-_10 {'13 l? 3 09-3 .7215 ff! 12"? STEVEN W. MYHRE Actin United States Attome D. DICKINSON), 3? I 917T -3 PH 3: 59 Assistant United States Attorney District ofNevada ?110551 RATE 3' SEE Nevada Bar No. 12940 501 Las Vegas Boulevard South, Suite 1100 Las Vegas, Nevada 89101 PHONE: (702) 388-6336 NDickinsonQusdoigov Counsel for the United States UNITED STATES DISTRICT COURT DISTRICT OF NEVADA -000- IN THE MATTER OF SEARCH OF Magistrate No. INFORMATION ASSOCIATED WITH INSTAGRAM ACCOUNTS STORED AT AFFIDAVIT PREMISES CONTROLLED BY FACEBOOK CORPORATION: (Under Seal) A1 IN THE MATTER OF SEARCH OF INFORMATION ASSOCIATED WITH INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: Mariloudanley A2 IN THE MATTER OF SEARCH OF INFORMATION ASSOCIATED WITH INSTAGRAM ACCOUNTS STORED AT PREMISES CONTROLLED BY FACEBOOK CORPORATION: Mariloudanleyy A3 2: Magistrate N0. . AFFIDAVIT (Under Seal) AFFIDAVIT Magistrate No. (Und-er Seal) 10o-u. ?a Feta. IN THE MATTER OF SEARCH OF Magistrate No. 2 31 I 36}th ?0.9961 INFORMATION ASSOCIATED WITH - fr?~ - WSTAGRAM ACCOUNTS STORED AT team 9 PREMISES CONTROLLED BY 4335., FACEBOOK CORPORATION: Mariloudanleypaddoek A4 IN THE MATTER OF SEARCH OF Magistrate No. INFORMATION ASSOCIATED WITH - MSTAGRAM ACCOUNTS STORED AT AFFIDAVIT PREMISES CONTROLLED BY FACEBOOK CORPORATION: (Under Seal) maritou.danley A5 STATE OF NEVADA I COUNTY OF CLARK i 35: AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, Heather D. Burton, Special Agent, Federal Bureau of Investigation (FBI), having been duly sworn, hereby depose and say: I I INTRODUCTION AND AGENT BACKGROUND 1. Your A?iant is a Special Agent with the FBI currently assigned to the Las Vegas, Nevada Division. She has been so employed for over three years. Prior to this she, was employed for ?ve years as a United States Probation Of?cer in Memphis, Tennessee. Your A?iant is currently assigned to FBI Las Vegas Squad 6. Previously, she was assigned to the Las Vegas Safe Streets Task Force and was responsible for investigating a variety of violent crimes, to include bank robbery, kidnapping, extortion, robbery, car-jacking, assault and murder Of Federal. Of?cers, racketeering related violent Offenses, as well as long?term investigations into the activities and Operations of criminal enterprises, drug tra??icking organizations, and violent street gangs. - Your Af?ant has experience in conducting criminal investigations, including the investigation of l0 criminal groups and conspiracies as well as the collection of evidence and the identi?cation and use of witnesses. 2. Your A?iant makes this affidavit in support of an application for a search warrant for information associated with certain Instagram, LLC (hereina?er ?Instagrarn?) user 1133 that are stored at premises owned, maintained, controlled, or operated by Facebook Inc. (hereinafter ?Facebook?), a social networking company headquartered in Menlo Park, California. The information to be searched is described in the following paragraphs and in Attachment A1This af?davit is made in support of an application for a search warrant under 18 I U.S.C. 2703(a), 2703(b)(l)(A) and 2703(c)(1)(A) to require Facebook to disclose to the government records and other information in its possession, pertaining to the subscriber or customer associated with user IDs. It is submitted that the information sought through the issuance of the requested warrant constitutes evidence of the following offense: Violation of National Firearms Act chistration of Firearms, Title 26, United States Code, Section 5841. 3. The items to be searched are the associated Instagram user ID names as follows: stephenpaddock47 mariloudanley mariloudanleyy marilondanleypaddock marilou.danley 4. Because this affidavit is being submitted for the limited purpose of securing a search warrant, your A?iant has not included each and every fact known to her concerning this investigation. Your Af?ant has set forth only those facts that are necessary to establish probable cause for the above listed offense. The information used to support this search warrant was derived from reports of information obtained from witnesses as well as investigation conducted by other Agents and law enforcement of?cers related to the incident. This ai??davit contains information necessary to support probable cause to believe that the criminal offenses described herein were committed by the defendant, STEPHEN PADDOCK (hereinafter and others yet unidenti?ed, and is not intended to include each and every fact and matter observed by your A?iant or known to the Government. Moreover, to the extent this affidavit contains statements by witnesses, those statements are set forth only in part in substance and are intended to accurately convey the information, but not to be verbatim recitations- All noted times are approximate. JURISDICTION 5. This Court has jurisdiction to issue the requested warrant because it is ?a court of competentjurisdiction? as de?ned by 18 U.S.C. 2711 and 18 U.S.C. 2703(a), and Speci?cally, the Court is a ?district court of the United States (including a magistrate judge of such a court) that . . . hasjurisdiction over the offense being investigated. . . 