A0 106 (Rev. 04l10) Application for a Search Warrant United States District Co . for the Western District of New York 2814 In the Matter of the Search of (Brie?y darting Lhepropergz to besearched or idme thepmon by name and address.) WhatsApp Messenger account's associated with the telephone 5? numbers 5853549614, +963967197623, and +967700780952. Case 65 APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property located in the Western Of New York (Edema? thepmon or desm'be thepropeny to be searched andgr?ve its location): WhatsApp Messenger accounts associated with the telephone numbers 5853549614, +963967197623, and +967700780952, as described in Attachment A. The person or property to be searched, described above, is believed to conceal (asses theperson property to banked): See Attachment B, Schedule of Items to be Seized, all of which are fruits, evidence and instrumentalities of violations of Title 18, United States Code, Sections 956, 2339A, 2339B, 1114, and 9240:), and Title 26, United States Code, Sections 5841, 5861(d), and 5871. The basis for search under Fed. R. Crirn. P. 41(c) is (check one or more): evidence of a crime; contraband, fruits of crime, or other items illegally possessed; property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. DQIZ-IZ The search is related to violations of: Title 18, United States Code, Sections 956 (conspiracy to murder or maim persons overseas), 2339A (providing, attempting and conspiring to provide, material support of terrorism), 2339B (providing, attempting and conspiring to provide, material support to a designated foreign terrorist organization), 1114 (attempted murder of federal of?cials and employees), and 924(c) (possession of ?rearm in furtherance of a crime of violence), and Title 26, United States Code, Sections 5841, 5861(d), and 5871 (receipt and possession of an unregistered ?rearm silencer). The application is based on these facts: See attached af?davit. 12] continued on the attached sheet. Delayed notice of days (give exact ending date if more than 30 days: is requested under 18 U.S.C. 3103a, the basis of which iythyon the aged sheet. ?ght/dams Signature I Special Ag?en lbert W. Zenner - name and ri?e Sworn to before me and signed in my presence. Date: August 2014 Judgeis Signature RABLE JONATHAN w. FELDMAN Uni States Magistrate Judge - .. .. . Printed name and Title City and state: Rochester. New York Case Document 1 Filed 08/06/14 Page 2 of 38 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANT State of New York County of Monroe SS: City of Rochester I, ALBERT W. ZENNER, being duly sworn, depose and state the following: I. INTRODUCTION AND AGENT BACKGROUND 1. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have served in this capacity for over 16 years. I am currently assigned to the Joint Terrorism Task Force Buffalo Division, in Rochester, New York. At the JTIF, I work with a team of federal, state, and local law enforcement agents and of?cers on investigations relating to domestic and international terrorism. During my tenure with the FBI I have also worked on a number of other types of investigations, including counterintelligence, white collar crime, public corruption, organized crime, and narcotics. Prior to my employment with the FBI, I worked as an attorney, and remain a licensed member of the bar. I am familiar with digital evidence commonly possessed and, used by those involved in criminal activities in all forms of media. I have also conferred with other FBI Special Agents who have expertise and experience in counterterrorism investigations and digital evidence. 2. I make this af?davit in support of an application under Rule 41 of the Federal Rules of Criminal Procedure for a search warrant for information associated with WhatsApp Messenger (hereinafter ?WhatsApp?) accounts associated with the following telephone numbers: (1) 5853549614; (2) +963967197623; and (3) +967700780952. 3. I am familiar with the facts contained in this af?davit based upon my personal involvement in this investigation, information provided by other law enforcement agents and of?cers, subpoenaed records from Facebook and Western Union, subpoenaed records from Case Document 1 Filed 08/06/14 Page 3 of 38 WhatsApp, information provided by two reliable con?dential human sources (hereinafter and consensual recordings of conversations between the con?dential human sources and MUFID A. information from public databases, and information provided by the United States Department of State. Because this af?davit is submitted for the limited purpose of obtaining a search warrant, I have not included each and every fact k110wn to me concerning this investigation. I have set forth facts that I believe are necessary to establish probable cause to search the above? referenced WhatsApp accounts. 4. Based on my training and experience, and the facts set forth in this af?davit, there is probable cause to believe that MUFID A. ELFGEEH a/ k/ a Abu Musa al-Faqih a/k/a Abu Musa al-Madhaji a/ k/ a Abu Musa al-Athjri a/k/ a Abu Musa al-Athari a/k/ a Abu Musa Athari al- Yemeni a/k/a Abu Musa a/k/a Abi Musa al-Madhaji a/k/a Abu Naje a/k/a Ali Saleh a/k/a Abumusa Almuslm a/k/a Abo Baqia a/k/a Mou Leeg a/k/a Abu Hamza, has COmmitted violations of 18 U.S.C. 956 (conspiracy to murder or maim persons overseas), 2339A (attempting and conspiring to provide material support of terrorism), 2-339B (attempting and conspiring to provide material support to a designated foreign terrorist organization), 1114 (attempted murder of federal of?cials and employees), and 924(c) (possession of ?rearms in furtherance of a crime of violence), and 26 U.S.C. 5841, 5861(d), and 5871 (receipt and possession of unregistered ?rearm silencers). There is also probable cause to search the information described in Attachment A for evidence of these crimes, and contraband or fruits of these crimes, as described in Attachment B. 1 All of the recorded conversations summarized in this af?davit were recorded with the consent of the con?dential human sources. All conversations between and ELFGEEH occurred in Arabic. I have reviewed the available verbatim and summary English translations of those conversations that were drafted by certi?ed FBI translators. The English translations are preliminary, not ?nal. -2- Case Document 1 Filed 08/06/14 Page 4 of 38 II. PROBABLE CAUSE WhatsApp 5. WhatsApp Messenger is an instant messaging subscription service for smartphones that uses the Internet for communication. It is a cross~p1atform mobile messaging application which allows a user to exchange messages Without having to pay service fees for use. WhatsApp is available for use on an iPhone, Blackberry, Android, Windows?based or Nokia telephone. WhatsApp does not use traditional cellular or wire communication lines for communications, but instead relies on Internet access for Communication. Users are required to subscribe to WhatsApp by using their mobile telephone number. The WhatsApp application allows its subscribers to communicate with other subscribers to the application or with subScribers to related third-party applications and websites using instant messaging. In addition to instant messaging, WhatsApp users can send each other unlimited images (photographs), video and audio media messages, engage in group chats, and send their 10Cation using integrated mapping features. 6. The contents of messages delivered by WhatsApp are not kept or archived by WhatsApp in the normal course of business. Users type their messages, which are sent via data service to WhatsApp servers, and routed to the intended recipient (who must also be a WhatsApp user), if that recipient is online. If the recipient is not online, the undelivered message is held in WhatsApp?s servers until it can be delivered. If the message is undelivered for 30 days, the undelivered message is deleted from WhatsApp?s servers. While WhatsApp does not keep records of the content of delivered messages, WhamApp may retain date and time stamp informatiOn associated with successfully delivered messages and the mobile telephone numbers involved in the messages . Case Document 1 Filed 08/06/14 Page 5 of 38 AH Qa?ida in a/k/a The Islamic State of Iraq and the Levant 7. In December 2004, the United States Department of State designated al-Qa?ida in Iraq (AQI) as a foreign terrorist organization under Section 219 of the Immigration and Nationality Act and as a ?specially designated global terrorist entity? under Executive Order 13224. In the 19905, Abu Mus?ab al-Zarqawi, a Jordanian-bom militant, organized a terrorist group called al- Tawhid wal?Jihad to oppose the presence of the United States and other Western military forces in the Islamic world, and the West?s support for and the existence of Israel. In late 2004, he joined a1? Qa?ida (AQ) and pledged allegiance to Usama Bin Laden. After this, al-Tawhid wal-Jihad beCame known as AQI. Zarqawi traveled to Iraq during Operation Iraqi Freedom and led his group against United States and Coalition Forces until his death in June 2006. In October 2006, AQI publicly renamed itself the Islamic State of Iraq (181). 