A0 106 (Rev. 01109) Application for a Search Warrant United States District for the Western District of New York In the" Matter of the Search of describe ?repropmjz to be searched or idem)? the person by name and address.) THE MATTER OF THE SEARCH OF EMAIL ACCOUNT: Case No. 17-MJ-522 APPLICATION FOR A SEARCH WARRANT 1, Kevin Parker, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identr? Ikeperson or derm'be Ekepmpe?y to be searched andgr've its location): See Attachment A, which is attached and incorporated herein by reference. located in the Western District of New York, there is now concealed (Margy theperson ordascn'be theprqnergl to mazes): See Attachment B, which is attached and incorporated herein by reference. The basis for search under Fed. R. Crim. P. 41(c) is (check one or more): evidence of a crime; contraband, fruits of crime, or other items illegally possessed; property designed for use, intended for use, or used in committing a crime; IZI a person to be arrested or a person who is unlawfully restrained. The search is related to violations of 18 U.S.C. 1030 (unauthorized computer access and computerdrelated fraud) and 2261A (stalking) [statutory The application is based on these facts: IZI continued on the attached sheet. Delayed notice of days (give exact ending date if more than 30 days: is requested under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet. Applicant?s Signature KEVIN PARKER SPECIAL AGENT FEDERAL BUREAU OF INVESTIGATION Printed name and title Sworn to before me and signed in my presence. Date: March I 0 2017 Judge?is saignamre RABLE JONATHAN W. FELDMAN City and state: Rochester. New York TED STATES MAGISTRATE JUDGE Printed name and Title Case Document 7 Filed 03/10/17 Page 2 of 42 ATTACHNUENT A - GOOGLE Property to be Searched This warrant applies to information associated with the following email accounts stored at premises owned, maintained, controlled, or operated by Google, Inc., a company located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. a. wrosica?lama?com. Case Document 7 Filed 03/10/17 Page 3 of 42 ATTACHNIENT - GOOGLE Information to he Seized Because Google, Inc. (Google) is not aware of the facts of this investigation, its employees are not in a position to search for relevant evidence. In addition, requiring Google to perform the search would be a burden upon the company. If all Google is asked to do is produce all the ?les associated with the account, an employee can do that easily. Requiring Google to search the materials to determine what content is relevant would add to their burden. Therefore, in order to ensure that agents search only those computer accounts and/ or computer ?les described herein, this search warrant seeks authorization to permit employees of Google, to assist agents in the execution of this warrant. To ?irther ensure that agents executing this warrant search only those accounts and/ or computer ?les described below, the following procedures have been implemented: 1. The warrant will be presented to Google, personnel by law enforcement agents. Google, personnel will be directed to isolate those accounts and ?les described below; 2. In order to minimize any disruption of computer service to innocent third parties, the system administrator will create an exact duplicate of the accounts and ?les described in Attachment A, including an exact duplicate of all information stored in the computer accounts and/ or ?les described below; 3. The Google, system administrator will provide the exact duplicate of the accounts and ?les described below and all information stored in those accounts and or ?les to the Special Agent who serves this search warrant; Case Document 7 Filed 03/10/17 Page 4 of 42 4. Law enforcement personnel will thereafter review the information stored in the accounts and ?les received from the system administrator and then identify and copy the information contained in those accounts and ?les which are authorized to be further copied by this search warrant; 5 . Law enforcement personnel will then seal the original duplicate of the accounts and ?les received from the system administrator and will not ?lrther review the original duplicate absent an order of the Court. . I. Information to be disclosed by Google To the extent that the information described in Attachment A is within the possession, custody, or control of Google, Google, is required to disclose the following information to the government for each account or identi?er listed in Attachment A: a. The contents of all emails stored in the account, including copies of emails sent from the account; b. All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any creditor bank account number); c. All records or other information stored by an individual using the account, including address books, contact and buddy lists, pictures, and ?les; (1. ?All content in the Docs, Calendar, Friend Contacts and Photos areas; 6. Any and all ?les linked to email accounts of the user; and f. All records pertaining to communications between Google and any person regarding the account, including contacts with support services and records of actions taken. Case Document 7 Filed 03/10/17 Page 5 of 42 II. Information to be seized by the government All records or information, including the contents of any and all wire and electronic communications, attachments, stored ?les, print outs, and header information that contain evidence, fruits, and instrumentalities of violations of 18 U.S.C. 1030 (unauthorized computer access and computer?related ?aud) and 2261A (stalking), relating to the victim, Lisa Mino and efforts to cyberstalk the victim, Lisa Mino, for each account or identi?er listed on Attachment A, such information to include: a. The contents of any such communications that will assist investigators in asCertaining the nature and scope of the crimes under investigation, the true identity and or location of the subjects and any co-conspirators, the names, addresses, and any disposition of the proceeds of the crimes under investigation; b. Records relating to who created, used, or communicated with the account or identi?er; c. Records pertaining to accounts held with companies providing Internet access or remote storage of tangible items, documents, data, or storage media; (1. Records relating to ownership or use of phones including passwords, pins, and keys necessary to access such devices and/ or applications on devices voicemail) e. Records, including, but not limited to, video ?les, audio ?les, images, stored messages, recordings, books, documents, and cached web pages relating to either stalking or computer intrusion scheme; f. Records re?ecting the communications with or the existence, identity, travel, or whereabouts of, any co?conspirators; g. Any other identifying information associated with the user of the account (?nancial information, employment information, patterns of behavior, etc.); h. Records of activities or usage relating to the operation or ownership of any computer hardware, software, storage media, Internet online accounts, or data (such as usernarnes, passwords, telephone records, and notes). Case Document 7 Filed 03/10/17 Page 6 of 42 ADDENDUM TO SEARCH WARRANT SEARCH OF COMPUTERS 1. The computer or electronic media search authorized by this warrant shall be completed within 60 days from the date of the warrant unless, for good cause demonstrated, such date is extended by Order of this Court. 2. In conducting the search authorized by this warrant, the government shall make reasonable efforts to utilize computer search methodology to search only for ?les, documents or other electronically stored information which are identi?ed in the warrant itself. 3. Should the government not locate any of the items speci?ed in the warrant (or other fruits, contraband, instrumentalities, or property subject to forfeiture) within the authorized search period (including any extensions granted), the government shall return the computer or electronic media to the owner. 4. In any circumstance not covered'by paragraph three (3) above, upon completion of the search, the government, upon request of the owner of the computer, shall return to the owner of the computer copies of all ?les and documents requested and speci?ed by the owner, excluding any items or ?les seized pursuant to the warrant or other fruits, contraband, instrumentalities or property subject to forfeiture. 5. If electronically stored data or documents have been identi?ed by the government pursuant to this warrant, or other fruits, contraband, instrumentalities or property subject to forfeiture, the government may retain the original hard drive or other data storage mechanism pending further order of this Court. The retention of the original hard drive or other data storage mechanism does not relieve the government of its obligation to return to the owner of the computer ?les, documents or other electronically stored information identi?ed in paragraph (4) above. 