAP AND TRACE DEVICES ) ) ) ) ) ) ) ) No. Filed Under Seal ORDER John J. Farley, on behalf of the United States, has submitted an application pursuant to 18 U.S.C. §§ 3122 and 3123, requesting that the Court issue an Order authorizing the installation and use of pen registers and trap and trace devices (“pen-trap devices”) on the wire or electronic communications transmitted via WhatsApp Inc. (“WhatsApp”) over cellular telephone number 52 33 3724 5939, whose listed subscriber is not known, and which is believed to be used by Oswaldo Contreras-Reyes. The Court finds that an attorney for the government has submitted the application and has certified that the information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation being conducted by the Drug Enforcement Administration (“DEA”) of Oswaldo Contreras-Reyes in connection with possible violations of 21 U.S.C. §§ 846 and 841. IT IS THEREFORE ORDERED, pursuant to 18 U.S.C. § 3123, that the DEA may install and use within the United States pen-trap devices to record, decode, and/or capture dialing, routing, addressing, and signaling information associated with each communication sent via Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 12 of 13 WhatsApp to or from cellular telephone number 52 33 3724 5939, including the date, time, and duration of the communication, and the following, without geographic limit:  IP addresses associated with the cell phone device or devices used to send or receive electronic communications  Any unique identifiers associated with the cell phone device or devices used to make and receive calls with cell phone number 52 33 3724 5939, or to send or receive other electronic communications, including the ESN, MEIN, IMSI, IMEI, SIM, MSISDN, or MIN  IP addresses of any websites or other servers to which the cell phone device or devices connected  Source and destination telephone numbers and email addresses IT IS FURTHER ORDERED, pursuant to 18 U.S.C. § 3123(c)(1), that the use and installation of the foregoing is authorized for sixty days from the date of this Order; IT IS FURTHER ORDERED, pursuant to 18 U.S.C. §§ 3123(b)(2) and 3124(a)-(b), that WhatsApp and any other person or entity providing wire or electronic communication service in the United States whose assistance may, pursuant to 18 U.S.C. § 3123(a), facilitate the execution of this Order shall, upon service of this Order, furnish information, facilities, and technical assistance necessary to install the pen-trap devices, including installation and operation of the pen-trap devices unobtrusively and with minimum disruption of normal service; IT IS FURTHER ORDERED that the DEA reasonably compensate WhatsApp and any other person or entity whose assistance facilitates execution of this Order for reasonable expenses incurred in complying with this Order; 2 Case 1:14-mc-00021-AJ Document 1 Filed 06/13/14 Page 13 of 13 IT IS FURTHER ORDERED that WhatsApp and any other person or entity whose assistance may facilitate execution of this Order notify the applicant and the DEA of any changes relating to the use of WhatsApp by cell phone number 52 33 3724 5939, including changes to subscriber information, and to provide prior notice to the DEA before terminating or changing service to the cell phone number; IT IS FURTHER ORDERED that the DEA and the applicant have access to the information collected by the pen-trap devices as soon as practicable, twenty-four hours per day, or at such other times as may be acceptable to the DEA, for the duration of the Order; IT IS FURTHER ORDERED, pursuant to 18 U.S.C. § 3123(d)(2), that WhatsApp and any other person or entity whose assistance facilitates execution of this Order, and their agents and employees, shall not disclose in any manner, directly or indirectly, by any action or inaction, the existence of the application and this Order, the pen-trap devices, or the investigation to any person, except as necessary to effectuate this Order, unless and until otherwise ordered by the Court; IT IS FURTHER ORDERED that the Clerk of the Court shall provide the United States Attorney’s Office with three certified copies of this application and Order, and shall provide copies of this Order to the DEA and WhatsApp upon request; IT IS FURTHER ORDERED that the application and this Order are sealed until otherwise ordered by the Court, pursuant to 18 U.S.C. § 3123(d)(1). __________________ Date ____________________________ 3