8. On January 26, 2012, the 2004 designation of AQI as a foreign terrorist organization under Section 219 of the Immigration and Nationality Act was amended to include the name, Islamic State of Iraq (and any other possible transliterations of the name), as an alias of AOL Similarly, on December 11, 2012, the 2004 designation of AQI as a foreign terrorist organization under Section 219 of the Immigration and Nationality Act Was amended to include the aliases, al- Nusrah Front, abhat al-Nusrah, The Victory Front, and al?Nusrah Front for the People of the Levant. 9. As early as 2005, an individual known as Abu Bakr al-Baghdadi was identi?ed as a senior AQI leader. After the deaths of the top two AQI leaders in 2010, al-Baghdadi assumed leadership of AQI.2 Al-Baghdadi took credit for a series of terrorist attacks in Iraq since 2011, including operations against the Abu Ghraib prison outside Baghdad, a suicide bombing attack in 2 On October 7, 2011, the United States Department of State designated al?Baghdadi as a ?Specially Designated Global Terrorist.? -4- Case Document 1 Filed 08/06/14 Page 6 of 38 the IVIinistry of Justice, and other attacks against Iraqi Security Forces and Iraqi citizens. In or about April 2013, al-Baghdadi released a video statement in Arabic describing the history of AQI and announcing that the organization was changing its name to the Islamic State of Iraq and the Levant (ISIL), speci?cally stating ?We announce the abolition of both names, the Islamic State of Iraq and the aleNusrah Front, and we merge them under one name, the Islamic State of Iraq and the Levant.? ISIL is now based in Syria. 10. Since the designations of 151 and al?Nusrah Front in 2012, differences over management and tactics have led to an increase in violence between the two groups. In early 2014, the tension between the two groups peaked when al-Qa?ida leader, Ayman al-Zawahiri, released a statement dismissing ISIL from al-Qa?ida. 11. To re?ect the split between ISIL and al-Nusrah Front, on May 15, 2014, the 2004 designation of AQI as a foreign terrorist organization under Section 219 of the Immigration and Nationality Act was amended to include the name Islamic State of Iraq and the Levant (ISIL) 3 as its primary name and to remove all aliases associated with al?Nusrah Front. In addition, the State Department added the following aliases to the ISIL listing, the Islamic State of Iraq and al-Sham, the Islamic State of Iraq and Syria, ad?Dawla al-Islarniyya al-?Iraq wa?sh?Sham, Daesh, Dawla al Islamiya, and al-Furqan Establishment for Media Production. Throughout this af?davit, I will refer to the group as ISIL, except when it is a direct quote from ELFGEEH. 12. Since al?Baghdadi?s announcement of the name change, ISIL has claimed credit for a number of terrorist acts, including seizing Fallujah, a city in western Iraq, and rocket attacks in East Lebanon in March 2014. 3 The ?Levant? is a geographic area encompassing Syria, Lebanon, Palestine, and portions of Jordan. -5- Case Document 1 Filed 08/06/14 Page 7 of 38 Subject of the Investigation 13. MUFID A. ELFGEEH a/k/a Abu Musa al?Faqih a/k/a Abu Musa al?Madhaji a/k/a Abu Musa al-Athiri a/k/a Abu Musa al-Ath?ari a/k/a Abu Musa Athari al-Yemeni a/ k/ a Abu Musa a/k/a Abi Musa al-Madhaji a/k/a Abu Naje a/ k/ a Ali Saleh a/k/ a Abumusa Almuslrn a/k/ a Abo. Baqia a/k/a Mou Leeg a/k/a Abu Hamza, is a 30?year old Yemeni male. He is a naturalized United States citizen and, until May 31, 2014, resided at 1193 North Clinton AVenue, Rochester, New York. ELFGEEH owned and operated a store, Halal Mojo and Food Mart a/k/a Mojoe?s (hereinafter ?Mojoe?s?), at that location until May 31, 2014. Beginning in early 2013, and continuing until May 31, 2014, ELFGEEH expressed his support of various terrorist groups (including al-Qa?ida, al?Nusrah Front, and ISIL) and violent jihad.? As detailed, infra, this investigation has revealed that, consistent with his ideology, ELFGEEH sent funds Overseas to others associated with ISIL, attempted to recruit others in the Rochester area to travel to Syria to ?ght on behalf of ISIL, and plotted. to shoot and kill both members of the United States armed forces returning from Iraq and Shi?a Muslims in the Western District of New York. Twitter Posts 14. ELFGEEH, a frequent user of Twitter, maintained Twitter accounts under aliases, including Abu Musa al-Yamani@2866594 and Abu Musa ELFGEEH used Twitter to post and re-post tweets expressing support of various Errorist groups and violent jihad, 4 ?Jiha is an Arabic term meaning ?struggle,? referring to one?s struggle on behalf of Islam. In the context of these communications, and the other communications summarized in this af?davit, I understand ELFGEEH to be referring to a violent form of jihad associated with terrorist groups. 5 I have concluded that these Twitter accounts were used by ELFGEEH based on information from an FBI employee who had contact with ELFGEEH, the fact that the aliases for these accounts matched aliases also used by ELFGEEH for certain Facebook accounts, and subpoenaed records which showed that, as of November 2013, the most recent logins for both Twitter accounts were from the IP address 96.25 .125 .2, which was bound to a broadband device registered to ELFGEEH at 1193 North Clinton Avenue, Rochester, New York residence and place of business). -6- Case Document 1 Filed 08/06/14 Page 8 of 38 and seeking donations to assist jihadist ?ghters in Syria. For example, between approximately September 2013 and December 2013, ELFGEEH sent the following publicly viewable tWeets: a. In a series of tweets, ELFGEEH praised decisions by ISIL to prevent food, fuel and medicine from going into certain. areas in Syria. ELFGEEH also expressed support for al- Qa?ida and jihadists as the true Muslims, and advocated jihad and Additional tweets discussed the increasing number of ?ghters who are joining b. ELFGEEH posted two tweets saying that al-Qa?ida gets revenge for the Muslims of Burma and al-Qa?ida is our only savior; c. ELFGEEH re-posted a tweet stating that there are jihad opportunities against America and Hawthis6 in Yemen and the Levant region; d. ELFGEEH posted a tweet stating, ?al-Qa?ida said it loud and clear: we are ?ghting the American invasion and their hegemony7 over the earth and the people;? e. ELFGEEH posted several tweets with photographs and captions promoting Ansar al-Sharia (another al-Qa?ida-linked terrorist group), and stating that people will have an honorable life under Shari?a law, and that with grenades in their hands they are ready to die for the sake of Allah; f. In a series of tweets, ELFGEEH stated that money is the largest resource for jihadists and that the prophet Muhammad preached that people should ?ght the in?dels with their money, their bodies, and their words. ELFGEEH urged people to donate money as it is considered a type of jihad, and stated that money is the foundation of jihad because there will be no jihad if the jihadist does not have money with which to buy his weapons. One tweet stated that there is a speci?c weapon that jihadists want to purchase which costs $20,000, and the amount of money 6 ?Hawthis? (or ?Houthis? or ?Huthis?) are a Shi?a Muslim insurgent group operating in Yemen. Their opponents include al-Qa?ida. 7 ?He emon means domination, control, or su remac . -7- Case Document 1 Filed 08/06/14 Page 9 of 38 needed will be divided into four shares, with each share amounting to $5,000. Another tweet contained the hashtag, g. ELFGEEH reposted a tweet stating, ?Every Iraqi Sunni jihadist is de?ned as a terrorist in the international society; they don?t know that the State of Iraq and Sham will one day rule the world with the will of All h. ELFGEEH posted a tweet stating that ?@free_syria_army? and their group support Arnerica in waging a campaign against the State (ISIL) and against all those who Want to apply Shari?a/Allah?s law; i. ELFGEEH posted tweets telling eVeryone to donate a third of their salary to the jihadists in Syria and that ?@sHaFi_Ajmi, @Al_owaihan, and @hajjajalajr'ni? are the pe0p1e who will deliver the donations; and j. ELFGEEH posted tweets. asking for money donations, one of them stating that there is a campaign to collect $5,000 from each family to go to the jihadists in al-Shar'n (Syria). Con?dential Human SO'uIces 15. In early 2013, the FBI began using as part of its investigation of ELFGEEH. ?rst cooperated with the FBI in or about 2000, and ?rst reported information about ELFGEEH in or about early 2013. As of June 2014, the FBI has paid a total of approxirhately $21,700 in exchange for his cooperation in this investigation, as well as an unrelated matter in another distIict. continues to cooperate with the FBI in anticipation of receiving additional monetary compensation. Additionally, the FBI made an informal request to the Immigration and Customs Enforcement (ICE) liaison for visitor visas for ?ve of CS-l?s family members. ICE subsequently approved visitor visas for two of those family members, although it is not believed that the request in?uenced decision to grant those visas. The FBI, however, believes that may believe that he/ she has received this bene?t from the FBI. The FBI also obtained -3- Case Document 1 Filed 08/06/14 Page 10 of 38 Signi?cant Public Bene?t Parole status from ICE for three of CS-l?s family members who were not previously granted visas. is aware that the FBI facilitated the entry of these family members into the United States. 