18 U.S.C. 2711(3)(A)(i), which tack place in Las Vegas, Nevada. BACKGROUND CONCERNING INSTAGRAM 6. Instagram, which is owned by Facebook, operates a free-access-social-networking website of the same name that can be accessed at histagram alloWs its users to create their own pro?le pages, which can include a short biography, a photo of themselves, videos and other information. Users can access Instagram through its website or by using a Special electronic application created by the cornpany that allows users to access the service through a mobile device. I 7. Instagram permits users to post photos and videos to their pro?les on Instagram and otherwise share them with others on Instagram, as well as certain other social-media services, including Flickr, Facebook, and Twitter. When posting or sharing a photo or video on Instagram, a user can add a caption to it, can add various "tags" that can be used to search for the photo or video user may add the tag #vw to a photo so that people interested in Volkswagen vehicles can 7 Search for and ?nd the photo), can add location information, and can add other information, as well as apply a variety of ??lters" or other visual effects that can be used to modify the look of the posted photos. In addition, lnstagram allows users to make comments on posted photos or videos, I including photos or video that the user posts or posted by other users of Instagram. Users can also "like'l photos. 8. Upon creating an Instagram account, an Instagram user must create a unique lnstagram username and an account password. This information is collected and maintained by Instagram. 9. lnstagram asks users to provide basic identity and contact information upon registration and also allows users to provide additional identity information for their user pro?le. This information may include the user's full name, e-mail address(es), and phone as well as potentially other personal information provided directly by the user to Instagram. Once an account is created, users may also adjust various privacy and account settings for the account on Instagrarn. This information is collected and maintained by instagram. I 10. I Instagram allows users to have "friends," which are other individuals with whom the user can share information without making the information public. Friends on lnstagram may come from either contact lists maintained by the user, other third-party sdcial media websites and information, or searches conducted by the user on Instagram pro?les. This information is collected and maintained by Instagram. I 1. Instagram also allows users to "follow" another user, which means that they receive updates about pests made by the other uSer. Users may also "unfollbw" users, that is, stop following ll them or block them, which prevents the blocked user from following that user. 12. Instagram allows users to post and share various types of user content, including photos, videos comments, and other materials. User content that' IS posted to Instagram or shared through Instagrarn is collected and maintained by Instagram. 13. Instagram users can exchange private messages on Instagram with other users. These messages, which are similar to email messages, are sent to the recipient?s ?Inbox? on Instagram, which also stores cepies of messages sent by the recipient, as well as other information. 14. Users on Instagram may also search Instagram for other users or particular types of photos or other content. 15. For each user, Instagram also collects and retains information, called "log file" information, every time a user requests access to Instagrarn, whether through a web page or through an app. Among the log ?le information that Instagram's servers automatically record is the particular web requests, any Internet Protocol address associated with the request, type of browser used, any referencingfexit web pages and associated URLs, pages viewed, dates and times of access, and other information. 16. Instagram also collects and maintains "cookies," which are small text ?les that are placed on a user?s computer or mobile device and that allows Instagram to identify the browser or device's accesses to the service. I 17. Instagram also collects infonnation on the particular devices used to access Instagram. In particular, Instagram may record "device identi?ers," which includes data ?les and other information that may identify the particular electronic device that was used to access Instagram. 18. Instagram also collects metadata associated with user content. Forexample, Instagram collects any "hashtags" associated with user content keywords used), "geotags" that mark the location of a photo and which may include latitude and longitude information, comments on photos, and other information. l9. Instagram also may communicate with the user,'by email or otherwise. Instagram collects and maintains copies of communications between Instagram and the user. 20. Based on the information above, the computers of Instagram are likely to contain all the material described above with respect to accounts with the above referenced user 105, including stephenpaddock47, mariloudanley, ma?loudanleyy, mariloudanleypaddock, and mariloudanley, including stored electronic communications and information concerning subscribers and their use of Instagram, such as account access information, which would include information such as the IP addresses and devices used to access the account, as well as other account- information that might be used to identify the actual user or users of the accounts at particular times. STATEMENT OF PROBABLE CAUSE 21. On the evening of Sunday, October 1, 2017, the Route 91 Harvest, a music festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada 89119. At approximately 2208 hours, the Las Vegas Metropolitan Police Department received calls reporting shots had boon ?red at the concert and multiple victims were struck. determined the shots were coming from Rooms 134 and 135 on the 32nd ?oor of the Mandalay Bay Resort and Casino, 3950 South. Las Vegas Boulevard, Las Vegas,iNevada 89119. 