6. Nothing in this warrant shall limit or prevent the government from retaining the computer or electronic media as ?fuits, contraband or an 'mstrumentality of a crime or commencing forfeiture proceedings against the computer and/ or the data contained therein. Nothing in this warrant shall limit or prevent the owner of the computer or electronic media ?om ?ling a motion with the Court pursuant to Rule 41(g) of the Federal Rules of Criminal Procedure for the Return of Property or making a request of the government to return certain speci?ed ?les, data, software or hardware. 7. Should there be a dispute or question over ownership of any computer or any electronically stored data or documents stored therein, the government shall notify this Court so that such dispute or question can be resolved. Case Document 7 Filed 03/10/17 Page 7 of 42 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF NEW YORK IN THE MATTER OF THE SEARCH OF EMAIL ACCOUNTS: Case No. WROSICAEDGMAILCOM. WEKNOWQEMAILZACTORCOM, AND AMENDED AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT 1, Kevin Parker, being first duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I have been a Special Agent with the Federal Bureau of Investigation (FBI) since September, 2011. I am currently assigned to the Cyber Squad, Buffalo Division, in Rochester, New York. As part of the Cyber Squad, I work on investigations relating to criminal and national security cyber intrusions. I have gained experience through training and everyday work related to these types of investigations. During my tenure with the FBI I have also worked on other types of investigations including counterintelligence and counterterrorism. I am familiar with fundamental operations of the intemet, hardware, software, and the communication protocols across each. Experience with similar investigations and working with other FBI Special Agents and computer forensic professionals has expanded my knowledge of internet communications and, more speci?cally, intemet based obfuscation techniques. I have participated in the execution of warrants involving the search and seizure of computers, computer equipment, mobile phones and tablets, and electronically stored information, in conjunction with various criminal investigations. Case Document 7 Filed 03/10/17 Page investigative or law enforcement of?cer of the United States within the meaning of Title 18, United States Code, Section 2510(7); that is, an of?cer of the United States who is empowered by law to conduct investigations of, and to make arrests for, offenses enumerated in Title 18, United States Code, Section 2516. 3. I make this af?davit in support of an application for a search warrant authorizing the search of email accounts controlled by the Service Providers known as: a. AOL Inc. located at 22000 AOL Way, Dulles, VA 20166; b. Google Inc. (?Google?), located at 1600 Amphitheatre Parkway, Mountain View, CA 94043; and c. MailZWorld, Inc. (?Mail2World?), located at 10960 Wilshire Blvd., 9th Floor, Los Angeles, CA 90024, 4. The email accounts and the information to be searched are described in the following paragraphs and in Attachments A and for each Service Provider. This af?davit is made in support of an application for a search warrant under 18 U.S.C. 2703(a), 2703(b)(1)(A) and 2703 to require the Service Providers to disclose to the government records and other information in its possession pertaining to the subscriber or customer associated with the accounts, including contents of communications. 5. I respectfully submit that probable cause exists to believe that evidence, contraband, fruits, and instrumentalities of violations of Title 18, United States Code, Sections 1030 Case Document 7 Filed 03/10/17 Page 9 of 42 (unauthorized computer access and computer?related fraud) and 2261A (stalking) (the TARGET OFFENSES) will be found in the accounts: a. opssZ@aol.com; b. wrosica@gmail.com; c. weln10w@maiIZactor.com; and d. skankcatcher@mai12actor.com. 6. In my training and experience, I have learned that AOL is a company that provides multinational mass media and is a subsidiary of Verizon Communications. The company owns and operates such websites like the Huf?ngton Post, TechCrunch, and Engadget, and claims to serve 500 million global consumers. Additionally, AOL provides free Internet electronic mail (email) access to the public. I have learned that opened and unopened email for subscribers, may be located on the computers owned or leased by AOL. This application for a search warrant seeks authorization solely to search the computer accounts and/ or ?les following the procedures set forth herein. 7. In my training and experience, I have learned that Google is a company that provides Internet electronic mail (email) access to the public, and that stored electronic communications, including opened and unopened email for subscribers, may be located on the computers owned or leased by these companies. Further, I am aware that computers located at Google contain information and other stored electronic communications belonging to unrelated third parties. Accordingly, this application for a search warrant seeks authorization solely to search the computer accounts and/ or ?les following the procedures set forth herein. Case Document 7 Filed 03/10/17 Page 10 of 42 8. In my training and experience, I have learned that MailZWorld is a company that provides free email access to the public, and that stored electronic communications, including opened and unopened email for subscribers, may be located on the computers owned or leased by these companies. Further, I am aware that MailZWorld offers traditional email functionality to include contacts, calendar, organizer, bookmarks, translation, noti?er service, and group mailing. This application for a search warrant seeks authorization solely to search the computer accounts and/ or ?les following the procedures set forth herein. 9. I am familiar with the facts contained in this affidavit based upon my personal involvement in this investigation, information provided by other law enforcement agents, and private companies. Because this affidavit is submitted for the limited purpose of obtaining search warrants, have not included each and every fact known to me concerning this investigation. I have set forth facts that I believe are necessary to establish probable cause to search the above referenced facilities. RELEVANT STATUTES 10. This investigation concerns alleged violations of: 18 U.S.C. Stalking and 18 U.S.C. 1030 Fraud and Related Activity in Connection with a Computer. a. 18 U.S.C. prohibits a person from using the mail, any interactive computer service or electronic communication service with the intent to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person and that such use places that person in reasonable fear of the death of or serious bodily injury or causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress to a person. Case Document 7 Filed 03/10/17 Page 11 of 42 b. 18 U.S.C. 1030 prohibits a person from intentionally accessing a computer without authorization or exceeds authorized access and thereby obtains (C) information from any protected computer. PROBABLE CAUSE 11. On or about November 2016, the Buffalo FBI met with the New York State Police regarding an ongoing computer intrusion and stalking investigation. Initial discussions identi?ed a Rochester, New York based female (hereinafter, the ?victim?) that has been targeted throughout 2016 through the use of a variety of intemet based mediums. Following the end of a relationship with Rosica, the victim began receiving harassing text messages, phone calls, and emails. The communications slowly escalated in both content and obfuscation techniques. In addition, the victim?s work email account and online medical system (University of Rochester?s MyChart) had numerous unauthorized access attempts. Rosica also targeted the victim?s ex~husband and co? workers. Investigation results to date have shown Rosica to use the network in conjunction with other obfuscation web sites and email providers. 12. In February 2016, the victim ended a three?year relationship with Rosica. Following the end of the relationship the victim and Rosica engaged in conversations regarding the ending of the relationship. On March 3, 2016, Rosica, using the email account emailed the victim with the following, .. Please consider Speaking with me and allowing me the chance to make things clearer and more right with you. I know you are very upset. too quick to anger and too quick to accuse is NOT what I want to do ever On March 23, 2016, the victim received an anonymous text message which stated it was from ?trustmeiknow@yahoo.com? 5 Case Document 7 Filed 03/10/17 Page 12 of 42 and included the message: have already provided him with all of the information he needs to know how you played him. And you wonder why you have no friends?? 