16. The information provided by has been corroborated by the JTTF through independent investigation, physical surveillance, public records, information provided by other law enforcement agencies, consensual recordings of conversations between and ELFGEEH, consensual recordings between CS-2 and ELFGEEH, and subpoenaed Western Union records. The information provided by has been found to be accurate and reliable. 17. CS-2 began cooperating with the FBI in or about November 2013. As of June 2014, the FBI has paid CS-2 a total of approximately $7,000 in exchange for his cooperation in this investigation. CS-2 has a prior felony conviction for Attempted Criminal Sale of a Controlled Substance 3? from Monroe County Court from 2003, for which he Was sentenced to one (1) year in jail, and a prior misdemeanor conviction for Criminal Possession of a Controlled Substance 7? from Rochester City Court from 2004. CS-2 continues to cooperate with the FBI in anticipation of receiving additional monetary compensation. 18. The information provided by has been corroborated by the JTTF through independent investigation, physical surveillance, public records, information provided by other law enforcement agencies, consensual recordings of conversations between CS-2 and ELFGEEH, and consensual recordings of conversations between and ELFGEEH. The information provided by CS-Z has been found to be accurate and reliable. Attemm to Send Yemeni Fighter to Join ISIL in Sun 19. Over the course of this investigation, ELFGEEH forcefully expressed his support for ISIL and its activities in Syria. For example, on November 20, 2013, ELFGBEH said that the only -9- Case Document 1 Filed 08/06/14 Page 11 of 38 honorable ?ghting forces in Syria are ISIL, al-Nusrah Front, al-Tawhid, and Ahrar al-Sham, noting that ISIL was larger than al-Nusrah Front. As detailed more fully below, on March 10, 2014, ELFGEEH discussed with the accomplishments achieved by ISIL on the Syrian battle?eld, noting that, despite its accomplishments, ISIL does not get much recognition. ELFGEEH also eXplained that the late Sheik Usama Bin Laden (the deceased leader of al-Qa?ida) said that ISIL is the only group who takes action based on truth without consideration for recognition. In addition, ELFGEEH expressed his desire to be a source of support for violent jihad. For example, on December 14, 2013, ELFGEEH stated that, if he could not sell his store, he would serve as an exporter or source of ?those who are fed up, this one wants to go to war and be jihadists.? 20. On February 12, 2014, ELFGEEH showed a photograph of a Yemeni male (hereinafter ?Yemeni Male that he described as someone who needed their support. ELFGEEH stated that Yemeni Male I needed $1,500. ELFGEEH stated that Yemeni Male 1 wants to join ?the State noting that ?the State is in need . . . of men and money.? ELFGEEH said that he would get $500 to send to Yemeni Male 1, and asked to ?nd one or two ?friends? to contribute money. ELFGEEH agreed to initiate a three-way communication (believed to be through Facebook) between ELFGEEH, and Yemeni Male 1. 21. On February 23, 2014, ELFGEEH told that he had sent $600 to Yemeni Male 1 yesterday. ELFGEEH also stated that he transferred the money in a name given to him by Yemeni Male 1. Western Union records show that ELFGEEH sent $600 to an individual in Aden, Yemen, on February 22, 2014, and that there were no other money transfers in the name of ELFGEEH on that date.8 3 It should be noted that ELFGEEH told the name to which he sent the money. The name ELFGEEH told to (384 was different than the name appearing in the Western Union records. Nonetheless, based on the similarity in the names, the timing of the money transfer, and the fact that there were no other money - 10 - Case Document 1 Filed 08/06/14 Page 12 of 38 22. On February 26, 2014, ELFGEEH told that Yemeni Male 1 is with ISIL. ELFGEEH said that he told Yemeni Male 1 to either go to Syria to ?ght with ISIL or to stay in Yemen to ?ght with a group in his area. ELFGEEH advised that he is waiting for Yemeni Male 1 to obtain his travel documents in Yemen and notify ELFGEEH before sending Yemeni Male 1 more money. 23. On March 10, 2014, ELFGEEH advised that he asked one of his friends in Sana?a (Yemen) to contact Yemeni Male 1. ELFGEEH said that Yemeni Male 1 was unsuccessful in getting his visa to Turkey. 24. On March 22, 2014, C84 recounted to ELFGEEH a Facebook conversation he had with Yemeni Male 1. During the Facebook exchange, Yemeni Male 1 told CS-1 that ?as soon as . . . they accept [him] at the university, [he] will leave [his] mother in Sana?a [Yemen] and [he] will continue on his way.?9 After their Facebook exchange, Yemeni Male 1 sent another message to CS- asking if understood what he meant when he referred to being ?accepted at the university.? replied that he did understand. CS-1 states that he understood the phrase about being ?accepted to the university? to mean that Yemeni Male 1 was waiting to have his travel documents approved in order to gain entry to Turkey for the purpose of ultimately entering Syria to join ISIL. Attemm to Send and to Fight For ISIL in sun 25. In 2013, ELFGEEH encouraged CS-2 to travel overseas to engage in violent jihad. CS-2 reported that, prior to cooperating with the government, ELFGEEH attempted to persuade to leave the United States and ?ght in con?icts in Syria, Yemen, and Somalia. CS-2 also reported that, at that time, ELFGEEH intended to travel with C82, and ELFGEEH speci?cally transfers in the name of ELFGEEH on that date, I believe that the money that was transferred was the money that ELFGEEH intended to send to Yemeni Male 1. 9 With the consent of the FBI viewed the Facebook exchange between and Yemeni Male 1. -11- Case Document 1 Filed 08/06/14 Page 13 of 38 mentioned two al-Qa?ida?af?liated groups Ansar al?Sharia (based in Yemen) and al-Shabaab (based in Somalia) as groups they could join. After began cooperating covertly with the government, ELFGEEH continued to encourage him to engage in violent jihad overseas. 26. Similarly, in or about December 2013, ELFGEEH began encouraging to travel overseas and engage in violent jihad. On December 18, 2013, ELFGEEH told to take CSul?s family on a jihadist expedition. When expressed reluctance to leave CS-l?s family behind, ELFGEEH gave examples of families participating in jihadist expeditions. ELFGEEH mentioned a Saudi woman who left her children behind and went to the war for jihad, and many other Saudi women who went along with their children for the war for jihad in Yemen. On December 31, 2013, ELFGEEH and discussed CS-l?s planned travel to Syria to engage in jihad. ELFGEEH Suggested that ?3 family travel to Jordan and then travel to Turkey, and then should separate from them and remain in Turkey while family returns to Jordan. stated that needed someone who is trustworthy as a contact in Syria. ELFGEEH responded, will look for someone you can trust. There are trustworthy people . . . someone in Jabhat al~Nusrah who I told you is from our homeland. He is one . . When asked for details on what would happen after arrived in Turkey, ELFGEEH responded that he did not know all of the details, bUt that would arrive in Turkey and ?that?s it.? 28. On January 25, 2014, ELFGEEH stated that, when the time comes fOr CS-I to travel to Syria, ELFGEEH can call a Yemeni brother, someone he has known" on Facebook for about a year, and ELFGEEH can consult with the Yemeni brother about where should go. 29. On March 10, 2014, ELFGEEH told that ISIL carried out a bombing in I Aleppo (Syria) that killed 500 people. He explained that they dug tunnels and placed explosives, noting that ISIL is using this method to save on ammunition. ELFGEEH said that ISIL is the only -12- Case Document 1 Filed 08/06/14 Page 14 of 38 organization that does not beg for money from anyone. ELFGEEH discussed the accomplishments achieved by ISIL on the Syrian battle?eld, noting that, despite their accomplishments, ISIL does not get much recognition. ELFGEEH explained that the late Sheik Usama Bin Laden (the deceased leader of al-Qa?ida) said that ISIL is the only group which takes action based on truth withOut consideration fer recognition. 30. On March 22, 2014, ELFGEEH, using a white iPhone, showed his list of Facebook friends. ELFGEEH described several individuals from Yemen and an individual known as Abu Qays, who ELFGEEH described as a military leader of the Green Battalion in Horns, Syria. ELFGEEH said that the Green Battalion used to be af?liated with al?Nusrah Front, but they separated from them. ELFGEEH further stated, are coordinating with them [the Green Battalion] on the grounds that they want to pledge allegiance to the State and they would like I for the State to support them with ammunition and weapons.? 