22. Officers made entry into the room and located an individual later identi?ed as Stephen Paddock, 9013-. address 1372 Babbling Brook Court, Mesquite, Nevada 39034. Paddock was deceased from an apparent self~in?icted gunshot wound. 23. . O?icers found multiple firearms and hundreds of rounds of ammunition in the room in close proximity to Paddock?s body. Additionally, investigators located overa thousand rounds of ammunition and explosive material in a vehicle associated with Paddock. Further, multiple ?rearms and a large quantity of ammunition were located at Paddock?s residence at 1372 Babbling Brook Court, Mesquite. 24. Paddock?s Nevada driver?s license was located in the Mandalay Bay hotel room with Paddock, and both hotel rooms were registered in his name. A player?s club card in name of Marilou Danley was located in Paddock?s room, and the card returned to the same Babbling Brook address in - Mesquite. I 25. While monitoring an identi?ed Facebook accounts of Marilou Danley (facebook.com/marilou.danley) after the shooting, investigators noted that the account settings and privacy settings were changed on October 2, 2017, at approximately 0030 hours. At approximately 0246 hours, the Facebook account was deleted. Investigators discovered the following additional Instagram accounts associated with Stephen Paddock and Marilou Paddock: stephenpaddock47, mariloudanley, mariloudanleyy, mariloudanleypaddock, and marilon.danley. On October 3, 2017, a preservation request for all content pertaining to the these Instagram was submitted to Facebook to maximize the chance that the contents of the account remain preserved. 26. Based on my training and experience, a person who possesses large amounts of ?rearms and ammunition obtains those items over a period of time. Thus, I am requesting that the search period be from September I, 2016 to the present. 27. Based on these stated facts, it is your Af?ant?s opinion that there. is probable cause to believe that the Instagram accounts with user IDs stephenpaddockt?, mariloudanley, mariloudanleyy, ma?loudanleypaddock, and marilou.danley contain evidence related to possession of ?rearms in violation of Title 26, United States Code, Section 5841. Your A?iant also submits that a review of photos and other non-public content on the subject accounts will likely produce further evidence of prior and additional violations of the enumerated offenses. I swear, under penalty of perj ury, that the foregoing is true and correct to the best of my. knowledge and belief. INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 28. Your A?iant anticipates executing this warrant under the Electronic Communications Privacy Act, in particular 18 U.S.C. 2703(3), 2703(b)(l)(A) and by using the warrant to require acebook to disclose to the government copies of the records and other information (including the content of communications) particularly described in Section I of Attachment Upon receipt of the information described in Section I of Attachment government-authorised persons will review that information to locate the items described in section II of Attachment CONCLUSION 29. Based on the information set forth herein, Your Af?ant has probable cause to believe that in the subject accounts listed in Attachments there is proof that constitutes evidence-of the commission of criminal otfense(s); contraband, the fruits of crime and things otherwise criminally possessed; and property designed or intended for use or which is or has been used as the means of committing criminal offense(s). The evidence to be searched for and seized is set forth in Attachment which is attached hereto and incorporated herein lay reference. 30. Based on the forgoing, your Af?ant requests that the Court issue the proposed search warrant. I Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not required for the service or execution of this warrant. REQUEST FOR SEALING 31. I further request that the Court order that all papers in support of this application, including the af?davit and search warrant, be sealed until further order of the Court. These documents discuss an ongoing criminal investigation that is neither public nor known to ali of the targets of the investigation. Accordingly, there is good cause to seal these documents because their premature disclosure may seriously jeepardize thatinvestigation. SWORN TO AND SUBSCRIBED before me this my of October, 2017. CAM FERENBACH UNITED STATES MAGISTRATE JUDGE Respectfully Submitted, Heather: D. Burton, Special Agent Federal Bureau of Investigation iherebyatestammtyon that the foregoiog decument is 3 full true and correct copy 0! the original on ?le in my office. and in my leg melody. . CAM 0.8. MAGESTRATE JUDGE DISTRICTOF NEVADA 3" 94%. .mm 10 al Attachment Pronertv to Be Searched This warrant applies to information associated with the Instagram user 1135 stepbenpaddock?, that is stored at premises owned, maintained, controlled, or operated by Facebook, a cempany headquartered in 'Menio Park, California for the time period beginning September 1, 2016 to present. 11 Attachment Propertv to Be Searched This warrant applies to information associated exit}; the Instagmn user 1135 mariloudanley, that is stored at premises owned, maintained, controlled, or operated by Facebook, a company headquartered in Menlo Park, California for the time period beginning September 1, 2016 to present. 12 Attachment Property to Be Searched This warrant applies to infomation associated with the Instagram user IDs mariloudanleyy, that is stored at premises owned, maintained, controlled, or operated by Facebook, a company headquartered in Menlo Park, California for the time period beginning September 1, 2016 to present. 