Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 1 of i, IN THE UNITED STATES DISTRICT FOR THE NORTHERN DISTRICT OF TEXAS DALLAS DIVISION UNITED STATES OF AMERICA No. 51 35" 5F v. - U.S. DISTRICT COURT NORTHERN DISTRICT or TEXAS JUSTIN SHAFER FILED I MR 3' I 20!? CRIMINAL COMPLAINT ,e - CLERK, U.S. URT I, the complainant in this case, state that the following is true Ilo the?le In 0 nd belief: 61W From in or about May 2016 through and including March 21, 2017, in the Dallas and Fort Worth Divisions of the Northern District of Texas and elsewhere, defendant JUSTIN SHAFER, knowingly and with the intent to harass and intimidate and to place under surveillance with intent to harass and intimidate a person, namely N. and his spouse, did knowingly and intentionally use an interactive computer service and an electronic communication service to engage in a course of conduct that caused, attempted to cause, and would be reasonably expected to cause substantial emotional distress to that person; in that JUSTIN SHAFER used his Twitter account to post derogatory and in?ammatory statements about Hopp and personal identifying information of Hopp and his immediate family and his wife online. In violation of 18 U.S.C. and 18 U.S.C. 2261(b)(5). This criminal complaint is based on the facts set out in the attached af?davit. RONNIE o. BUENTELLO Special Agent Federal Bureau of Investigation Sworn to before me and signed in my presence in Dallas, Texas, on March UNITED STATES MAGISTRATE JUDGE Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 2 of 20 PageID 2 AFFIDAVIT IN SUPPORT OF COMPLAINT 1, Ronnie O. Buentello, being ?rst duly sworn, hereby depose and state as follows: 1. I am a Special Agent (SA) with the Federal Bureau of Investigation (FBI) duly appointed and acting according to law. I have been employed as an FBI SA since February of 201 1. Prior to becoming a SA, I was employed by the FBI as an Electronic Technician. Since January 2013, I have been assigned to investigate violations of federal law including violations involving computer crime, such as malicious computer activity, computer intrusions, and internet fraud schemes. Since being employed with the FBI, I have received training and expertise in various forms of computer technology along with industry recognized cyber forensic and security training to investigate computer crimes. I have participated in the execution of numerous searches and seizures pursuant to warrants authorizing the seizure of evidence related to the unauthorized access of protected computer systems. Based on my training, experience, and my participation in other investigations involving individuals engaged in offenses like the current offenses, I know that individuals and/or business engaged in ?nancial crimes often maintain documents and ?nancial records for long periods of time, particularly when they are involved in ongoing criminal conduct over a long period of time. I also know that individuals and/or businesses keep some, if not all, of their records in electronic form, such as on a computer. I know that documents and records can be in the form of printed documents or stored in computer memory or on computer disks or other computer storage mediums. 2. Upon information and belief, there is probable cause to believe that between in or about May 2016, and continuing through and including March 21, 2017, defendant Affidavit Page 1 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 3 of 20 PageID 3 JUSTIN SHAFER, knowingly and with the intent to harass and intimidate and place under surveillance with intent to harass and intimidate another person, did knowingly and intentionally use an interactive computer service and an electronic communication service to engage in a course of conduct that caused, attempted to cause, and would be reasonably expected to cause substantial emotional distress to that person, in violation of 18 U.S.C. Cyber Stalking. 3. Upon information and belief, there is probable cause to believe that between in or after May 2016, through on or about March 21, 2017, defendant JUSTIN SHAFER, knowingly and with the intent to harass, intimidate, and place under surveillance with the intent to harass and intimidate FBI SA Nathan Hopp, his immediate family members, and his spouse. Specifically JUSTIN SHAFER used his Twitter Inc. account @jshafer817 and his Facebook Inc. account to publicize personal identifying information of SA Hopp, his family, and his spouse, to include a past residence address, and acebook pro?le accounts belonging to SA Hopp?s mother, cousin, and spouse, and ex-wife, in an attempt to harass and intimidate SA Hopp and his family members. Furthermore, JUSTIN SHAFER, knowingly and willfully, sent a Facebook ?friend request? to SA