31. On March 29, 2014, asked if had any intention of traveling. 1:10 responded that ?project is a little different, noting that has a family so it is not easy for CS-2 to leave. At that time, ELFGEEH said that would travel only if ELFGEEH traveled with CS-Z. 32. On April 8, 2014, told ELFGEEH that he had decided to make a reservation and travel by June 1. ELFGEEH responded by stating that he was supportive and he wanted to help. said that needed ELFGEEH to help him make contacts and arrange for people to meet him at the airport. went on to state that he was planning to arrange his travel from the United States to Istanbul (Turkey) to Amman (Jordan). continued by stating that he would . arrive in Istanbul and then ?proceed to the inside,? meaning Syria. ELFGEEH responded by ?0 I believe this was a reference to a separate plot to kill members of the United States armed forces returning from Iraq, which is detailed, infra. -13- Case Document 1 Filed 08/06/14 Page 15 of 38 saying, am going to do that [for you] without a doubt. I am going to search it without a doubt.? stated that he wanted to ?go to the university? [meaning and ELFGEEH responded ?the application to be ready.? ELFGEEH stated that he had contact with the commander of al-Khadra battalion ?or something? (referring to Abu Quays) on Facebook because ELFGEEH wanted to coordinate with someone for pledging allegiance and sending them funds because they were cut off from support. ELFGEEH stated that he (ELFGEEH) had a Facebook account and would send it to 33. On April 10, 2014, only two days after announced his intention to travel to Syria, told CS-2 that there was someone who was leaving here and going to Syria. CS-2 asked ELFGEEH if CS-Z would join abhat al-Nusrah. ELFGEEH responded that CS-Z Would join ?Dawla? (meaning ELFGEEH also told CS-Z that it was job to try to build a link to someone that CS-Z could contact in Syria. (IS-2 noted that he would have to get a passport, and ELFGEEH responded that CS-Z could go to Buffalo and get the passport in just one day. 34. On April 15, 2014, ELFGEEH told that he had contacted an individual from Chechnya who was born in Syria. ELFGEEH further stated that the Chechen ?is from those who pledged the allegiance to the State According to ELFGEEH, the Chechen told him that after-they (meaning and CS-Z) reach Turkey, they would ?y from the capital to another city close to the border with Syria and ?from there all the way.? ELFGEEH and discussed the anticipated departure date of June 1. described to ELFGEEH his experience operating heavy machinery and his weapons training as a soldier in the Jordanian army. ELFGEEH said that when goes ?there? (Syria), and tells these stories, they (ISIL) can place him in a trainer position and, ?1 Based on the fact that ISDL is also referred to as ad-Dawla al-Islamiyya al-?Iraq wa-sh-Sham and Dawla a1 Islamiya 1] 11, supra), I believe that ELFGEEH was referring to ISIL when he told CS-2 that CS-2 would be joining ?Dawla.? -14- Case Document 1 Filed 08/06/14 Page 16 of 38 after a while, a cadre12 position. ELFGEEH noted that a cadre position means that the person understands the politics of the war. 35. On April 19, 2014, ELF GEEH sent a text message, consisting of a link to a YouTube video, to CS-Z. The video started with a reading of a verse from the Qur?an and display of the ?ag commonly used by ISIL. The video then showed ISIL militants in combat shooting and a gathering of militants. An unidenti?ed male (UM-1) carrying a Saudi Arabian passport criticized the people who induce sedition between Muslims and divide the Muslim world, and plant tyrant leaders to ?ght the religion of God and the Muslims. Ul?vI-l indicated that, at this gathering in Syria, they Were burning the pas?sports that create separation between brothers for political reasons, to build One Islamic state from the east to the west under the law of God. praised ISIL saying ?long live to the Islamic State.? Another unidenti?ed male carrying a Jordanian passport indicated that this is a passport of the slave of the English (King Abdullah II) and asked the people of Jordan to join ISIL. UM-Z swore that ?they will come and kill the king and every elements of the civil and military intelligence and bring tons of (explosive cars) to the kingdom.? then tore up the Jordanian passport and burned it. Another unidenti?ed male (UM-3) said in English, ?this is a message to Canada and to all tyrant in America, we are coming and we will destroy you in God?s will. I made Hijrat14 to Islam. for one reason alone; for Allah, and after Sham?Syria- and Iraq and Saudi we are going for you Barack Obama, we are coming to kill you . . Other unidenti?ed militants were shown burning Egyptian, Russian and Saudi Arabian passports. The video then showed ISIL attacking a police barracks in Saleh al din province in Iraq, with a heavy ?re ?ght showing the killing of the police live on video. 12 A ?cadre? is a group of of?cers around whom a unit is formed, or a training staff. 13 I believe this is a reference to Vehicle Borne Improvised Explosive Devices (VBIED). 1? ?Hijrat? (also ?hijra?) is the migration or journey of the Islamic prophet Muhammad and his followers from Mecca to Medina. -15- Case Document 1 Filed 08/06/14 Page 17 of 38 36. On April 21, 2014, at the direction of ELFGEEH, purchased a copy of his birth certi?cate for $30 from the Monroe County Vital Records Of?ce, 111 Westfall Road, Rochester, New York. 37. Later on April 21, 2014, ELFGEEH and CS-2 went to a local Rite Aid store to get passport photographs taken. ELFGEEH paid CS-2 $30 for the copy of the birth certi?cate that bought earlier that day, and paid for passport photographs. ELFGEEH told that he is going to either go with and CS-2 to Syria or go ?a couple of months after.? When CS-2 wondered how he was supposed to trust that the contact arranged by ELFGEEH was truly ?'om ISIL, ELFGEEH stated that he would put CS-2 in contact with an individual from Chechnya who grew up in Syria. ELFGEEH expected the Chechen contact to let him know that night. ELFGEEH also stated that the Chechen was just one contact and ELFGEEH had others, including one in Yemen who trusts ELFGEEH. ELFGEEH also described the process for CS-Z to travel to Syria to join ISIL, noting that CS-2 and would ?rst be sent to a house where they would be educated for two or three months. During that time, the group asseSses you and determines who is a spy and who is not. ELFGEEH stated that the process is conducted by individuals formerly associated with the Iraqi version of the CIA. ELFGEEH agreed to put CS-2 in contact with an English?speaking individual over Facebook. ELFGEEH said that he would tell his contact that CS- 2 wants to speak with someone ?om ?Dawla to tell him ?how things are over there,? and his contact would give ELFGEEH someone to speak with over Facebook. 38. On April 22, 2014, ELFGEEH, using the Facebook user name ?Mou Leeg,?15 Facebook User ID 100008149782764, posted the following message on his Facebook pro?le: ?Brothers in al?Dawla Whoever knows a brother from ISIS who is able to ?5 received a friend request from this account on or about April 18, 2014. accepted the friend request and later con?rmed for the investigative team that this account is in fact used by ELFGEEH. -16- Case Document 1 Filed 08/06/14 Page 18 of 38 communicate well in English, can communicate with me through the private, due to the importance.? On April 24, 2014, ELFGEEH, using Facebook, provided CS-2 with a link to a Facebook account for an individual located in Iraq.16 39. C82 exchanged a series of messages over Facebook with the individual in Iraq in late April 2014. In the course of these messages, they discussed having CS-2 travel to Syria via Turkey. 40. On April 22, 2014, ELFGEEH and CS-2 traveled to Buffalo, New York, to obtain a passport for CS-2. During the trip, CS-2 asked ELFGEEH what ELFGEEH thinks they (ISIL) would have him do over there (Syria). ELFGEEH responded that, in light of patience, he thought they would use CS2 to operate a cannon, act as a sniper and/ or build bombs. ELFGEEH said that they (ISIL) would teach CS-2 how to build a bomb. CS-2 thereafter submitted his application for a passport at the Buffalo Passport Agency, 111 Genesee Street, Buffalo, New York. ELFGEEH paid over $200 toward the fee for passport (a total $209.85), which included a fee for overnight delivery. CS-2 received the passport on April 25, 2014. 41. On April 27, 2014, ELFGEEH met with and CS-2 at a location in Rochester, New York. 17 During the meeting, they discussed the planned travel to Syria. When inquired about the identity of their contact, ELFGEEH con?rmed that he had already given one contact to CS-2 and said that Yemeni Male 1 has ?a couple . . . brothers they gonna contact.? ELFGEEH Stated that he told Yemeni Male 1 that they need someone to contact, that Yemeni Male?l would put him in contact with people, and that ELFGEEH would contact those people. ELFGEEH told 16 ELFGEEH sent the link along with the Facebook pro?le picture of the individual located in Iraq, which picture depicts an individual wearing a ski mask and what appears to be a ?ak jacket, and holding an assault rifle. 