13. Also on March 23, 2016, the victim received a text message from ?anonymous@textem.net? with the message: think he knows how you played him. Arguing and ?ghting to throw him off. All while you were setting up with someone else?? 14. Based on the Af?ant?s training and expertise combined with research associated from this investigation, your Af?ant believes that ?trustmeiknow@yahoo.com? is not a real email address and was entered within a website advertising free text messaging. The website markets free text messaging services; any user with access to the internet can navigate to this website and enter a recipient?s phone number, sending email address visible when the message is received (optional), recipient mobile carrier, and message content. Your Af?ant performed a text message test on December 2, 2016, using the fake email address of ?abc@yahoo.com? and message content of ?Test?; the message was received on the Af?ant?s cellular phone and appeared to have been sent by ?abc@yahoo.com.? It is your Affiant?s belief that text messages referenced throughout the remainder of this af?davit utilize the same or similar services and that the email addresses provided are not real nor used in traditional email communications by the target user. 15. On April 17, 2016, Rosica, using the email account ogssZ@aoI.com, emailed the victim and stated the he had also been the target of harassing emails and text messages. The content of the email included the following, have had enough. All hours of the day, night, 6 Case Document 7 Filed 03/10/17 Page 13 of 42 middle of the night. If you know who is doing this please have them stop! The last two came from lrnin0@yahoo.com. I have my number blocked from that one site. Thank The email includes six attachments of screen shots taken from a mobile phone screen; the attachments included ?le names appearing to' be timestamps taken on April 17, 2016. The ?rst image had a screenshot appearing to be from with a series of incoming text messages: ?wake up and realize what it is?, ?whatever you do do not trust her she is lying bigtime you fool?, ?has she told you yet??, ?she needs to tell you something soon she is hiding something from you run! The second image had a screenshot appearing to be from lmino@yahoo.com with a series of incoming text messages: The third image had a screenshot appearing to be from iamonit@yahoo.com with a series of incoming text messages: ?she is not telling you everything. There is something going on you need to know about? ?don?t say you weren?t warned?, ?sorry to trouble you but she is up to something you really need to know about?, ?when I), CC 9 are you going to learn your She is not telling you everything shes lying to you?. The fourth image had a screenshot appearing to be from iamonit@yahoo.com with a series of incoming text messages: ?Has she told you yet? She needs to tell you something?, ?when will you learn??, ?you need to wake up?, ?wake up idioti?. The ?fth image had a screenshot appearing to be from iamonit?yahoocom with a series of incoming text messages: ?why are you wasting your time? She is a liar?, ?are you frustrated yet??, ?you have been played oh so well?, ?she has serious issues you need to know aboutll?, ?shes got someone over there right now?. The sixth image had a screenshot appearing to be from iamonit@yahoo.com with a series of incoming text messages: ?you missed out on the good information you fool?, ?you are an idiot. You deserve what you get?, ?haven?t you ?gured it out yet??, ?what a jerk off you are! She is playing you! I i I ?fuck you?, ?dumb fuck?.? Case Document 7 Filed 03/10/17 Page 14 of 42 16. On or about May 22, 2016, the victim stated that she broke off all communications with Rosica. The victim told the FBI this was one of the first milestones in the evolution of Rosica?s behavior; one of the ?rst turning points when she noticed the harassment and communications become more aggressive and technically sophisticated. 17. On June 3, 2016, the victim received an email sent from Rosica, using the email account opssZ@aol.com, the content of the email included: take responsibility for anything I have said or done that was misguided based on rumor, innuendo or from misplaced anger.? am sorry for the document I left with you because in NO WAY did I intend to imply anything from it other than your own concerns, that you have shared with me, regarding your thyroid issues. I NEVER meant that the entire document pertained to you and I should have been clearer about that. I really thought I was trying to help. Please believe that!? The document referenced by Rosica was a research paper titled, ?The Thyroid and the Mind and Emotions/Thyroid Dys?mction and Mental Disorders? and was written by a Professor of with the University of Toronto. 18. On July 16, 2016, the victim received an email sent from Rosica, using the email account cpss2@aol.c0m, the content of the email included: remain deeply concerned for your well being whether you agree with that or not. I will repeat this forever I DO NOT think you are crazy, or mental. . . I wish I could have handled the paperwork thing differently.? 19. On August 22, 2016, the victim stated she agreed to meet, in person, with Rosica. According to the Victim, Rosica stated, am at a cross?roads. Either I let you walk away and we 8 Case Document 7 Filed 03/10/17 Page 15 of 42 live our separate lives or short of killing you, I destroy every aSpect of your life. You tell me what I should do.? The victim stated her request was to be left alone and walk away. The victim identi?ed this meeting as another milestone further increasing the intensity of harassing contact and technical sophistication. 20. On August 28, 2016 Rosica, using the email account opssZ@aol.c0m, sent an email to the victim which included the following, . .And with regard to our last conversation in the park, I still remain at a cross?roads. I must protect my better interests.? 21. On September 6, 2016, the victim received multiple automated text messages from (V ictim?s cellular phone provider). The text messages provided the following, Free Msg: Your User ID is lansing862904suv. Wireless number 5856359226 can also be used to log in. Did not request? Based on your Af?ant?s training and expertise, this text message represents the attempted and potentially successful access of the victim?s online account. 22. On September 7, 2016, Rosica sent the victim an email with the following, am on the phone with the fraud department at Verizon. Since 4:05 pm. yesterday, I have had 17 attempts into my Verizon account. The password keeps getting reset. I have also had 24 attempts into my AOL account. Three step veri?cation is already in place. I have had 2 attempts into my Google account (which is odd because only a handful of people know that I even use that account). Two step verification is in place. ?Katy Jones? has now sent me 216 emails! One better than the other. She?s one busy girl. This is all legitimate and NOT bullcrapl have saved every message 9 Case Document 7 Filed 03/10/17 Page 16 of 42 from Verizon, AOL, and Grnail. I am working diligently to ?nd out the perpetrator and I am very close to going public with this and ?ling a police report if it does not stop! I am pissed, exhausted and frustrated. I do not want anyone knowing my business (which could also drag you into this). Please, if you know who is doing this, tell them to stop now! Enough is enough!? Information provided from the victim identi?ed the email account, wrosica@gmail. com as the Google account used by Rosica and the one referenced above as only being known by a handful of people. A subpoena return from Google (on January 11, 2017) identi?ed the following for wrosica@gmail.com: Name: Bill Rosica, recovery email: SMS: 585?721?7661 and last known address log in on December 16, 2016 from address 66.66.156.185. 23. The Katy Jones referenced in the email from Rosica is a reference to the email accounts katy.iones76@yandex.com and katv.iones76@muchomail.com; Rosica is referencing emails he received directly from those accounts with alleged details of what the victim was doing. For instance, the Katy Jones accounts emailed Rosica with messages stating, ?ask around shes talking all kinds of shit about you shes making you look foolis ?she is on your street right now?, and ?your job cant protect you?. Note: Yandex is a Russian multinational technology company specializing in Internet?related services and products. Yandex operates the largest search engine in Russia with about 60% market share in that country; Yandex would be comparable to Google (and Gmail) in the United States. 