Hopp?s spouse, and sent direct messages through Facebook to her. JUSTIN SHAFER started to ?follow? SA Hopp?s spouse?s Twitter account, in an attempt to harass and intimidate her. - Additionally, JUSTIN SHAFER sent an email from his email address, justinshafer@gmail.com, to SA Hopp?s business email address. Because of the contact by JUSTIN SHAFER, SA Hopp observed the tweets on Twitter feed, and reported the criminal conduct for further investigation. Affidavit - Page 2 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 4 of 20 PageID 4 4. The information contained in this af?davit is based on my investigation, including information obtained from other Agents, review of data, and my experience and background as an FBI SA. I have not included each and every fact known to me concerning this investigation. I have set forth only the facts that I believe are necessary to establish probable cause to believe that a violation of 18 U.S.C. 2261A. APPLICABLE CRIMINAL STATUTES 5. There is probable cause to believe that JUSTIN SHAFER has committed a violation of 18 U.S.C. The pertinent sections of the statutes are set out below: 18 U.S.C. Stalking Whoever, with the intent to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person, uses the mail, any interactive computer service or electronic communication service or electronic communication system of interstate commerce, or any other facility of interstate or foreign commerCe to engage in a course of conduct that causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress to a person described in clause or of paragraph shall be punished as provided in section 2261(b) of this title (5 years). 6. The clauses in paragraph identify the ?person? as: that person; (ii) an immediate family member (as de?ned in section 115) of that person; or 'a spouse or intimate partner of that person. 7. 18 U.S.C. 115(c)(2) de?nes an immediate family member as follows: (A) his spouse, parent, brother or sister, child or person to whom he stands in loco parentis; or (B) any other person living in his household and related to him by blood or marriage. PROBABLE CAUSE Affidavit Page 3 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 5 of 20 PageID 5 8. By way of background, FBI Dallas opened an investigation on February 19,2016 based on JUSTIN actions of accessing an FTP server belonging to Patterson Companies Inc., (PCI) without permission, in which SA Nathan Hopp was the primary Case Agent. On February 6, 2016, JUSTIN SHAFER accessed an FTP server belonging to PCI without permission and downloaded approximately 22,000 patient records. PCI sells dental products to dental of?ces, including a management software, called Eaglesoft. Eaglesoft allows dental of?ces to store patient?s personal identifying information (PII) and personal health information (PHI). PCI was able to determine the internet protocol (IP) address used to access the FTP server belonged to JUSTIN SHAFER, residing in North Richland Hills, Texas. 9. Pursuant to a search warrant approved in the Northern District of Texas, FBI 7 I Dallas executed a search warrant at JUSTIN residence on May 25, 2016, searching for evidence associated with the accessing of computer systems, and the acquisition and dissemination of personal identifying information and health information of thousands of individuals. On or about May 25, 2016, JUSTIN SHAFER began posting comments on the online social media networking service, Twittercom, and tagged the Twitter pro?les; ?@FBIDallas,? and JUSTIN SHAF ER also posted comments referring to ?Special Agent Nathan Hawk.? 10. On June 29, 2016, FBI Atlanta (NDGA) opened a criminal computer intrusion investigation on an individual using the online moniker, ?TheDarkOverlord,? who It is believed that JUSTIN SHAFER believed SA Nathan Hopp?s true name to be ?Nathan Hawk.? Affidavit Page 4 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 6 of 720 PageID 6 claimed to have stolen 655,000 patient medical records and attempted to extort the medical facilities he victimized. As part of their case, FBI Atlanta is investigating JUSTIN SHAFER as a co-conspirator of ?TheDarkOverlord.? Subsequent media reports con?rmed ?TheDarkOverlord? had posted the records for sales where he was seeking 60 Bitcoins2 for a armington, Missouri database of 47,864 records, which was found on JUSTIN computer during a search warrant executed on January 29, 2017; 170 Bitcoins for a Central/Midwest database containing 207,572 records; and 300 Bitcoins for a Blue Cross/Blue Shield S) database containing 396,458 records. Since his appearance in June 2016, ?TheDarkOverlord? has claimed approximately 15 major computer breaches and the sale of one million customer PII records, and engaged in extortion of the victims across the Unites States, targeting medical providers, ?nancial companies, large US. corporations, and even a provider of cancer services in Indiana. In most cases, ?TheDarkOverlord? extorted his victims with verbose, condescending, and abusive language, and taunted victim companies, their employees, and (in at least one case) the children of victim employees. ?TheDarkOverlord? has carried out threats to release data when victims declined to pay, and has made implied threats to FBI Agents in Atlanta and New Orleans. 