17 Neither nor CS-2 knew, at that time, that the other is cooperating with the FBI. -17- Case Document 1 Filed 08/06/14 Page 19 of 38 (38-1 and CS-2 that they needed to have cover stories that matched (such as where they are going, why they are going, and how long they are staying). ELFGEEH also said that when and CS-2 arrive at the ?welcoming camp? they would receive ?education, training a little bit, good food.? ELFGEEH further stated that they (ISIL) would ?get to know? and CS2, ?then they know . . who?s been around masjids [mosques] a lot and who is good and who is not . . . and they will know who?s spy.? As they continued talking about the vetting process, ELFGEEH stated, ?especially the Dawla They gonna make sure. Because they never get screwed before.? ELFGEEH said that, when and CS-2 get to Syria, they should cancel their current Facebook accounts and set up two or three new accounts. 42. On April 27, 2014, at approximately 8:52 pm, ELFGEEH posted a video on Facebook page. The video called for Muslims around the world to make "hijra" and assist ISIL in whatever capacity they could. The speaker in the video indicates that joining in armed con?ict was the first preference, but they (ISIL) would welcome any type of support. 43. In May 2014, purchased a commercial airline ticket for to travel to Istanbul, Turkey, on June 2, 2014. did not actually purchase a ticket for himself, but represented to ELFGEEH that he had a ticket for the same ?ight. 44. On May 12, 2014, ELFGEEH discussed with a contact telephone number for a Jordanian male in Syria. ELFGEEH gave a piece of paper bearing the telephone number, 001963967197623.18 An online search by the FBI con?rmed that the pre?x of the telephone number a 963 -- is the country code for Syria. subsequently tried to contact this number, but was unsuccessful. ELFGEEH stated that he was in a group communication with the Jordanian male and that they later talked ?in private.? ELFGEEH also stated that he communicates with the 1? The FBI obtained the piece of paper containing the telephone number from -13- Case Document 1 Filed 08/06/14 Page 20 of 38 Jordanian male through WhatsApp. ELFGEEH read to the WhatsApp communications from the Jordanian male, and showed them to ELFGEEH referred to one communication where the Jordanian male said, ?we are longing for you,? which ELFGEEH stated meant ?the men in al? Dawla your brothers in the Islamic State love you in the name of Allah?? ELFGEEH said that he had been ?trying to coordinate things so that we have leads/ threads in our hands,? meaning that ELFGEEH was trying to coordinate ISIL contacts in Syria for and ELFGEEH asked if had Skype. After responded in the af?rmative, ELFGEEH gave instructions on how to make the call through Skype. ELFGEEH told to Use code -w by referring to and CS-2 as ?university students?20 when speaking with the ordanian male. 45. On May 17, 2014, told ELFGEEH that he could not get through to the Jordanian male at the number provided by ELFGEEH (001963967197623). In. CS-l?s presence, ELFGEEH Sent a message via WhatsApp to the Jordanian male with CS?l?s telephone, stating that wanted to go to the college/ university, which is a coded reference to traveling to Syria to join ISIL. read the actual message sent by ELFGEEH, and ELFGEEH read the message to as. well. ELFGEEH stated that he does not know the Jordanian male personally, but he knows that the Jordanian male is reliable and is with ISIL. ELFGEEH loaded the Jordanian male?s number into telephone and indicated that he would let the Jordanian male initiate the contact. also obtained WhatsApp number, which is 5853549614 (which is the number for Apple iPhone). 46. On May 22, 2014, received a message over WhatsApp from the telephone number provided by ELFGEEH for the Jordanian male, 001963967197623. The pro?le picture ?9 It should be noted that ELFGEEH stated that he deleted some of the WhatsApp messages with the Jordanian male. 2? This code is consistent with the code used by Yemeni Male 1 when communicating with over Facebook, as detailed in 24, sup_ra). -19- Case Document 1 Filed 08/06/14 Page 21 of 38 associated with the telephone number was a black flag with white writing, which appears to be the ?ag for ISIL. In the message, the sender included greetings and asked how was doing. 47. In the evening on May 23, 2014, met with ELFGEEH at Mojoe?s. During the meeting, ELFGEEH confirmed that the WhatsApp message sent to on the previous day was from the Jordanian male. ELFGEEH reaf?rmed that the Jordanian male is from ISIL and that he is located in eastern Ghota (Syria). ELFGEEH also showed, and read to a series of WhatsApp messages on a white iPhone between ELFGEEH and the Jordanian male. The JOrdanian male asked about the names of the ?university students? (which is a coded reference to and CS2), and noted that he had communicated with a brother there and the route is easy. In this conversation, ELFGEEH also described a Yemeni male, who is trustworthy and ?is 100% ISIS and was seeking funds to send two brothers on a jihadist expedition. 48. On May 28, 2014, met with ELFGEEH at MojOe?s. During the meeting, ELFGEEH gave the telephone nUmber for a Yemeni male (hereinafter ?Yemeni Male who is believed to be the same individual referred to by ELFGEEH in the conversation summarized in 1] 47, m. The telephone number provided by ELFGEEH was 0119677007 80952. The pre?x of the telephone number 967 -- corresponded to the country code for Yemen. ELFGEEH told that Yemeni Male 2 would serve as CS-l?s and contact for their travel to Syria. ELFGEEH read a series of WhatsApp messages received on his white iPhone from Yemeni Male 2. In those messages, Yemeni Male 2 said that and C82 should ?rst go to Istanbul (Turkey) and then take a ?ight to Gaziantep (Turkey). 2? Yemeni Male 2 told ELFGEEH to have and C82 contact him (Yemeni Male 2) at the provided telephone number once they arrive in Gaziantep. Yemeni Male 2 further stated that, during their travel, and CS-2 would stay in a guesthouse and pass all tests until they get ?their? (meaning ISIL) approval. ELFGEEH noted that Yemeni Male 2 wants 21 Gaziantep, Turkey is a city in southeast Turkey located near the northern border of Syria. -20- Case Document 1 Filed 08/06/14 Page 22 of 38 and CS-Z to be security conscious when communicating with him. At One point during the meeting, ELFGEEH and went upstairs to apartment at 1193 North Clinton Avenue. While there, ELFGEEH gave a high de?nition action camera for the trip to Syria, noting that ?the youth? (meaning jihadists) will use it in Syria, and may use it during an operation to record the action. Plot to Kill United States Soldiers Returning from Iraq and Shi?a Muslims 49. On December 9, 2013, ELFGEEH discussed with the attack on a mall in Kenya by al?Shabaab (an al-Qa?ida?a?iliated terrorist group operating in Somalia). ELFGEEH said that, ?Kenya is killing everybody in Somalia. They killing children, women, everyone . . . Anybody.? ELFGEEH continued, ?They [Kenya] go in there killing everybody, just like the American [sic] went into Iraq killing everybody. Just like . . . the Americans surrounding Iraq, everybody, it?s like they go to Afghanistan killing everybody. It?s like they went to Yemen now killing everybody. Doesn?t make no difference.? ELFGEEH said, ?me, myself, I?m thinking about doing something here to be honest with you . . . I?m thinking about just go buy a big automatic gun from off the street or something and a lot of bullets and just put on a vest [meaning bulletproof vest]: or whatever and just go around and start shooting.? stated, ?you already got a bulletproof vest.? ELFGEEH responded, ?yeah.?22 50. On December 11, 2013, ELFGEEH told CS-2, ?[w]hat I think is if we somehow ?nd a budget and we could just to make this thing serious . . . We start doing small things like this brother used to do . . . in French. He used to go after, you know, people. You used to be in the 22 It should be noted that the FBI executed search warrants at business (Mojoe?s) and residence, and on vehicle on May 31, 2014. They did not recover a bulletproof vest during those searches. -21- Case Document 1 Filed 08/06/14 Page 23 of 38 army and hunt them down and he used to do it by himself and he got killed by . . . cops.?23 ELFGEEH noted that ?it?s easy to . . . give the location of who?s in Iraq and who comes back. I know a couple of them that come here regular and they?re proud to be in there . . . they still proud of what they?re doing, you lmow, what they?ve done [unintelligible]. Now will give you satisfaction ?rom what you?re doing.? In response to statement ?when you?re doing something crazy and you?re probably going to be killed or it?s gonna be something that you can?t go back to your home or business or something,? ELF GEEH stated, ?you just gotta ?nd a way to do it, you know? I can snipe, you could buy a sniper.? 51. On February 5, 2014, ELFGEEH told CS-2 that he needed a handgun with a device to ?take the volume away.? CS-2 responded, the silencer, the silencer.? ELFGEEH then said, ?Yup.? ELFGEEH indicated that he wanted a handgun for which ?you could ?nd bullets everywhere,? and emphasized that he needed the handgun and silencer together. 