13 Attachment Prop 3 to Be Searched This warrant applies to information associated with the 111st user IDs mariloudanleypaddock, that is stored at premises owned, maintained, controlled, or Operated by? Facebook, a company headquartered in Menlo Park, California for the time period beginning September 1, 2016 to present. Attachment Propem to Be Searched This warrant applies to information associated with the Instagram user IDs and mariloudanley that is stored at premises owned, maintained, controlled, or operated by Facebook, .a company headquartered in Menlo Park, California for the time period beginning September 1, 2016 present. 15 Particular Things to be Seized I. Information to be disclosed by Facebook To the eXtent that the information described in Attachment A is within the possession, custody, or control of Instagram LLC (?Instagram?), including any messages, records, ?les, logs, or information that have been deleted but are still available to Instagram, or have been preserved pursuant to a request made under 18 U.S.C. 2703(0 on October 3, 2017. Facebook is required to disclose the following information to the government for each user 1135 listed in Attachment A for the period of September 1, 2016 to present: (0) (6) All contact and personal identifying information, including: full name, user identi?cation number, birth date, gender, contact e-mail addresses, Instagram passwords, Instagrarn security questions and answers, physical address (including city, state, and zip code), telephone numbers, screen names, websites, and other personal identi?ers; All activity logs for the account and all other documents showing the user?s posts and other lnstagrarn activities; All photos and videos uploaded by that user ID and all photos and videos uploaded by any. user that have that user tagged in them; All pro?le'information; status updates; links to videos, photographs, bios, articles, and other items; Wall postings; friend lists, including the fiiends? Instagram user identi?cation numbers; We and past event postings; comments; and tags; All other records of communications and messages made or received by the user, chat history, and pending ?Friend? requests; 16 (P) 01) All user content created, uploaded, or shared by the account, including any comments made by the account on photographs or other content; All IP logs, including all records of the IP addresses that logged into the account; All records of the account?s usage of the ?Like? feature, including all Instagram posts and content that the user has ?liked?; All location data associated with the account, including geotags; All data and information that has been deleted by the user; All past and present lists of ?iends created by the account; All records of Instagrarn searches performed by the account; The types of service utilized by the user; The length of service (including start date) and the means and source of any payments associated with the service (including any credit card or bank account number); All privacy settings and other account settings, including privacy settings for individual Instagram posts and activities, and all records showing which Instagram users have been blocked by the account; All records pertaining to communications between Instagram and any person regarding the user or the user?s Instagram account, including contacts with support services and records of actions taken. I All information regarding the particular device or devices used to login to or access the account, including all device identi?er information or cookie information, including all information about the particular device or devices used to access the account and the date and time of those accesses; l7 II. Information to be seized by the government All information described above in Section I that constitutes fruits, evidence, and instrumentalities of violations of: Violation of National Firearms Act Registration ofFireazms, Title 26, United States Code, Section 584] . involving STEPHEN PADDOCK and others yet unidenti?ed, including, for each user ID identi?ed on Attachment information pertaining to the following matters: Evidence showing the possession, use, purchase, or sale of ?rearms, ?rearms accessories, ammunition, or explosives'by Paddock, including through conspiring and cooperating to possess, use, purchase, or sell prohibited ?rearms, ?rearms accessories, ammunition, or explosives. Evidence indicating how and when the Instagram account was accessed or used, to determine the chronological and geographic context of account access, use, and events relating to the crime under investigation and to the Facebook account owner; Evidence indicating the Instagram account owner?s state of mind as it relates to the crime under investigation; The identity of the person(s) who created or used the user ID, including records that help reveal the whereabouts of such I The identity of the person(s) 'who communicated with the user about matters relating to the illegal possession, purchase, use, or sale of ?rearms, firearms accessories, ammunition, or explosives, including records that help reveal their whereabouts. I The Warrant expressly incorporates the Af?davit submitted in support of the Warrant, and separately sealed, as though set forth fully herein. 18 ATTACHMENT - PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED PURSUANT TO THIS SEARCH WARRANT 1. 