11. Collaboration between multiple FBI Divisions has subsequently identi?ed signi?cant links (IP addresses, emails, social media accounts) between ?TheDarkOverlord? and JUSTIN SHAF ER. On January 29, 2017, FBI Dallas, FBI 2 Bitcoins are a type of digital currency in which techniques are used to regulate the generation of units of currency and verify the transfer of funds, operating independently of a central bank. Affidavit - Page 5 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 7 of 20 PageID 7 Atlanta, FBI Saint Louis, FBI New Orleans, and FBI Newark executed a search warrant at JUSTIN residence, located in North Richland Hills, Texas. At the time of entry, JUSTIN SHAFER was logged into at least two different workstations in his home of?ce and garage. During the execution of the search warrant, the FBI seized approximately 29 evidence items, including desktops, laptops, hard drives, router, several cell phones, numerous universal serial bus (USB) drives, and an Xbox game console. A chat session appearing to be with ?TheDarkOverlord? was observed on a computer during the execution of the search warrant. In the months following the initial search warrant on May 25, 2016, several online media outlets published articles defending Shafer as a ?security researcher? and admonished the FBI for executing a search warrant at his residence.? SA Nathan Hopp was present for both search warrants that were executed on May 25, 2016 and on January 29, 2017. 12. The United States Attorney?s Of?ce (USAO) and the FBI are investigating the cyber stalking and disclosure of personal information of an Agent of the Federal Government. On March 21, 2017, at approximately 8:54 am, SA Hopp received an email on his government email account from JUSTIN SHAFER from the email address justinshafer@gmail.com, with the subject of the email titled ?Hola? and the content of the email was a ?smiling face? emoji. Pursuant to a Federal Search Warrant issued out of the Northern District of Texas, records reveal the email address justinshafer@gmail.com is used by JUSTIN SHAFER. Additionally, beginning on March 21, 2017 at approximately 4:11 am, JUSTIN SHAFER began posting a series of tweets which made available personal information about SA Hopp and his family, to include his Affidavit Page 6 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 8 of 20 PageID 8 cousin, his ex-wife, his mother, and his wife. Af?ant believes that JUSTIN SHAFER engaged in the criminal conduct described herein from his residence in Tarrant County, Texas. SA Hopp and his spouse reside in the NDTX and received and observed the communications from JUSTIN SHAFER on devices in the NDTX. 13. Some of the tweets posted by JUSTIN SHAFER included the following: Name Twitter Time Date Post Account Justin Shafer @JShafer817 4:11am Mar 21, there is a Nathan Hopp at 2017 the Dallas Justin Shafer @JShafer817 5:22am Mar 21, 3 2017 .. facebook pro?les that I can tell. Justin Shafer @JShafer817 6:06am Mar 21, 2017 Closer. Justin Shafer @JShafer817 7:00am Mar 21, Close as I will get. 2017 Justin Shafer @JShafer817 7:11am Mar 21, Skinnier version of this 2017 dude: 1 HYYCIX7 Is Nathan Hawk. Justin Shafer @JShafer817 7:28am Mar 21, Elizabeth 2017 Justin Shafer @JShafer817 7:30am Mar 21, Bingo: 2017 3 The Universal Resource Locator (URL) link posted on Twittercom is a link to the website, crowrivermediacom, in which the webpage is an obituary of an individual named Ervil Hopp. 4 The URL link posted on Twittercom is a link to the website, stateoftexas.info, in which is a past address location for SA Nathan Hopp and his spouse. . 5 The URL link posted on Twittercom is a link to a acebook pro?le, belonging to Susan Hopp, SA Hopp?s Mother. 5 The URL link posted on Twitter. com is a link to a Facebook pro?le, belonging to Katy Olson, SA Hopp?s ex-wife. 7 The URL link posted on Twittercom is a link to a acebook pro?le, belonging to Bruce Hopp, SA Hopp?s cousin. 3 The URL link posted on Twitter.com is a link to a Facebook pro?le, belonging to Elizabeth Hopp, SA Hopp?s wife. Affidavit - Page 7 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 9 of 20 PageID 9 Name Twitter Time Date Post Account Justin Shafer @JShafer817 7:31am Mar 21, She kept her maiden name 2017 on Justin Shafer @JShafer817 7 :3 9am Mar 21, Back the blue. 2017 Justin Shafer @JShafer817 7:56am Mar 21, @bethahopp 2017 @PogoWasRight This is Nathan Hawk?s wife -- Justin Shafer @JShafer817 8:47am Mar 21, @bethahopp . 