52. On March 3, 2014, ELFGEEH told CS-2 that he was. ?looking for a baby meaning a small 9 millimeter handgun. ELFGEEH said, ?some small and nice, Glock, you know, gonna do some damage, you know.? ELFGEEH further stated that he wanted the handgun to be ?clean,? meaning that it had not been previously used to commit another murder. ELFGEEH told CS-2 that he wanted to know the price for the handgun with and without the silencer. With regard to the plot, ELFGEEH said, gonna take our time . . . So, I know 100 percent what I?m gonna do, you lmow . . . I?m gonna do, you know, a few things with it.? ELFGEEH continued and asked CS-2 to inquire about prices for hand grenades, the type that one could throw at someone as you are 2" Based on this description, and other statements by ELFGEEH summarized in this af?davit, I believe ELFGEEH was referring to a series of three shootings by a 23?year-old French-Algerian man named Mohammed Merah, who targeted French soldiers and Jewish civilians in France in March 2012. During a shooting spree on March 11 and 15, 2012, Merah killed a French paratrooper and two uniformed soldiers, and seriously injured another uniformed soldier. In addition, Merah killed four people (including three children) at a Jewish day school. Merah was shot and killed during a 30-hour siege with the police. -22- Case Document 1 Filed 08/06/14 Page 24 of 38 driving a car. When CS-2 asked if they were going to target members of the Army (including one of customers), ELFGEEH responded, ?we gonna ?sh around for whatever that we [unintelligible] . . . We gonna ?sh. [unintelligible] Then we gonna work our way ?rom there. Cause more, some things, you don?t even tell nobody anything.? ELFGEEH continued, ?even if we do 20 or 30 people slowly . . . So we just gonna focus about things that are gonna really'work.? 53. On March 10, 2014, ELFGEEH recounted to a conversation he had with a Somali male. The Somali male told ELFGEEH about a conversation he had with a former member of the United States military (who he referred to as the ?Army marines?), during which the Somali male told the former military member, ?you see what we did . . . to the American marines when they came.? The former military member apparently responded, ?[y]ou should see what we did in Iraq and Afghanistan.? ELFGEEH told that he told the Somali male that, if he killed the former military member, he (the Somali male) would ?get a reward [from God].? ELFGEEH stated that, while some people who ?claim to be scholars? say that ?these people [meaning United States military members} are now in peace, etc, and not to kill a child and so on and it is a lie.? ELFGEEH said, ?in fact it is kill them as they kill you . . . ?ght them all together as they ?ght you all together.? ELFGEEH continued, ?They go and kill women and children, etc., and if we are a state or any army or so, at that. time we have to differentiate, at that time we are obligated and don?t have to think, but if we were a gang, I mean, you want to terro?ze them . . . you want to stop the killing machine that is happening there, you understand, and the only way is to deter them by any means.? ELFGEEH stated that he told the Somali male, ?if you kill him in the cause of Allah then you have defended our sanctities and avenged their blood.? -23- Case Document 1 Filed 08/06/14 Page 25 of 38 54. On March 19, 2014, (ZS-2 showed ELFGEEH a photograph of a handgun and silencer that his ?source? was willing to sell to them.? CS-2 told ELFGEEH that the brand of the handgun was CS-2 also quoted ELFGEEH a price of $600 for the handgun and silencer. ELFGEEH asked CS-2 questions about how effective the silencer would be in suppressing the soUnd of the handgun ?ring. Later in the conversation, ELFGEEH stated, don?t have . . . no plan whatsoever, all in my head. It?s all in my head,? noting that the handgun was for his ?personal use . . . to take care of some things.? ELFGEEH indicated that the timeframe for the plot would not ?be right away,? but stated that ?when we ready for future reference, we gonna go a bit, little bit more bigger [unintelligible] we gonna buy some more stuff from this guy [meaning gun supplier], and probably we gonna need like big ones with the same quiet [meaning silencer], you know, but they have to be big ones [unintelligible ELFGEEH continued, ?we gonna try to do as much as we could before we could get, get captured.? ELFGEEH said that getting the handgun and silencer ?is gonna be a big step, getting it in the ?rst place.? When CS-2 asked if they were going to release a video message after the shooting(s), ELFGEEH responded, ?[o]nce we do ?ve or ten already, 15, something like that . . . then we gonna say something,? noting that they would ?post something.? After CS-2 asked about the timeframe for the shootings, ELFGEEH responded, ?most of the things I?m gonna do ?em by myself. And, you know, hopefully in the right time.? ELFGEEH continued, ?[e]ven if we do 15, 20 something and then we leave, and we go take a nice video and just [laughing], you known such and such was us.? ELFGEEH then stated, ?most of it is going to be a quicky thing. You know, it?s like, ah, kid in French?? 2? The photograph, which depicted a Walther PPK .32 caliber handgun with a silencer af?xed to the barrel, was provided by the FBI. 25 As detailed supra, I believe this is a reference to a French-Algerian individual named Mohammed Merah, who shot and killed three French military members, and seriously injured a fourth, during shootings in France in March 2012. -24- Case Document 1 Filed 08/06/14 Page 26 of 38 55. On March 30, 2014, told ELFGEEH that the handgun was a 9 millimeter, and reiterated that the model was PPK. CS-Z asked ELFGEEH whether he needed the handgun for a personal issue or for ?sabilillahf? noting that he would feel comfortable only if it was fisabilillah. ELFGEEH responded, ?the main thing is that [meaning ?sabilillah], and the only thing is that, I?m just gonna also keep it, ah, around for other reasons and stuff that I said.? ELFGEEH then said that the gun would ?be around? the store and that he would have to get a permit because if the police pulled him over they would know he was ?clean.? ELFGEEH stated the ?main thing is right now, is we don?t have nothing, so we have to have something, and silencer is the easy thing like, it could be right now in the day time, and I could be . . . like this guy here or something . . I could just go back and Wait for him to when he leave to go to his garage, and just walk up slowly, boom, boom, boom, inside his garage.? When asked how they would know if the victim was a soldier, ELFGEEH stated, ?this is easy to ?nd out. It?s not hard . . . we could go online or something and they tell you names . . . this is official thing.? ELFGEEH also stated, ?why I said it?s for purpose because, or ah, personal or something, because, it?s the thing that I need, to know you know, get it right away, um, there is some, you know, now we have war with Shi?a and others, you know, at the same time, and they all . . . kuffar27 you know, so, you know, just I just gotta do, I?m gonna do my deed. Hits left and right [meaning multiple killings], you know.? CS-2 asked ELFGEEH about the ?guy in France? that ELFGEEH had referenced in prior conversations. ELFGEEH responded, in YouTube. Young boy . . . he made news man, he killed about four soldiers . . . he was just young and doing it by himself. He got caught.? 28 ELFGEEH said that the French male got caught 2? ?Fisabilillah? (or ?feesabilillah?) is an Arabic expression meaning ?in the cause of Allah.? 27 ?Kuffar? means in?del or non-Muslim. 2? As detailed supra, I believe this is a reference to a French?Algerian individual named Mohammed Merah, who shot and killed three French military members, and seriously injured a fourth, during shootings in France in March 2012. I should note that ELFGEEH stated that he believed the perpetrator was from Morocco, while Merah was actually Algerian. -25- Case Document 1 Filed 08/06/14 Page 27 of 38 because he did one or two of the shootings on camera, and he was killed when he got caught. When CS-2 stated that they should learn from the French male?s mistakes and avoid the cameras, ELFGEEH responded, ?Yeah.? ELFGEEH stated that $600 for the 9 millimeter handgun was a ?good price.? ELFGEEH asked CS-2 to tell the source to bring ?two, three boxes or more? of 9 millimeter ammunition, noting that don?t wanna have to go round looking for nothin?.? 56. On April 4, 2014, ELFGEEH told CS-Z to ?tell him to bring it,? meaning tell the source to, transport the handgun and silencer to Rochester. CS-Z asked ELFGEEH for proof that ?taking out a soldier 0n the disbelievers? land? is justi?ed. ELFGEEH indicated that he did not have suf?cient time to answer the question, and that it would take more time to provide the material to C84. 