1n executing this warrant, the government must make reasonable efforts to use methods and procedures that will locate and expose in the electronic data produced in response to this search warrant (?the Search Warrant Data?) those categories of data, ?les, documents, or other electronically stered information that are identi?ed with particularity in the warrant, while minimizing exposure or examination of irrelevant, privileged, or con?dential ?les to the extent reasonably practicable. - 2. When the Search Warrant Data is received, the government will make a duplicate copy of the Search Warrant Data (?the Search Warrant Data Copy?). The original version of the Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to return or dispose of the Search Warrant Data; production to the defense in any criminal case if authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose. The original of the Search Warrant Data will not be searched or examined except to ensure that it has been fully and completely replicated in the Search Warrant Data Copy. I 3. The investigating agents will then search the entirety of the Search Warrant Data Copy using any and all methods and procedures deemed appropriate by the United States designed to identify the information listed as Information to be Seized in Attachment B, Section II. The United States may copy, extract or otherwise segregate information or data listed as Information to be Seized in Attachment B, Section 11. Information or data so copied, extracted or otherwise segregated will no longer be subject to any handling restrictions that might be set out in this protocol beyond those required by binding law. ,To the extent evidence of crimes not within the scope of this warrant appear in plain view during this review, a supplemental or ?piggyback? warrant will be applied for in Order to further search that docmnent, data, or other item. 4. The Government will have ninety (90) days from receipt of the data disclosed under Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the Search Warrant Data Copy has been thoroughly and completely examined for any document, data, or other items identi?ed in Attachment B, Section II as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject to any further search or examination unless authorized by another search warrant or other appropriate court order. The Search Warrant Data Copy will be held and preserved for the same purposes identi?ed above in Paragraph 2. 5. The search procedures utilized for this review are at the sole discretion of the investigating and prosecuting authorities, and may include the following techniques (the following is a non-exclusive list, as other search procedures may be used): i9 examination of all of the data contained in the Search Warrant Data to view the data and determine whether that data falls within the items to be seized as set forth herein; 1). searching for and attempting to recover from the Search Warrant Data any deleted, hidden, or data to determine whether that data falls within the list of items to be seized as set forth herein (any data that is and unreadable will not be returned unless law enforcement personnel have determined that the data is not (I) an instrumentality of the offenses, (2) a fruit of the criminal activity,i(3) contraband, (4) otherwise unlaw?illy possessed, or (5) evidence of the offenses speci?ed above); c. surveying various ?le directories and the individual ?les they contain; d. opening ?les in order to determine their contents; e. using hash values to narrow the scope of what may be found. Hash values are under- inclusive, but are still a help?il tool; f. scanning storage areas; performing keyword searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are likely to appear in the evidence described in Attachment and/or 0' h. perform ing'any other data analysis technique that may be necessary to locate and retrieve the evidence described in Attachment B, Section II. Return and Review Procedures 6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: Issuing the Warrant. (2) Contents of the Warrant. (A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device warrant, the warrant must identify the person or property to be searched, identify any person or property to be seized, and designate the magistrate judge to whom it must be returned. The warrant must command the of?cer to: execute the warrant within a speci?ed time no longer than 14 days; (B) Warrant Seeking Electronically Stored Information. A warrant under Rule may authorize the seizure of electronic storage media or the seizure or copying of electronically stored information. Unless otherwise Speci?ed, the warrant authorizes a later review of the media or information consistent With the warrant. The time for executing the warrant in Rule and 20 1_o refers to the seizure or on-site cepying of the media or information, and not to any later o?ssite copying or review. I Executing and Returning the Warrant. . Wanant to Search for and Seize a Person or Property. (B) Inventory. An of?cer present during the execution of the warrant must prepare and verify an inventory of any property seized. . . . In a case involving the seizure of electronic storage media or the seizure or copying of electronically stored information, the inventory may be limited to describing the physical storage media that were seized or copied. The of?cer may retain a copy of the electronically stored-information that was seized or copied. I 7. Pursuant to this Rule, the government understands and will act in accordance with the following: a. Pursuant to Rule within fourteen (14) days of the execution of the warrant, an agent is required to ?le an inventory return with the Court, that is, to ?le an itemized list of the property seized. Execution of the warrant begins when the United States serves the warrant on the named custodian; execution is complete when the custodian provides all Search Warrant Data to the United States. Within fourteen (14) days of completion of the execution of the warrant, the inventory