24. A subpoena return for the email account katv.iones76@muchomail.com identi?ed the following subscriber data: Name: Katy Jones, 123 Main St, Dallas, TX 75189, DOB: 1/1/76, 10' Case Document 7 Filed 03/10/17 Page 17 of 42 Join Date: 7/21/2016, Total Logins: 171, and Last Login on 9/12/2016 from IP address: 91.121.230.209. An open source lOOkup of the IP address identi?ed a TOR exit node. 25. On September 8, 2016, three attempted login attempts were made into the victim?s employer?s email system. The IP Addresses used for the attempted access were from TOR Network exit nodes. September 8, 2016 represents the ?rst date known in the investigation where Rosica attempted access into the victim employer?s email account. 26. Throughout the month of September 2016, additional text messages were received from with similar attempted access messages as identi?ed above. On or about the middle of September, the victim changed cellular phone numbers and online accounts; soon after switching the victim received the same automated text messages with the new online ID. Additionally, multiple additional attempts to access the victim?s employer email account were made, and all were made from TOR exit nodes. 27. On or about Labor Day weekend 2016, which was on or about September 18, 2016, the victim?s ex-husband and the victim spent the day at the Canal Days festival near the ex? husband?s residence. The victim drove her new Honda CRV to the ex-husband?s residence and parked it in the driveway. After the victim left the ex-husband?s residence in the afternoon, the ex?husband checked his mobile phone and saw multiple text messages from ?Katy Jones? referencing that the victim been at the ex?husband?s residence. The text messages included the following, ?Tell [victim] katy jones says hello?, Will make sure bill knows [victim] is at your house right now?, ?Shes been lying to bill for months [victim] has told many people you are a ll Case Document 7 Filed 03/10/17 Page 18 of 42 drunk and you abused her?, ?Tell [victim] katy is sending bill a picture of her car in your driveway while she helps you with yard work?, ?we tried to warn bill?. 28. On September 18, 2016, Rosica, using email address forwarded an email message to the victim. The content of the original forwarded message stated, ?this is [victim?s] new car parked at her err?husband?s house on [ex?husband address] have her explain why she is at her ex?s house when she has made it known he was abusive to her shes even helping him do yard work in her kaki shorts and grey t?shirt this was taken on sunday 9 18 aroun [sic] The victim con?rmed receiving a picture in the email that showed her new vehicle in her err?husband?s driveway. A digital copy of the image was provided to the FBI, which showed a Honda CRV with a NY license plate matching that of the victim?s vehicle. 29. In this September 18, 2016, forwarded email, Rosica wrote the following, ?When you decided to start sending things back to me with my name on them in July, that?s when I suspected you had someone else. We started talking again and I begged for you to tell me the truth and you kept lying, as is evident now. You knew I knew. I felt sorry for you because I thought you were going to kill yourself again like you did several years ago. Remember when you were in?patient for downing all of those phenobarbital Better yet, maybe your son needs to know just how you Did you bring with you to [victim err?husband?s] today or did you leave her home in the crate again? Doctors were right about you?Borderline Personality Disorder along with Mania and Depression (although you only ever admitted to the depression). You are pathetic, a LIAR, and the MOST untrustworthy person I have 12 Case Document 7 Filed 03/10/17 Page 19 of 42 ever met. . . What would your son think of his mother being suicidal? That is where you are headed. You have created such messes in your life that you will end up having no other option.? 30. On or about October 6, 2016, the IT Manager for the victim?s employer, was contacted by the employer?s Of?ce Manager. The Of?ce Manager informed the IT Manager that a user at the company had their email hacked. The IT Manager checked access logs, enabled two? factor authentication, and changed passwords. The IT Manager extracted available logs for the previous 180 days and voluntarily provided those to the NY State Police. Following the involvement of the FBI, the NY State Police then provided the FBI those historic logs. The review of the alleged access to the victim?s email account indicated that, with a high level of con?dence, no unauthorized access was obtained for the period of activity provided; all unauthorized activity was only attempted and either failed at an invalid password or stopped after a challenge question. On February 9, 2017 the IT Manager voluntarily provided the FBI with an updated analysis of attempted access into the victim?s email account; that analysis showed 282 unique unauthorized attempts beginning September 8, 2016 and ending on February 6, 2017. 31. On October 16, 2016, the victim received a text message from email account ?sycamoreneighbor@yahoo.com? with the mes sage: ?when sneaking around at night and switching and hiding vehicles, please remember to shut the lights off in your house so you don?t waste electricity?. The victim?s home residence is off a street with the name Sycamore. Based on your Af?ant?s training and expertise, and the investigation to date, your Af?ant believes the email address to not be an authentic Yahoo address and was only used to harass the victim. 13 Case Document 7 Filed 03/10/17 Page 20 of 42 32. On October 19, 2016, the Victim received a text message from email account with the message: ?watch your speed Winton or Monroe tonight? what time will you be at [victim?s ex?husband] or is he coming over t0night??= Based on the Af?ant?s training and expertise, and the investigation to date, your Af?ant believes the email address to not be an authentic Yahoo address. Further, your Af?ant believes the content of the messages could only be known. by physical surveillance of the victim and her residence. Your Af?ant believes these messages were used to scare the victim into believing she is being followed and that the sender, not only knows where she lives, but also knows her route home. 33. On October 25, 2016, the victim received four separate text messages with references to assisting in suicide. From email address message: From email address message: 1565 From email address message: wavs?to?commit?suicide/. From email address message: 360388/. 34. On October 26, 2016, the victim received six unique text messages from Google with a veri?cation code. Based on your Af?ant?s training and expertise, your Af?ant believes these text messages were initiated based upon unauthorized access attempts into the victim?s personal email account. 14 Case Document 7 Filed 03/10/17 Page 21 of 42 35. - On October 29, 2016, the victim received numerous text messages. A portion of those text messages provide medical characteristics of individuals with personality disorder (for example, ?people with personality disorder are also usually very impulsive, oftentimes demonstrating self-injurious behaviors?). The remaining portion of text messages reference encouraging the victim to commit suicide. Text message from to victim, message: trailer trash lying cheating ruin everything you touch liar liar liar cheater cheater liar go take some pills lots of them. Text message from to victim, message: watching the move [sic] ?me before you? twice in one week is a good sign your thinking of killing yourself again good for you do it right this time Text message from ?5857336606@txt.att.net? to victim, message: watching the move [sic] ?me before you? twice in one week is a good sign your thinking of killing yourself again good for you do it right this time Text message ?om to victim, message: watch more suicide related movies then take some more of your pills. Text message from ?email@addthis.com? to victim, message: SUBJ: 99 Little Known Facts about suicide MSG: watch more suicide related movies and tell people you are not and crazy take plenty more pills you are out of your mind and a liar. Text message from ?noreply@txt2day.com? to victim, message: by IP 46.166.188.209 MSG: interesting movie selections more suicide ?icks? 36. On October 30, 2016, the victim received an email from weknow@hotdak.net with the message: ?anyone(everyone) knows what a liar you are you cant ever keep youre stories straight with your neighbors no need to hide in any of the garages you park in we know What you do and when you do it you get no sympathy from us you ruined our quiet neighborhood with your 15 Case Document 7 Filed 03/10/17 Page 22 of 42 trailer park antics.? This was the ?rst email the victim received from the email account weknow@hotdak.net. 37. A subpoena return for the email account welmow?lhotdaknet identi?ed the following subscriber data: Name: all knowing, 123 Main St, Rochester, NY 14605, DOB: 1/1/76, Join Date: 10/30/2016, Total Logins: 124, and Last Login on 12/18/2016 from IP address: 51.15.36.187. An open source lookup of the IP address identi?ed a Europe based cloud storage and data provider. 