57. On April 10, 2014, CS-Z reminded ELFGEEH that he was ?asking for more proof? regarding the justi?cation for the plot. ELFGEEH con?rmed, ?evidence . . . about the subject that we was talkin?, planning.? (IS-2 told ELFGEEH that he would really like ELFGEEH to give him somebody who has ?given like fatwa from it, either from, that I could see even like YouTube and see.?29 ELFGEEH responded, ?there is a YouTube that says all . . . tell you what to do, don?t do this, don?t do that, don?t do this, do this, it tells you everything before that and then it tells you that . . . it?s YouTube . . . they call them here . . . ?individual wolf.?30 ELFGEEH also inquired if there was ?anything new? about the handgun. responded that his source planned to take a trip to at the end of the month (April). ELFGEEH responded, probably where the stash is.? ?9 It should be noted that ELFGEEH did not provide the requested proof or justi?cation to 3? I believe this is a reference to a ?lone wolf? or ?lone mujahid? terrorist. A ?lone wolf" terrorist is someone who commits acts of violence in support of a group, movement or ideology, but who does so alone, outside of any command structure and without material assistance from any group. -26- Case Document 1 Filed 08/06/14 Page 28 of 38 58. On April 20, 2014, ELFGEEH told C571 that he (ELFGEEH) was purchasing a PPK 9 millimeter handgun equipped with a silencer for $600. ELFGEEH told got it [meaning the handgun and silencer] in order, uh, between me and you; we wanted to start shooting those who were in the Army who went to Iraq . . . I mean there were people coming to me, they are known, we wanted to begin with them instead of sitting doing nothing, one begins to try, you understand, and see how far he reaches with them.? ELFGEEH also stated that ?there is someone from our homeland in Yemen who was my friend . . . his brothers and nephews are ?ghting with al? Huthi against Sunnis in Yemen, you understand, and they do it with his consent and support and he is the one who is ?nancing and everything, someone like that, uh, I mean it is a war, you understand, I wanted it for these kind of things and then it is an excellent silencer.? ELFGEEH stated that ?God willing,? the gun and silencer would come by the end of the month (April), and that he would then set up a shooting target in the basement. 59. On April 21, 2014, ELFGEEH asked ?what?s up with this guy [the gun supplier], man?? CS-Z stated that the supplier is leaving at the end of the month (April), within the next two weeks. 60. On April 27, 2014, asked ELFGEEH to con?rm that he would not ?do nothing here until [they] leave,? meaning that he would not proceed with the plot to shoot and kill United States soldiers and/ or Shi?a Muslims before and CS-2 leave for Syria. ELF GEEH responded, ?no, no.? 61. On May 12, 2014, C52 sent a text message to ELFGEEH at the telephone number (585) 354-9614, the telephone number used by ELFGEEH. The text message stated, in pertinent part, ?my friend got what you wanted [meaning the firearm and silencer], do you got the money.? ELFGEEH responded, ?Yes. I got it.? -27.. Case Document 1 Filed 08/06/14 Page 29 of 38 62. On May 29, 2014, met with ELFGEEH at Mojoe?s. During the meeting, asked if ELFGEEH had gotten ?his thing,? meaning the handgun from CS-2. ELFGEEH responded that it was supposed to come at the end of the month (May), but it did not. ELFGEEH also stated that he wanted the handgun even for his use here, adding that it is good to have you never know when you are going to use it. 63. On May 29, 2014, C82 met with ELFGEEH at Mojoe?s. During the meeting, CS-2 told ELFGEEH that supplier had two handguns with silencers available. One was the previously-discussed Walther PPK and the other was a 9 millimeter. ELFGEEH gave $550 in cash for the purpose of purchasing from supplier the Walther PPK with a silencer and ammunition. In addition, gave (ZS-2 his Visa debit card for Bank and instructed CS-Z to withdraw $500 from account for the purpose of purchasing from supplier the 9 millimeter handgun with a silencer and ammunition. ELFGEEH asked to ?nd out if the supplier would sell the two handguns, the two silencers, and ammunition for the aggregate price of $1,050. During this converSation, ELFGEEH also told CS-2 that he had a laptop computer for CS-2 to take to Syria on the trip with observed ELFGEEH using the laptop computer inside Mojoe?s during this meeting. After leaving Mojoe?s, (IS-2 used the Visa card to withdraw $500 from bank account at an Automated Teller Machine (ATM). 64.. Later on May 29, 2014, CS-2 returned to Mojoe?s to give the Visa card and ATM receipt back to ELFGEEH. While there, CS-2 informed ELFGEEH that the supplier agreed to sell the two handguns, the two silencers, and the ammunition for a total of $1,0 50. further stated that the supplier may be in the Rochester area on Friday night (May 30, 2014) or Saturday morning (May 31, 2014) to make delivery of the requested items to 65. On May 31, 2014, the FBI gave CS-Z a grey tackle box containing a Walther PPK, .32 caliber handgun with a functional silencer affixed to the barrel, a Glock 26, 9 millimeter 23 Case Document 1 Filed 08/06/14 Page 30 of 38 handgun with a functional silencer a?ixed to the barrel, two boxes of .32 caliber ammunition, and two boxes of 9 millimeter ammunition.31 Later, (IS-2 arranged to meet ELFGEEH at a location in Rochester, New York. During the meeting, gave the tackle box to ELFGEEH. ELF GEEH took the box and began to return to his vehicle. Members of the investigative team arrested ELFGEEH in possession of the box containing the handguns, silencers, and ammunition.??2 WhatsApp Accounts 66. May 29, 2014, the FBI served preservation requests under 18 U.S.C. 2703(f) on WhatsApp for the accounts 5853549614, +963967197623 and +967700780952. As detailed, m, ELFGEEH stated that he communicated With the Jordanian male and Yemeni Male 2 over WhatsApp in an effort to arrange for and CS-2 to travel to Syria to ?ght with ISIL, and that the WhatsApp numbers for the Jordanian male and Yemen Male 2 were +963967 197 623 and +967700780952, respectively. In light of these statements by ELFGEEH, I believe that ELFGEEH used his account, 5853549614, to communicate with the Jordanian male at +963967197623 and with Yemeni Male 2 at +967700780952 about the plan to send CS-1 and CS-2 to Syria to ?ght with ISIL. 67. In or about July 2014, the government served subpoenas on WhatsApp Messenger seeking accounting information for the accounts 5853549614, +963967197623 and +967700780952. On or about July 16, 2014, the FBI received the subpoenaed information from WhatsApp Messenger. The documents showed the following: 3? Prior to giving the ?rearms to CS-2, the FBI had rendered them inoperable. 32 On May 31, 2014, the Honorable Jonathan W. Feldman, United States Magistrate Judge, Western District of New York, issued a complaint charging ELFGEEH with two counts of receipt and possession of an unregistered ?rearm silencer (as de?ned in Title 18, United States Code, Section 921(24)), in violation of Title 26, United States Code, Sections 5841, 5861(d), and 5871. -29.. Case Document 1 Filed 08/06/14 Page 31 of 38 a. Service for account number +1-585-354-9614 was started on January 26, 2014, at 3:expire on January 26, 2015 at 3:23 pm. PT. The services used for this account are ?Address Book? and ?Groups.? This account was ?last seen? on May 31, 2014, at 12:00 pm. PT (which is the date of arrest in the Western District of New York);33 b. Service for account number +963?96?7197-623 was started on December 13, 2013 at 6:expire on December 13, 2014 at 6:52 am. PT. The services used for this account are ?Address Book? and ?Groups.? This account was ?last seen? on July 8, 2014 at 11:08 pm. and c. Service for account number +967-700-780-952 was started on May 23, 2013 at 11:expire on April 12, 2015 at 8:56 am. PT. The services used for this account are ?Address Book? and ?Groups.? This account was ?last seen? on July 15, 2014 at 6:50 pm. PT. 68. Given that the speci?ed WhatsApp accounts are still in existence and have not been deleted, and that a preservation requested was timely served on WhatsApp, the computers at WhatsApp are likely to contain all the material described, above, including information concerning subscribers and their use of WhatsApp, such as account access information, transaction information, and other account information. INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 69. I anticipate executing this warrant under the Electronic Communications Privacy Act, in particular 18 U.S.C. 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A), by using the warrant to require WhatsApp to disclose to the government copies of the records and other information (including content regarding the identities or locations of persons, telephone numbers or accounts 33 ?Last seen? information is available and displayed to each user who has a particular mobile telephone number in their mobile telephone address book or contact book, and re?ects the last approximate time the WhatsApp mobile application has been used or brought to the foreground on the mobile telephone. ?Last seen? information is reported to WhatsApp when a user brings the mobile application to the foreground. -30- Case Document 1 Filed 08/06/14 Page 32 of 38 associated with the accounts 5853549614, +963967197623, and +967700780952) particularly described in Section I of Attachment B. Upon receipt of the information described in Section I of Attachment B, government-au?lorized persons will review that information to locate the items described in Section II of Attachment B. 111. 