will be ?led. b. Pursuant to Rule 41 (2) (B), Rule governs the time within which the electronically stored information must be seized after the issuance of the warrant and copied after the execution of the warrant, not the ?later review of the media or information? seized, or the later off?site digital copying of that media. c. Under Rule 41 the inventory retmn that is to be ?led with the court may be limited to a description of the ?physical storage media? into which the Search Warrant Data that was seized was placed, not an itemization of the information or datastored on the ?physical storage media? into which the Search Warrant Data was placed; I Under Rule 41 the government may retain a copy of that information for purposes of the investigation. The government proposes that the original storage media on which the Search Warrant Data was placed plus a full image copy of the seized Search Warrant Data be retained by the government. e. Ifthe person from whom any Search Warrant Data was seized requests the return of any information in the Search Warrant Data that is not set forth in Attachment B, Section II, that information will be copied onto appropriate media and returned to theperson from whom the information was seized. 21 Of?ce of the United States Attorney - District of Nevada 50] Las Vegas Boulevard, Suite 1 100 Las Vegas, Nevada 89101 (702) 388-6336 I Attachment Property to Be Searched This warrant applies to information associated with the Instagram user IDs stephenpaddock47, that is stored at premises owned, maintained, controlled, or operated by Facebook, a company headquartered in Menlo Park, California for the time period beginning September I, 2016 to present. _11 ATTACHMENT Particular Things to be Seized I. Information to be disclosed by Facebook To the extent that the information described in Attachment A is Within the possession, custody, or control of Instagram (?Instagram?), including any messages, records, ?les, logs, or infonnation that have been deleted but are still available to Instag'ram, or have been preserved pursuant to a request made under 18 U.S.C. 270305) on October 3, 2017. Facebook is required to disclose the following information to the government for each user IDs listed in Attachment A for the period of September 1, 2016 to present: (C) (6) All contact and personal identifying information, including: full name, user identi?cation nmnber, birth date, gender, contact e?mail addresses, Instag'ram passwords, lnstagram security questions and answers, physical address (including city, state, and zip code), telephone numbers, screen names, websites, and other personal identi?ers; All activity legs for the account and all other documents showing the user?s posts and other Instagram activities; All photos and videos uploaded by that user ID and all photos and videos uploaded by any user that have that user tagged in them; All pro?le information; status Updates; links to videos, photographs, bios, articles, and other items; Wall postings; friend lists, including the ?iends? Instagram user identi?cation numbers; future and past event postings; comments; and tags; All other records of communications and messages made or received by the user, chat history, and pending ?Friend? requests; 16 (In) (0) (F) (El) All user content created, uploaded, or shared by the account, including any comments made by the account on photographs or other content; All IP logs, including all records of the IP addresses that logged into the account; All records of the account's usage of the ?Like? feature, including all Instagram posts and content that the user has ?liked?; All location data associated with the account, including geotags; All data and information that has been deleted by the user; All past and present lists of friends created by the account; All records of lnstagram searches performed by the account; The types of service utilized by the user; The length of service (including start date) and the means and source of any payments associated with the service (including any credit card or bank account number); All privacy settings and other accountsettings, including privacy settings for individual Instagram posts and activities, and all records showing users have been blocked by the account; All records pertaining to communications between histagram and any person regarding the user or the user?s Instagram account, including contacts with support services and records of actions taken. All information regarding the particular device or devices used to login to or access the account, including all device identi?er information or cookie information, including all information about the particular device or devices used to access the account and the date and time of those accesses; 17 Information to be seized by the government All information described above I that constitutes fruits, evidence, and instrumentalities of violations of: I Violation of National Firearms Act Registration of Firearms, Title 26, United States Code, Section 5841. involving STEPHEN PADDOCK and others yet unidenti?ed, including, for each user ID identi?ed on Attachment information pertaining to the following matters: (3) Evidence showing the possession, use, purchase, or sale of ?rearms, ?rearms- accessories, ammunition, or explosives by Paddock, including through conspiring and cooperating to possess, use, purchase, or sell prohibited ?rearms, ?rearms accessories,lammunition, or explosives. Evidence indicating how and when the histagram account was accessed or used, to detennine the chronological and geographic context of account access, use, and events relating to the crime under investigation and to the Facebook account owner; Evidence indicating the Instagram account owner's state of mind as it relates to the crime under hivestigation; . The identity of the person(s) who created or used the user 1D, including records that help reveal the whereabouts of such person(s). The identity of the person(s) who communicated with the user ID about matters relating to the illegal possession, purchase, use, or sale of ?rearms, ?rearms accessories, ammunition, or explosives, including records that help reveal their whereabouts. The Warrant expressly incorporates the Af?davit submitted in support of the Warrant, and separately sealed, as though set forth fully herein. 