38. On November 27, 2016, the victim received an email from weknow@hotdak.net with the message: ?youre little ?lies? werent so little after all it has unraveled all this mess people must know what a true skank you are lying ?lthy cheating trailer trash skank with a grossly fat ass and ankles as big as stumps are you tired yet of ruining others? Seek help or eat pills or both!? 39. On November 30, 2016, two attempts were made to remotely access the online University of Rochester MyChart account containing medical information for the victim. The attempts were identi?ed via automated Login ID recovery emails sent to victim?s personal email account. An interview of the victim stated she did not initiate the unauthorized attempted access but she did change her password after learning of the attempts. 40. On December 7, 2016, the victim received a phone call from Walgreens stating her prescription was ready for pick?up. After speaking with the pharmacist, victim stated that she had previously cancelled all her auto?re?ll prescriptions but for some reason this one was not cancelled. 16 Case Document 7 Filed 03/10/17 Page 23 of 42 After picking up her prescriptions the evening of December 7, 2016, the Victim received an email from wek110w@hotdak.net with the message: ?bout time you picked up youre pills at drug store youre driving is not great either hurry home so you can go to trailvervile how does it feel deep in youre mind to know you are a skank liar? don?t be surprised how many people know all of this. .. a suicidal skank liar so many people know that 41. Also on December 7, 2016, two individuals at the Victim?s employer received emails from weknow@hotdak.net. The emails were sent to the Managing Partner and Operations Manager. Content of the email stated: ?you need to look closer at her do not let her fool you if you talk to the right people they will tell you what you need to hear you should read some of the emails she has sent about youre ?rm ask the right people and you will ?nd the truth do not be fooled!? 42. An interview with the victim?s pharmacy identi?ed a pattern of anonymous and fake phone calls inquiring about the victim?s medications. The employees at the pharmacy have documented phone calls on September 26, 2016, October 20, 2016, seven times on December 1, 2016, December 2, 2016, December 3, 2016, December 4, 2016, December 6, 2014, December 14, 2016, December 15, 2016, twice on December 16, 2016, December 29, 2016, four times on December 30, 2016, January 2, 2017, and January 4, 2017. 43. On December 13, 2016, weknow@hotdak.net sent a second email to the victim?s employer?s Managing Partner and Operations Manager. The content of the message included: ?[victim] is creating this drama because she is mad about her bonus you should here her bad mouth you both shes hoping all this attention will make you feel sorry for her go look at her 17 Case Document 7 Filed 03/10/17 Page 24 of 42 emails and see what she has sent out about both of you talk to the other ?rms where holly is known as the word according to [victim] john is a ?dirty cheating lawyer? the girls at these other ?rms can con?rm this she has serious mental issues.? 44. On December 14, 2016, the victim re?lled a prescription through a Walgreens automated tool and 14 minutes later received an email from weknow@hotdak.net with the message: ?you have 2 new meds waiting for you hopefully this batch of pills will ?x youre illness if not just take the whole bottle are these antiskank pills? . . .another person found out today what a lying skank you are?. 45. On December 15, 2016, weknow@hotdak.net sent a third email to the victim?s employer?s Operations Manager. The content of the message included: ?check her emails she continues to shitalk [sic] you she has talked to a lot of girls from other ?rms about you she is looking for a new job everyday on work time she calls [Managing Partner?s ?rst name] a crook and you a word every change she gets she is already crying about her bonus dont let her fool you she creates drama so people will feel sorry for her she makes shit up all the time she is poison she has serious mental issues and is heavily medicated do not let her fool you if you want more info let me know she loves mining lives.? 46. On December 21, 2016, the victim received an email from weknow@hotdak.net with the message: ?youre plans for a new job will not go well a certain note about you has been circulated to the right people and they wont even touch youre resume they too know what a lying untrustworthy skank you are you have sent out some interesting emails over the last few months 18 Case Document 7 Filed 03/10/17 Page 25 of 42 and youre boss now is not to happy be careful of the smiling face that says ?dont worry [victim] we believe you? you will be out of a job soon enough you ?lthy lying ska 47. On December 23, 2016, the victim received an email from weknow@hotdak.net with the message: . . give the world a great present and ?nish what you started 30 years 48. On January 2, 2017, the victim reported that the someone called Walgreens impersonating the victim?s primary care physician. The FBI interviewed the Pharmacist who took that call and con?rmed an attempted call from someone who claimed they were with the ?Of?ce of [the victim?s doctor] and wanted to know details of medication for the victim. The caller hung up after the Pharmacist asked for more information regarding the Doctor?s of?ce. 49. On January 5, 2017, the victim received an email from weknow@hotdak.net with the message: . .Attempt suicide lately 50. On January 5, 2017, an email was sent from iama.skank@vandex.com to the victim?s place of employment. The recipients of the email were the Managing Partner, the Operations Manager, and Of?ce Manager. All individuals are in the direct chain of command over the victim. The message of the email was: ?did [victim] tell you how pissed she was about her bonus? she mentioned both of you by name with some of her "friends" at other ?rms she doesnt even try to hide it [character return] according to [victim] she does more work than both of you 19 Case Document 7 Filed 03/10/17 Page 26 of 42 combined, [Managing Partner]1 is having an affair with some new lawyer and [employee name] is the of?ce snitch [victim] has serious issues she should not be trusted go back and look at her outgoing emails before she deletes them [character return] if she denies any of this let me know and i will give you the names of the other people she has spoken to at the different ?rms she has serious psyco issues she has been making up stories about what is "happening" to her so she can get attention dont fall for it shes on psyco meds right now? 51. Following the delivery of the email above to the victim?s chain of command, the FBI interviewed the victim and the victim?s co-workers. The Operations Manager told the FBI that she had received three emails prior to the one on January 5, 2017; all three emails from the account (identi?ed above). The victim told the FBI that Rosica had told her, While they were dating, that he had software on his laptop that would hide his identity. 52. Your Af?ant believes that on or about January 17, 2017, Rosica created a new email account with the address Based, in part, on the email address itself, the content of subsequent emails, and the recipients of those emails, your Af?ant believes that Rosica created all three emails accounts weknow@hotdak.net, iama.skank@yandex.com and Subpoena results from MailZWorld for the email account shows an account that was created on January 17, 2017 from IP address 171 .25.l93.131, believed by the Government to be a TOR node. Records of login activity 1 The names of the individuals referenced in the email are known to your Af?ant but were withheld from this document to protect their identities. 20 Case Document 7 Filed 03/10/17 Page 27 of 42 for the weknow@mai12act0r.com account identify activity from January 17, 2017 to February 12, 2017. The IP addresses associated with the account logins were all associated with nodes. 