2017 @PogoWasRight - Based on this complaint. The epileptic tweet. Justin Shafer @JShafer817 11:19am Mar 21, @dawgSu @abtnatural 20 17 @Popehat @associatesmind @PogoWasRight Mike @dawg8u 1 1 :20am Mar 21, @abtnatural @Popehat Honcho 2017 @associatesmind Nathan Hopp is the least busy FBI agent of all time. 14. On January 9, 2017, before the execution of the NDGA search warrant, Shafer posted on Twitter that he called the Dallas FBI office and left a message for SA Nathan ?Hawk.? JUSTIN SHAFER posted on Twitter.com the following: Name Twitter Date Post Account Justin Shafer @JShafer817 January 9, 2017 Called the Dallas FBI today an for Nathan Hawk. 9 The image is an image of Dallas, Texas skyline, stating ?Back the Blue.? The image was posted by Elizabeth Hopp, and JUSTIN SHAFER shared her image on his Twitter pro?le feed. ?0 The URL link posted on Twittercom is a Northern District of Texas Dallas Division, Criminal Complaint of John Rayne Rivello, in which SA Hopp was the affiant. Affidavit Page 8 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 10 of 20 PageID 10 15. In the days following the execution of the NDGA search warrant (January 31, 2017), Shafer posted a series of ?tweets? about the execution of the search warrant. 16. On February 6, 2017, and on February 13, 2017, JUSTIN SHAFER posted numerous ?tweets? referring to SA Hopp, and seems to post threatening comments directed to FBI Dallas. The tweets posted by JUSTIN SHAFER included the following Name Twitter Time Date Post Account Justin Shafer @JShafer817 8:46am Feb 6, 2016 @FBIDallas takes big men to steal a 5 year old kid?s saved games from his WII.. But that is who you are. Worthless, without integrity. Justin Shafer @JShafer817 8:46am Feb 6, 2016 @FBIDallas Cowards. Justin Shafer @JShafer817 8:46am Feb 6, 2016 @FBIDallas And Nathan Hawk is full of shit. Justin Shafer @JShafer817 8:52am Feb 6, 2016 @FBIDallas ?smiling face emoji? Justin Shafer @JShafer817 3:59am Feb 13, Next time you send 2017 van to threaten me, you know what you are getting yourself into. Stay out of trouble FBI. 17. On March 18, 2017, JUSTIN SHAFER referenced the Criminal Complaint of John Rayne Rivello and tagged @FBIDallas. JUSTIN SHAFER posted the following tweet on his Twitter account: Name Twitter Time Date Post Account Justin Shafer @JShafer817 4:22am Mar 18,2017 @punishedmelpl, @FBIDallas Holy Shit! It Affidavit Page 9 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 11 of 20 PageID 11 gave that dude a seizure. Wow! 18. On or about March 21, 2017, JUSTIN SHAFER shared a photo which SA Hopp?s wife posted on her acebook pro?le webpage. The photo was posted by SA Hopp?s wife on July 8, 2016, which consisted of an image of the Dallas, Texas skyline with the words ?Back The Blue? within the image. Subsequent comments from JUSTIN post and other individuals stated the following:11 Facebook Pro?le Comment Justin Shafer She is Elizabeth Augenstein Hopp, married to Nathan Hopp.. AKA.. Nathan Hawk. FBI Agent. 59 I ?gured it out from this document. The jew_goldstein thing going around. Justin Shafer Doxxed Darrell Pruitt So you found him! Justin Shafer Idid! Darrell Pruitt What an asshole. Justin Shafer mil Pruitt is a.possibilitx-. Q. further damage to my car .. Darrell Pruitt I guess I missed that. Justin Shafer Darrell Pruitt Yeah..he was the one That leaves like 20 other people to ?gather evidence?..My wife found her missing ring last week. . .. So that is good Justin Shafer ?He knows what he did? Darrell Pruitt Darrell Pruitt Where have I heard that phrase yea! The TDA '1 It is unclear at this junction any involvement of ?Darrell Pruitt,? if any, bey0nd the communication above between Shafer Pruitt on this post. Affidavit - Page 10 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 12 of 20 PageID 12 Justin Shafer That?s two people now! Llanfair Cruz Affidavit Page 11 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 13 of 20 PageID 13 A copy of the screen capture is included for clarification below: F. Jaw-52 mews 3 1% mac Liv-7e in Ncr?th i?i'z Jami?: Shams: 55th il ?ew} Augerzslenre pawn it Ems has Mm mm From Ken-er Photos as dad naming, 93?s;an ia ?rm 19%? My?! ml uh Uke szment A Share: Jti?h? Sham/r aha ls Elizamrh Augxemsmin Hop? marriml Mailman :?gurea! l? Bunion! (his dbcumen! ?me lihn- Emily a: Jusxm Shah?? Dunno j? Like ?nal; 3 ms; Jumm Shain - Va .. mu: mime-we Beth ?Augeux?uain The max Threats 5mm aatnewg'e'n-s'mr @be-manopm; "The; is variously Such an smaclim organiza?un em: Reply .man 5mm? mum x. mm 9 )mn? W?u' {wee .. .rzbiw?yu?? m: Aww?apvw.? .1), M. mm . .. ?mama ??awleer mm .. immil-h-mI-rm-mWJ-?HK mm. him Remy m: Emvmn Fm?? yrhu taunt: Like Re?lls *i Justin *5me mm: Mik? {Wink ?an-mat} i?rui? W?he? em aas?mle? Ri?pl?y 5 ii Justm shaker Darrun Pruitt That is a pa-as?ebal?tir He ?anged mom from dalng any tanner damage in my 6m? . - mm Reply 5h?" ?11,861? new: 149! Fron I (gm-ms; i like: Rl?zi?g dimlin ?5?an Eurruli Pruiztmear?r?, he war; the ana intelmsannu. ?Fl-last leave-2 other to "gamer ewdence My wave mums new nno la? week So that goon, ?in Weary 3 we Justus: saunter ?He knows what he cud? Barre? Pr :4 new; i215 ?animal Where have I haan mm shims?: Oh yea! The Reply Jumm 3mm, Thaw we: beanie new mi: Lzunh?tw Cruz 3 Justin ahaf?r 2 a i Get an Umbe- switch to Demzlx. Ell'adlay DDS. R?rmu' dull ?Anya; E?g Affidavit - Page 12 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 14 of 20 PageID 14 19. On or about March 21, 2017, JUSTIN SHAFER sent a Facebook message to SA Hopp?s wife, using the application Facebook Messenger. A screen capture was obtained and the contents of the message states: Facebook Comment Pro?le Justin Shafer How ya doin? 59 Justin Shafer Tell Nathan I said howdy. Justin Shafer Tell him I want my videos of my kids you should just use your real last name on facebook. Justin Shafer A copy of the screen capture is included below: 21-2: v: saw 1 i, 3914 mm Refer ?Saiwamlien ?ows this? i=2 Writ-{amorous nus/>2: ?4 wsxawagiwidlwme maxim-m V, I Tell Em . want my meets of my (in: bark?, and- gnu moxith use 361 mi ammonites-back (foj?F?? S4: mange. he said Mite ms ?ex; ?In The: utter-e; f? Affidavit Page 13 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 15 of 20 PageID 15 20. On March 29, 2017, Shafer sent SA Hopp two additional emails, one at 5:55am and the second at 5:57am. A screen shot of the emails are below: Wad 3:2957751? Ali/Ii: Eust?o Skater {gustEmsbaier?2?tna?ig_ {3 sou-{mam this message on assets}? 3:13 AM Welcome to the Federal Government? On Wed, Ma: 29: 201? at 5:55 AM. Justin Simfcr?iius?inshafez?mn?eom? wrote: "Fuck the police?" f?3??502484 5 2,2 liS a??ra9620McGowan 000} rigs: i submitted this SEITU to OCR on march 3111.. .What is the hold up? Over 500 patients inthe sign-in-sheet folders." No SSN on this ftp. Why has this taken so long for the FTP server to go down? Justin Shafez Onsite Dental Systems 3?04 Sagebrush CL 5? North Riddand Hills. TX. 76182 (817) 909-4332 21. SA Hopp and his spouse advised Af?ant that JUSTIN conduct, his obsession with SA Hopp, his sending messages to SA Hopp and his spouse, his posting personal identifying information of SA Hopp, his spouse, and other family members on Twitter and on Facebook, and the derogatory and in?ammatory statements made about Affidavit - Page 14 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 16 of 20 PageID 16 SA Hopp since the execution of the NDTX Search Warrant in May 2016, have caused substantial emotional distress to SA Hopp and his spouse. CONCLUSION 22. JUSTIN communication using Twitter and Facebook intended to intimidate, harass, and cause harm to SA Hopp and to his family and were alarming in nature. 23. Based on the forgoing, I have probable cause to believe that from in or about May 2016, through and including March 21, 2017, defendant JUSTIN SHAFER, knowingly and with the intent to harass and intimidate and place under surveillance with intent to harass and intimidate a person, namely Nathan Hopp and his spouse, did knowingly and intentionally use an interactive computer service and an electronic communication service to engage in a course of conduct that caused, attempted to cause, and would be 3' . reasonably expected to cause substantial emotional distress to that person; in that JUSTIN SHAFER used his Twitter and his Facebook accounts to post derogatory and in?ammatory statements about Hopp and personal identifying information of Hopp and his immediate family and his wife online, in violation of 18 U.S.C. I request that a warrant be issued for the arrest of JUSTIN SHAFER. I further request that this complaint, af?davits, and warrant be sealed, except to the extent necessary to effectuate the arrest and arraignment of the defendant. 24. I understand that on January 5, 2017, Chief Judge Barbara M.G. of the United States District Court of Northern District of Texas issued Special Order No. 19-1 requiring in section 1, that ?the clerk of court will ensure that there is no public access . . . Affidavit - Page 15 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 17 of 20 PageID 17 to criminal complaints, supporting af?davits, and related papers, until each named defendant has been arrested or has made an appearance in federal court.? 