18 ATTACHMENT PROTOCOL FOR SEARCHING THE ELECTRONIC DATA SEIZED PURSUANT TO THIS SEARCH WARRANT 1. In executing this warrant, the government must make reasonable efforts to use methods and procedures that will locate and expose in the electronic data produced 111 response to this Search warrant (?the Search Warrant Data?) those categories of data, ?les, documents, or other electronically stored information that are identi?ed with particularity the warrant, while minimizing exposure or examination of irrelevant, privileged, or con?dential ?les to the extent reasonably practicable 2. When the Search Warrant Data is received, the government will make a duplicate copy of the Search Warrant Data (?the Search Warrant Data Cepy?). The original version of the Search Warrant Data will be sealed and preserved for purposes of: later judicial review or order to return or dispose of the Search Warrant Data; production to the defense in any criminal case if authorized by statute, rule, or the Constitution; for purposes of showing the chain of custody of the Search Warrant Data and the Search Warrant Data Copy; or for any other lawful purpose The original of the Search Warrant Data will not be searched or examined except to ensure that it has been fully and completely replicated 1n the Search Warrant Data Copy. 3. The investigating agents will then search the entirety of the Search Warrant Data Copy using any and all methods and procedures deemed appropriate by the United States designed to identify the information listed as Information to be Seized in Attachment B, Section 11. The United States may copy, extract or otherwise segregate information or data listed as Information to be Seized in Attachment B, Section II. Information or data so copied, extracted or otherwise segregated will no longer be subject to any handling restrictions that might be set out in this protocol beyond those required by binding law. To the extent evidence of crimes not within the scope of this warrant appear in plain view during this review, a supplemental or ?piggyback? warrant will be applied for in order to further search that document, data, or other item. 4. The Government will have ninety (90) days from receipt of the data disclosed under Attachment B, Section I to complete its examination of the Search Warrant Data Copy. Once the Search Warrant Data Cepy has been thoroughly and completely examined for any document, data, or other items identi?ed in Attachment B, Section II as Information to be Seized, the Search Warrant Data Copy will be sealed and not subject to any ?irther search or examination unless authorized by another search warrant or other appropriate court order. The Search Warrant Data Cepy will be held and preserved for the same purposes identi?ed above in Paragraph 2. 5. The search procedures utilized for this review are at the sole discretion of the . investigating and prosecuting authorities, and may include the following techniques (the following'is a non-exclusive list, as other search procedures may he used): 19 examination of allof the data contained in the Search Warrant Data to View the data and determine whether that data falls within the items to be seized as set forth herein; searching for and attempting to recover from the Search Warrant Data any deleted, hidden, or data to determine whether that data falls within the list of items to be seized as set forth herein (any data that is and unreadable will not be returned unless law enforcement personnel have determined that the data is not (1) an of the offenses, (2) a fruit of the criminal activity, (3) contraband, (4) otherwise unlawfully possessed, or (5) evidence of the offenses Speci?ed above); - surveying various ?le directories and the individual ?les they contain; opening ?les in order to determine their contents; . using hash values to narrow the mom of what may be found. Hash values are under- inclusive, but are still a helpful tool; f. scanning storage areas; g. performing keyword searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are likely . to appear in the evidence described in Attachment and/or h. performing any other data analysis technique that may be necessary to locate and retrieve the evidence described in Attachment B, Section II. Return and Review Procedures 6. Rule 41 of the Federal Rules of Criminal Procedure provides, in relevant part: Issuing the Warrant. (2) Contents of the Warrant. (A) Warrant to Search for and Seize a Person or Property. Except for a tracking-device warrant, the warrant must identify the person or property to be searched, identify any person or property to be seized, and designate the magistrate judge to whom it must be returned. The warrant must command the of?cer to: execute the warrant within a speci?ed time no longer than 14 days; (B) Warrant Seeking Electronically Stored Information. A warrant under Rule may authorize the seizure of electronic storage media or the seizure or copying of electronically stored information. Unless otherwise speci?ed, the warrant authorizes a later review of the media or information consistent with the warrant The time for executing the warrant in Rule 41 and 20 refers to the seizure or on?site copying of the media or information, and not to any later oft-site copying or review. Executing and Returning the Warrant. (1) Warrant to Search for and Seize a Person or Property. (B) Inventory. An of?cer present during the execution of the warrant must prepare and verify an inventory of any property seized. . . . In a case involving the seizure of electronic storage media or the seizure or copying of electronically stored information, the inventory may be limited to describing the physical storage media that were seized or copied The of?cer may retain a copy of the electronically stored information that was seized or copied. 