5 3. On January 17, 2017, the victim received an email from weknow@mai12act0r.com with the message ?hey skank tell them the truth and they won't feel so sorry for you tell them the nasty things you have said about them the girls at the other ?rms know the same stuff we do you are a ?lthy lying skank?. The victim?s co?worker, Operations Manager at the law ?rm, was blind copied on the email. The victim received one additional email on January 17, 2017, four emails on January 18, 2017, and one email on January 19, 2017, and all emails were sent from weknow?mai12act0r.c0m. 54. On January 31, 2017, the FBI obtained a Network Investigative Technique (NIT) Search Warrant on the user of email accounts: weknow@hotdak.net, iama.skank@vandex.com, and wekn0w@mai12act0r.com. The purpose of the Search Warrant was to identify the user of the three email accounts. Prior investigation identi?ed the user of the accounts had been using TOR and or proxy IP addresses; the Government believes this was done to hide the true identity of the user of the accounts. Execution of the Search Warrant involved sending emails to all three accounts with attachments and or hyperlinks designed to return identifying information if and when those attachments or hyperlinks were accessed. The Search Warrant obtained approval to send a Microsoft Word attachment with an embedded image (described as the Embedded Image Option); this document when ?rst opened prompted the user to perform an action in order to View the ?ll content. If the receiver wanted to view the entire document they had to click exit ?protected view? which caused the computer to retrieve an image from an FBI owned computer. When the 21 Case Document 7 Filed 03/10/17 Page 28 of 42 image was retrieved the logging of the FBI owned computer captured the IP address (outside of the TOR session) of the computer calling to retrieve the image. The Search Warrant also obtained approval to send a hyperlink via email (described as the Hyperlink Option); this hyperlink would be disguised in an email as a professional pro?le web page of the sender. If the receiver wanted to view the pro?le page of the sender they clicked on the link which took the user to a web page operated by the FBI. Logic on the web page stated that if the user was accessing the page from any IP address other than that of Rosica?s home internet that an error page would be displayed saying this site was not accessible ?om a or Proxy IP address. The FBI believed that Rosica would access the site from a TOR node ?rst and then, upon seeing the error page, would access it from his home IP address (outside of the TOR session). Lastly, the Search Warrant obtained approval to send a Microsoft Excel attachment with embedded code (described as the Enable Macro Option) designed to return identifying information from the user?s computer. This option required the user to open the attachment and to click Enable Editing and Enable Content before the embedded code would execute and the computer would return the identifying information. 55. On February 2, 2017, the FBI executed the Embedded Image option from the NIT Search Warrant on the user of email accounts: weknow@hotdak.net, iama.skank@vandex.com, and weknow?mai123ct0r.c0m. The FBI facilitated the sending of an email from the victim?s co- worker, the Operations Manager. This individual had just received a note ?om the account at 2:58 P.M.. The Operations Manager replied to that email and copied iama.skank@vandex.com and weknow@hotdak.net. The email sent included a ?ctitious Cease and Desist Order within a Microsoft Word document. The email was sent at 3:10 P.M.. At 5:22 P.M. the server logs on the FBI owned computer showed the IP address 22 Case Document 7 Filed 03/10/17 Page 29 of 42 66.66.156.185 had retrieved the embedded image within the Microso? Word document. The IP address in the server log matched the IP address provided from Time Warner Cable in a subpoena for the account of William Robert Rosica. Further, the IP address was identi?ed by the FBI via monitoring of a Pen Register Trap and Trace of Rosica?s home intemet. Your Af?ant believes that this information collectively identi?es Rosica as the user of the email addresses welmow?uhotdaknet, iamaskank?lvandexcom, and weknow@mai12actor.com, and that R0 sica accessed these accounts from his home internet service provided via Time Warner Cable. 56. On February 2, 2017, at 7:42 P.M. the Operations Manager received an email from the email account weknow?ma?2actor.com with the subject line: ok. Content of the email included the following, ?we are not making any phone calls! she has someone doing it! we already told you this. she is a skank liar looking for drama. we will send no more emails. do youre home work. she is still shitalking you (she hates you) and [Managing Partner] and [Of?ce Manager] and [co?worker]. her resume is all over the place and she is telling people she works for a corupt firm. shame on you for beleiving her. if you only knew the level of her mental] illness?. The Government believes this was a direct response to the ?ctitious Cease and Desist Order requesting the Subject stop all incoming emails and phone calls to the business. 57. On February 6, 2017, at approximately 7:30 P.M. the victim noti?ed the Af?ant the she had just seen Rosica drive past her house. Later on February 6, 2017 at 9:20 P.M. the victim received an email to her personal Gmail account from weknow@mail2actor.c0m. In this email, the sender referenced a haircut the victim had received that evening; the victim later con?rmed that she did travel from her home to get a haircut and returned home after. The victim 23 Case Document 7 Filed 03/10/17 Page 30 of 42 received an additional email on February 7, 2017 at 12:21 P.M. from the same weknow@mai12actor.c0m account. At 6:34 P.M. on February 7, 2017 the victim received an email from skankcatcher?mai12actor.c0m. Your Af?ant believes, based on previous actions and the content within the 6:34 P.M. email, that the user of weknow@mai123ctor.com is the same user of skankcatcher?mai12actor.com. On February 13, 2017 the Honorable Jonathan W. Feldman, US Magistrate Judge with the Western District of New York, signed an amended NIT Search Warrant to include the new email address skankcatcher@mai12actor.com. 58. On February 16, 2017 the FBI executed the second phase of NIT Search Warrant; this phase sent both the Hyperlink and Enable Macro Options. At 2:35 P.M. the victim sent an email to welqrow@hotdak.net, iama.skank@vandex.com, weknowGDmailZactorxom, and skankcatcher@mai12actor.com. The email included the Microsoft Excel (Enable Macro Option) and a modi?cation to the victim?s traditional signature line including a new hyperlink to a ?ctitious professional pro?le page (Hyperlink Option). 59. On February 17, 2017, your Af?ant reviewed footage from a pole camera less than two blocks away from the residence of the victim. Your Af?ant focused the review on a window of time beginning at 7:15 P.M. to 7:45 P.M. on the evening of February 6, 2017; this was the approximate window provided by the victim when she saw Rosica drive by her residence. At 7: 18 P.M. a silver gray Chevy pickup truck was observed; the truck appeared to have four doors, tinted windows, and a cover across the truck bed. At 7:20 P.M. the Af?ant saw, what appeared to be, the same silver gray Chevy pickup truck drive through the pole camera viewpoint; in this footage the Af?ant observed a running board under both side?doors. At 7:21 P.M. the Af?ant saw, what 24 Case Document 7 Filed 03/10/17 Page 31 of 42 appeared to be, the same Silver gray Chevy pickup truck drive through the pole camera viewpoint; in this footage the Af?ant observed a half silver half black side mirror. 60. Of February 17, 2017, your Af?ant conducted physical surveillance at the employer of William Rosica. In the parking lot, a silver/ gray Chevy Silverado pickup truck was identi?ed with a covered truck bed, running board, and silver gray side mirror. It is your Af?ant?s belief that the vehicle observed through the pole camera was that of William Rosica and, that Rosica sent the email to the victim on February 6, 2017 at 9:20 P.M. after following her to get a haircut. 61. On February 19, 2017 the FBI reviewed logging of the web server hosting the pages for the Hyperlink Option. The logging showed that at 12:23:29 AM the address 51.15.58.152 accessed the web page of the Hyperlink Option; open source search of the IP address identi?ed a exit node. Approximately 30 seconds later at 12:23:56 AM the logging showed IP address 66.66.156.185 access the web page of the Hyperlink Option. The Government believes this is evidence that the user of one of the four email accounts receiving the email from the victim on February 16, 2017 accessed the ?ctitious professional pro?le page operated by the FBI, initially from within a TOR session and then from the home IP address of Rosica. Your Af?ant believes this is evidence that Rosica is user of the previously identi?ed email accounts and that he is responsible for creating these accounts in furtherance of his scheme to stalk the victim. 