1:??tu submitted, Ryonnie C5. Buentello, Special Agent Federal Bureau of Investigation Subscribed . - 0 before me on March 2017 UNITED STATES MAGISTRATE JUDGE Affidavit - Page 16 Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 18 of 20 PageID 18 MW Property to Be Searched The warrant applies to information associated with the email account and ustin.Shafer.79, that is stored at premises owned, maintained, controlled, or operated by acebook Inc., a company headquartered in Menlo Park, CA. Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 19 of 20 PageID 19 Attachment Particular Things to be Seized 1. Information to be disclosed by Facebook Inc. To the extent that the information described in Attachment A is within the possession, custody, or control of Facebook including any messages, records, ?les, logs, or information that have been deleted but are still available to Facebook, or have been preserved pursuant to a request made under 18 U.S.C. 2703(f), Facebook. is required to disclose the following information to the government for each account or identi?er listed in Attachment A: a. All contact and personal identifying information, including full name, user identi?cation number, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook security questions and answers, physical address (include city, state, and zip code), telephone numbers, screen names, websites and other personal identi?ers. All activity logs for the account and all other documents showing the user?s posts and other Facebook activities; All photos and videos uploaded by that username and all photos and Videos uploaded by any user that have that user tagged in them; All photos and associated data through which Facebook has used facial recognition to identify the user through additional posts. . All pro?le information; News Feed information; status updates; links to Videos, photographs, articles, and other items; Notes; Wall postings; friend lists, including the friend? Facebook usernames/identi?cation numbers; groups and networks of which the user is a member, including the groups? Facebook group identi?cation numbers; future and past event postings; rejected ?Friend? requests; comments; gifts; pokes; tags; and information about the user?s access and use of Facebook applications; All other records of communication and messages made or received by the user, including all private messages, chat history, video calling history, and pending ?friend? requests; All ?check ins? and other location information; All IP logs including all records of all the IP addresses that loges into the account; Case 3:17-mj-00257-BF Document 1 Filed 03/31/17 Page 20 of 20 PageID 20 i. All records of the account?s usage of the ?like? feature, including all Facebook posts and all non-Facebook webpages and content that the user has ?liked?; All information about the Facebook pages that the account is or was a ?fan? of; All past and present lists of friends created by the account; All records of Facebook searches performed by the account; . All information about the user?s access and use of Facebook Marketplace; The types of service utilized by the user; The length of service (including start date) and the means and source of any payments associated with the service (including any credit card or bank account number); p. A11 privacy settings and other account settings, including privacy settings for individuals Facebook posts and activities, and all records showings which Facebook users have been blocked by the account; q. All records pertaining to communications between Facebook and any person regarding the user or the user?s Facebook account, including contacts with support services and records actions taken. 3 g- 11. Information to be seized by the government All information described above in Section I that constitutes fruits, evidence, and instrumentalities of violations 18 U.S.C. 119 and involving Justin Shafer, using since account inception including, for each username identi?ed on Attachment A, information pertaining to the following matters: a. Files, databases, and database records stored by Facebook related to criminal activity by the user b. The identity of the person(s) who created or used the username, including records that help reveal the whereabouts of such person(s). 0. The identity of the person(s) who communicated with the username about matters relating to criminal activity. (1. Subscriber information related to the accounts established in Attachment A to include: i. Names, physical addresses, telephone numbers and other identi?ers, email address and business information; ii. Length of service (including start date), types of service utilized, means of source payment for services (including credit card or bank account number), and billing and payment information.