70. Based on the foregoing, there is probable cause to believe that MUFID A. ELFGEEH a/k/a Abu Musa al-Faqih a/k/a Abu Musa al?Madhaji a/k/ a Abu Musa al-Athiri a/k/a Abu Musa al-Athari a/ k/ a Abu Musa Athari al-Yemeni a/k/a Abu Musa a/k/ a Abi Musa al-Madhaji a/k/a Abu Naje a/k/a Ali Saleh a/k/a Abumusa Almuslm a/k/ a Abo Baqia a/k/ a Mon Leeg a/k/a Abu Hamza, has committed violations of. 18 U.S.C. 956 (conspiracy to murder or maim persons overseas), 2339A (providing, and attempting and conspiring to provide, material support of terrorism), 2339B (providing, and attempting and conspiring to provide, material support to a designated foreign terrorist organization), 1114 (attempted murder of federal officials and employees), and 924(c) (possession of ?rearms in furtherance of a crime of violence), and 26 U.S.C. 5841, 5861(d), and 5871 (receipt and possession of unregistered ?rearm silencers), and that evidence of those criminal violations, as speci?cally described in Section of Attachment to this application, is presently located in the information described in Attachment A to this application. I therefore respectfully request that the Court issue the proposed search warrant. 71. This Court has jurisdiction to issue the requested search warrants because it is ?a court of competent jurisdiction? as de?ned by 18 U.S.C. 2711. 18 U.S.C. 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). Speci?cally, the Court is a ?district court of the United States (including a magistrate judge of such a court) . . . that has jurisdiction over the offense[s] being investigated.? 18 U.S.C. 2711(3)(A)(i). -31- Case Document 1 Filed 08/06/14 Page 33 of 38 72. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not required for the service or execution of the search warrant. Dated: Rochester, New York August 2014 W. ZENN Special Agent Federal Bureau of Investigation Joint Terrorism Task Force -32- Case Document 1 Filed 08/06/14 Page 34 of 38 ATTACHMENT A Property to be Searched The search warrant applies to information associated with the WhatsApp Messenger accounts associated with the following telephone numbers: (1) 5853549614; (2) +963967197623; and (3) +967700780952; that is stored at premises owned, maintained, controlled, or operated by WhatsApp, a company headquartered in San Mateo, California. Case Document 1 Filed 08/06/14 Page 35 of 38 ATTACHIVIENT Particular Items to be Seized 1. Information to be Disclosed by WhatsApp To the extent that the information described in Attachment A is within the possession, custody, or control of WhatsApp, including any messages, records, ?les, logs or information that have been deleted but are still available to WhatsApp, or have been preserved pursuant to a request made under 18 U.S.C. 27036), WhatsApp is required to disclose the following inforr?natidn to the government for each account listed in Attachment A: a. All identity and contact information, including full name, e-mail address, physical address (including city, state and zip code), date of birth, gender, hometown, occupation, and other personal identi?ers; b. All past and current usernames, accounts passwords, names and telephone numbers associated with the account; c. The dates and times at which the account and pro?le were created, and the Internet Protocol address at the time of sign-up; d. All IP logs and other documents showing the IP address, date, and time of a subscriber?s use of the account; I e. All data and information associated with any user pro?le, including photographs, ?bios,? and pro?le backgrounds and themes; f. All photographs, images and pro?le pictures associated with the subscriber?s account; g. All location data associated with the account, including geolocation sharing information with other accounts; h. All data and information that has been deleted by the user; i. A list of all of the people, telephone numbers or accounts that are linked to the WhatsApp account (including those that are part of the Address Books, Contact Lists, and Groups owned by or Case Document 1 Filed 08/06/14 Page 36 of 38 participated in), including through third?party applications or websites, along with the identity and contact information for each linked person, telephone number and account, including full name, e? mail address, physical address (including city, state and zip code), date of birth, gender, hometown, occupation, and other personal identi?ers; j. A11 privacy and account settings; a k. All information about. connections between the account and third-party websites and applications; 1. All information about the dates and times of delivered messages; m. All information about the identities of senders and recipients of delivered messages; 11. All content of undelivered messages; and o. All records pertaining to actions taken regarding the account, including suspensions. II. Information to be Seized by the Government All information described above in Section I that constitutes fruits, evidence and instrumentalities of violations of 18 U.S.C. 956 (conspiracy to murder or maim persons overseas), 2339A (providing, and attempting and conspiring to provide, material support of terrorism), 2339B (providing, and attempting and conspiring to provide, material support to a designated foreign terrorist organization), 1114 (attempted murder of federal officials and employees), and 924(c) (possession of ?rearms in furtherance of a crime of violence), and 26 U.S.C. 5841, 5861(d), and 5871 (receipt and possession of unregistered ?rearm silencers), including, for each account identi?ed in Attachment A, information pertaining to the following matters: a. Any undelivered messages involving efforts to provide, attempt to provide, and conspiracy to provide material support (including but not limited to personnel, funds, and equipment) to terrorists or designated foreign terrorist organizations (including but not limited to the Islamic State of Iraq and the Levant (ISIL) a/ k/ a the Islamic State of Iraq and al?Sham, the Islamic -2- Case Document 1 Filed 08/06/14 Page 37 of 38 State of Iraq and Syria, ad?Dawla al-Islamiyya al-?Iraq wa-sh-Sham, Daesh, Dawla al Islamiya, and al-Furqan Establishment for Media Production); b. Any information that the users of the telephone numbers on WhatsApp or third- party applications or websites associated with the account are affiliated with terrorists or designated foreign terrorist organizations (including but not limited to the Islamic State of Iraq and the Levant (ISIL) a/k/a the Islamic State of Iraq and al-Sham, the Islamic State of Iraq and Syria, ad?Dawla a1- Islamiyya al-?Iraq wa-sh-Sham, Daesh, Dawla a1 Islamiya, and al-Furqan Establishment for Media Production), including, for example, the use of a symbol or insignia known to be associated with a particular terrorist or designated foreign terrorist organization (including but not limited to the Islamic State of Iraq and the Levant (ISIL) a/ k/ a the Islamic State of Iraq and al?Sham, the Islamic State of Iraq and Syria, ad-Dawla al-Islamiyya al-?Iraq wa?sh-Sham, Daesh, Dawla a1 Islamiya, and al-Furqan Establishment for Media Production); c. Any undelivered messages relating to efforts to assist or arrange for CS-Z or others to travel overseas to engage in violent jihad, engage in acts of terrorism, and/ or join a designated foreign terrorist organization (including but not limited to the Islamic State of Iraq and the Levant (ISIL) a/k/a the Islamic State of Iraq and al-Sharn, the Islamic State of Iraq and Syria, ad-Dawla al-Islamiyya al-?Iraq wa?sh?Sham, Daesh, Dawla a1 Isla'miya, and al-Furqan Establishment for Media Production); (1. Records or other information relating to who created, used or communicated with the account, including records about their identities and whereabouts; e. Any undelivered messages relating to ?rearms, silencers, ammunition, terrorist attacks involving mass shootings or shooting sprees, military tactics and training, and/ or religious justi?cation for terrorist attacks; Case Document 1 Filed 08/06/14 Page 38 of 38 f. The names, telephone numbers, WhatsApp account numbers, and other identifying information for any and all WhatsApp contacts and subscribers in the Address Books and/ or Contact Lists for the subject WhatsApp accounts; g. The names, telephone numbers, WhatsApp account numbers, and other identifying information for any and all entries in any Groups owned by or participated in through the subject WhatsApp accounts; h. The dates and times of any and all messages delivered to and/or sent from the subject WhatsApp accounts; i. The senders and recipients of any and all messages delivered to and/ or sent from the subject WhatsApp accounts; and j. The pro?le picture for each of the subject WhatsApp accounts.