62. On or about January 25, 2017 the FBI initiated a Pen Register Trap and Trace (PRTT) on Rosica?s home internet. This technique provided the FBI the authority to review internet traf?c, without content, coming into and out of the 1P address_(es) associated with Rosica?s 25 Case Document 7 Filed 03/10/17 Page 32 of 42 home intemet. Since the start of the home internet PRTT, the victim and victim co?workers received approximately 30 emails and observed four attempts tO access the victim?s work email account. On or about each Of these dates and times (with the exception of two outgoing emails), the FBI observed corresponding TOR internet traf?c into or out Of Rosica?s home IP address. The Government believes this is evidence that Rosica was online in a TOR session at the same time all but two emails were received by the victim and co~workers as well as the times the victim?s employer identi?ed unauthorized email login attempts. More speci?cally, the Government believes Rosica would log in from his home Time Warner Cable internet, launch a TOR session to Ob?rscate his identity, and conduct activities associated with his scheme. 63. For the purposes Of this Search Warrant, the Af?ant has only included text messages and emails relevant to establish probable cause for this af?davit. 64. Based on my knowledge and experience, as well as the facts previously stated, there is probable cause to believe that William Rosica is in control Of the email accounts opssZ@aoLcom, wrosica@gmail.com, weknow??mai?worldxom, and Further, there is probable cause to believe the above email accounts were used in facilitation of the TARGET OFFENSES. DEFINITIONS OF TECHNICAL TERMS USED IN THIS AFFADIV AT 65. ?Computer,? as used herein, is de?ned pursuant to 18 U.S.C. 1030(e)(l) as ?an electronic, magnetic, optical, electrochemical, or other high speed data processing device 26 Case Document 7 Filed 03/10/17 Page 33 of 42 performing logical or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device.? 66. I have had training in the investigation of computer?related crimes. Based on my training, and experience, I know the following: a. The Internet is a worldwide network of computer systems operated by governmental entities, corporations, and universities. In order to access the Internet, an individual computer user must subscribe to an access provider, which Operates a host computer system with direct access to the Internet. The world wide web is a functionality of the Internet which allows users of the Internet to share information; b. With a computer connected to the Internet, an individual computer user can make electronic contact with millions of computers around the world. This connection can be made by any number of means, including modem, local area network, udreless and numerous other methods; and 0. Email is a popular form of transmitting messages and/or ?les in an electronic environment between computer users. When an individual computer user sends email, it is initiated at the user's computer, transmitted to the subscriber's mail server, then transmitted to its ?nal destination. A server is a computer that is attached to a dedicated network and serves many users. An email server may allow users to post and read messages and to communicate via electronic means. 27 Case Document 7 Filed 03/10/17 Page 34 of 42 67. With a computer connected to the Internet, an individual computer user can make electronic contact with millions of computers around the world. Many individual computer users and businesses obtain their access to the Internet through businesses known as Internet Service Providers ISPs provide their customers with access to the Internet using telephone or other telecommunications lines; provide Internet email accounts that allow users to communicate with other Internet users by sending and receiving electronic messages through the servers; remotely store electronic ?les on their customers' behalf; and may provide other services unique to each particular ISP. 68. The ISPs maintain records pertaining to the individuals or companies that have subscriber accounts with the ISP. Those records may include identifying and billing information, account access information in the form of log ?les, email transaction information, posting information, account application information, Internet Protocol addresses, and other information both in computer data format and in written record format. 69. or Network?, also known as the ?Onion Router?, is a network of computers designed to facilitate anonymity. Tor was originally designed, implemented, and deployed as a project of the US. Naval Research Laboratory for the primary purpose of protecting government communications. It is now available to the public at large. Information documenting what Tor is and how it works is provided on the publicly accessible Tor website at ect.org. In order to access the Tor network, a user must install Tor software either by downloading an add?on to the user?s web browser or by downloading the free ?Tor browser bundle? available at The Tor software protects users? privacy online by 28 Case Document 7 Filed 03/10/17 Page 35 of 42 bouncing their' communications around a distributed network of relay computers run by volunteers all around the world, thereby masking the user?s actual address which could otherwise be used to identify a user. It prevents someone attempting to monitor an Internet connection from learning what sites a user visits, prevents the sites the user visits from learning the user?s physical location, and it lets the user access sites which could otherwise be blocked. Because of the way Tor routes communications through other computers, traditional identi?cation techniques are not viable. When a user on the Tor network accesses a website, for example, the IP address of a Tor ?exit node,? rather than the user?s actual IP address, shows up in the website?s IP log. An exit node is the last computer through which a user?s communications were routed. There is no practical way to trace the user?s actual IP back through that Tor exit node IP. In that way, using the Tor network operates similarly to a proxy server that is, a computer through which communications are routed to obscure a user?s true location. BACKGROUND REGARDING GOOGLE 70. Based on my training and experience, I have learned the following about Google: a. Google is considered an electronic communications service provider because it provides its users access to electronic communications service as de?ned in Title 18,United States Code, Section 2510(15). Internet users signup for a subscription for these electronic communication services by registering on the Internet with Google. Google requests subscribers to provide basic information, such as name, gender, zip code and other personal/biographical information. However, Google does not verify the information provided. As part of its services, Google also provides its subscribers with the ability to set up email accounts; 29 Case Document 7 Filed 03/10/17 Page 36 of 42 b. Google maintains electronic records pertaining to the individuals and companies for which they maintain subscriber accounts. These records include account access information, email transaction information, and account application information; 0. Subscribers to Google may access their accounts on servers maintained or owned by Google from any computer connected to the Internet located anywhere in the world; (1. Any email that is sent to a Google subscriber is stored in the subscriber's "mail box" on Google's servers until the subscriber deletes the email or the subscriber's mailbox exceeds the storage limits preset by the internet service provider. Ifthe message is not deleted by the subscriber, the account is below the storage limit, and the subscriber accesses the account periodically, that message can remain on Google's servers inde?nitely; 6. When the subscriber sends an email, it is initiated at the user?s computer, transferred via the Internet to Google's servers, and then transmitted to its end destination. Google users have the option of saving a copy of the email sent. Unless the sender of the email speci?cally deletes the email from the Google server, the email can remain on the system inde?nitely. The sender can delete the stored email message, thereby eliminating it from the email box maintained at Google, but that message will remain in the recipient's email box unless the recipient also deletes it or unless the recipient's account has exceeded its storage limitations; f. A Google subscriber can store ?les, including emails and image ?les, on servers maintained and/ or owned by Google; and I g. Emails and image ?les stored on a Google server by a subscriber may not necessarily also be located in the subscriber's home computer. The subscriber may store emails and/ or other ?les on the Google server for which there is insuf?cient storage Space in the subscriber's own computer or which the subscriber does not wish to maintain in 30 Case Document 7 Filed 03/10/17 Page 37 of 42 his or her own computer. A search of the subscriber?s home, business, or laptop computer will therefore not necessarily uncover ?les the subscriber has stored on the Google servers. BACKGROUND REGARDING AOL 71. Based on my training and experience, I have learned the following about AOL: a. AOL is a multinational subsidiary of Verizon Communications. AOL attempts to bring intemet content to their subscribers across the world. One aSpect of business involves providing subscribers with intemet based email. b. AOL is considered an electronic communications service provider because it provides its users access to electronic communications service as defined in Title 18,United States Code, Section 2510(15). Internet users sign- 'up for a subscription for these electronic communication services by registering on the Internet with AOL. AOL requests subscribers to provide basic information, such as name, gender, zip code and other personal/biographical information. However, AOL does not verify the information provided. As part of its services, AOL also provides its subscribers with the ability to set up email accounts; 6. AOL maintains electronic records pertaining to the individuals and companies for which they maintain subscriber accounts; (1. Subscribers to AOL may access their accounts on servers maintained or owned by AOL from any computer connected to the Internet located anywhere in the world; 31 Case Document 7 Filed 03/10/17 Page 38 of 42 e. Any email that is sent to an AOL subscriber is stored in the subscriber?s mail box" on AOL's servers until the subscriber deletes the email or the subscriber?s mailbox exceeds the storage limits preset by the internet service provider. If the message is not deleted by the subscriber, the account is below the storage limit, and the subscriber accesses the account periodically, that message can remain on AOL's servers inde?nitely; f. When the subscriber sends an email, it is initiated at the user's computer, transferred via the Internet to AOL's servers, and then transmitted to its end destination. AOL users have the option of saving a copy of the email sent. Unless the sender of the email speci?cally deletes the email from the AOL server, the email can remain on the system inde?nitely. The sender can delete the stored email message, thereby eliminating it from the email box maintained at AOL, but that message will remain in the recipient's email box unless the recipient also deletes it or unless the recipient's account has exceeded its storage limitations; g. A AOL subscriber can store ?les, including emails and image ?les, on servers maintained and/ or owned by and h. Emails and image ?les stored on a AOL server by a subscriber may not necessarily also be located in the subscriber's home computer. The subscriber may store emails and/ or other ?les on the AOL server for which there is insufficient storage space in the subscriber?s own computer or which the subscriber does not wish to maintain in his or her own computer. A search of the subscriber's home, business, or laptop computer will therefore not necessarily uncover files the subscriber has stored on the AOL servers. 32 Case Document 7 Filed 03/10/17 Page 39 of 42 BACKGROUND REGARDING MAILZWORLD 72'. Based on my training and experience, I have learned the following about MailZWorld: a. MailZWorld is considered an electronic communications service provider because it provides its users access to electronic communications service as de?ned in Title 18,United States Code, Section 2510(15). Internet users sign-up for email accounts by registering on the Internet with MailZWorld. MailZWorld requests subscribers to provide basic information, such as name, gender, zip code and other personal/biographical information. However, MailZWorld does not verify the information provided; b. MailZWorld maintains electronic records pertaining to the individuals and companies for which they maintain subscriber accounts; 0. Subscribers to MailZWorld may access their accounts on servers maintained or owned by MailZWorld from any computer connected to the Internet located anywhere in the world; (1. Any email that is sent to an MailZWorld subscriber is stored in the subscriber's "mail box" on MailZWorld?s servers until the subscriber deletes the email or the subscriber?s mailbox exceeds the storage limits preset by the internet service provider. If the message is not deleted by the subscriber, the account is below the storage limit, and the subscriber accesses the account periodically, that message can remain on MailZWorld '5 servers indefinitely; 6. When the subscriber sends an email, it is initiated at the user's computer, transferred via the Internet to MailZWorld's servers, and then transmitted to its end destination. MailZWorld users have the option of saving a copy of the email sent. Unless the sender of the email speci?cally deletes the email from 33 Case Document 7 Filed 03/10/17 Page 40 of 42 the MailZWorld server, the email can remain on the system inde?nitely. The sender can delete the stored email message, thereby eliminating it from the email box maintained at MailZWorld, but that message will remain in the recipient's email box unless the recipient also deletes it or unless the recipient's account has exceeded its storage limitations; f. A MailZWorld subscriber can store ?les, including emails and image ?les, on servers maintained and/ or owned by MailZWorld; and g. Emails and image ?les stored on a MailZWorld server by a subscriber may not necessarily also be located in the subscriber's home computer. The subscriber may store emails and/ or other ?les on the MailZWorld server for which there is insufficient storage space in the subscriber's own computer or which the subscriber does not wish to maintain in his or her own computer. A search of the subscriber's home, business, or laptop computer will therefore not necessarily uncover ?les the subscriber has stored on the MaiIZWorld servers. INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 73. I anticipate executing this warrant under the Electronic Communications Privacy Act, in particular 18 U.S.C. 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant to require the Service Providers to disclose to the government copies of the records and other information (including the content of communications) particularly described in Section I in the Attachment Bs annexed hereto. Because the Service Providers are not aware of the facts of this investigation, their employees are not in a position to search for relevant evidence. hi addition, requiring the Service Providers to perform the search would be a burden upon the companies. If all the Service Providers were asked to do was produce all the ?les associated with the account, 34 Case Document 7 Filed 03/10/17 Page 41 of 42 an employee can do that easily. Requiring the Service Providers to search the materials to determine what content is relevant would add to their burden. Upon receipt of the information described in Section I in the Attachment Bs, government?authorized persons will review that information to locate the items described in Section II of Attachment Bs. CONCLUSION 74. Based on my training and experience, and the facts as set forth in this af?davit, I respectfully submit that there is probable cause to believe that in the email accounts located on computer systems owned, maintained, and/or operated by AOL, Inc., located at 22000 AOL Way, Dulles, VA 20166, Google, Inc., located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, and Mail2World, located at 10960 Wilshire Blvd, 9til Floor, Los Angeles, CA 90024, there exists evidence, contraband, fruits, and instrumentalities of violations of Title 18 U.S.C. 1030 (unauthorized computer access and computer?related fraud) and 2261A (stalking). I therefore respectfully request that the Court issue a search warrant directed to the Service Providers for the email accounts identi?ed in the Attachment As for information described in the Attachment Bs. 75. This Court has jurisdiction to issue the requested warrant because it is "a court of competent jurisdiction" as de?ned by 18 U.S.C. 2711. 18' U.S.C. 2703(a), Speci?cally, the Court is "a district court of the United States that has jurisdiction over the offense being investigated." 18 U.S.C. 2711(3)(A)(i). 76. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not required for the service or execution of this warrant. 35 Case Document 7 Filed 03/10/17 Page 42 of 42 REQUEST FOR SEALING 77. Because this investigation is continuing, disclosure of the search warrant, this af?davit, and/or this application and the attachments thereto could jeopardize the progress of the investigation. Disclosure of the search warrant at this time could jeopardize the investigation by giving the targets an opportunity to destroy evidence, change patterns of behavior, notify confederates, or ?ee from prosecution. Accordingly, I request that the Court issue an order that the search warrant, this af?davit in support of application for search warrant, the application for search warrant, and all attachments thereto be ?led under seal until further order of this Court. Respectfully submitted, Kevin Parker, Special Agent I Federal Bureau of Investigation Subscribed and swo . ch 1L, 2017 ad JONATHAN W. FELDMAN ITE STATES MAGISTRATE JUDGE 36