7. Pursuant to this Rule, the government understands and will act in accordance with the following: a Pursuant to Rule withinfourteen (14) days of the execution of the warrant, an agent is required to ?le an inventory return with the Court, that is, to ?le an itemized list of the preperty seized. Execution of the warrant begins when the United States serves the warrant on the named custodian; execution is complete when the custodian provides all Search Warrant Data to the United States. Within fourteen (14) days of completion of the execution of the warrant, the inventory will be ?led. b. Pursuant to Rule Rule 41 governs the time Within which the electronically stored information must be seized after the issuance of the warrant and copied after the execution of the warrant, not the ?later review of the media or information? seized, or the later off-site digital copying of that media. 0. Under Rule the inventory return that is to be ?led with the court may be limited to a description of the ?physical storage media? into which the Search Warrant Data that was seized was placed, not an itemization of the information or data stored on the ?physical storage media? into which the Search Warrant Data was placed; d. Under Rule the government may retain a copy of that information for purposes of the investigation- The government proposes that the original storage media on which the Search Warrant Data was placed plus a hill nnage copy of the seized Search Warrant Data be retained by the government. e. Ifthe person from whom any Search Warrant Data was seized requests the return of any information in the Search Warrant Data that is not set forth in Attachment B, Section II, that information will be copied onto appropriate media and returned to the person from whom the - information was seized. 21 search the subject premises for evidence and instrumentalities of the subject offenses, more fully described in Attachment (attached hereto and incorporated herein by reference). I BACKGROUND OF INVESTIGATION El. 0n the evening of Sunday, October 1, 2017, Route 91 Harvest, a music festival, was in progress at 3901 South Las Vegas Boulevard, Las Vegas, Nevada. At approximately 10:08 the Las Vegas Metropolitan Police Department received calls reporting shots had been ?red at the concert and multiple victims were struck (the ?attack?). determined the shots were coming from Rooms 134- and 135 on the 32?" floor of the Mandalay Bay Resort and Casino, located due west of the festival grounds at 3950 South Las Vegas Boulevard, Las Vegas, Nevada. These rooms are an elevated position which overlooks the concert venue. Witness statements and video footage captured during the attack indiCates that the weapons being used were ?ring in a fully?automatic fashion. 7. o?cers ultimately made entry into the room and located an individual later identi?ed as Stephen Paddock. Paddock was deceased from an apparent self-inflicted I gunshot wound. 8. Paddock?s Nevada driver?s license was located in the Mandalay Bay, hotel room with Paddock, and both hotel rooms were registered in his name.' A player?s club card in name of Marilou Danley was located in~Paddock?s room, and the card returned to the address located on Babbling Brook Court in Mesquite, Nevada. FBI Agents located Danley, who was traveling outside the United States at the time of the shooting. It was ultimately determined that Danley resided with Paddock at the Babbling Brook address. I 9. On October 2, 2017, local search warrants were obtained and executed on Paddock?s Mandalay Bay hotel rooms, Paddock?s vehicle parked in the Mandalay Bay parking 2.5 garage, and two Nevada residences owed by Paddock: 1372 Babbling Brook Court', and 1735 Del Webb Parkway, Reno, Nevada. Pursuant to those searches, Of?cers and Agents found over 20 ?rearms, hundreds of rounds of un?red ammunition (much of it in preloaded high-capacity magazines), range ?nding devices, several suitcases (some partially full of pre-loaded high capacity magazines) 3 set of body armor, an apparent homemade gas mask, and hundreds of spent cartridge cases in the Mandalay Bay hotel rooms, in close proximity to Paddock's body. Over a thousand rounds of ri?e ammunition and a signi?cant amount of explosive precursor material was found in Paddock's vehicle (speci?cally the binary explosive brand-named Tannerite). Additional explosive precursor material, approximately 18 ?rearms, and over 1,000 rounds of ammunition were located at the Mesquite residence. A large quantity of ammunition and multiple ?rearms Iwere recovered from the Reno residence. 10. Immediately following the shooting, an extensive investigation was commenced which is currently being conducted jointly by and the FBI, with the substantial support of numerous state, local and federal law enforcement agencies. As of this date, 58 people have been identi?ed to have been killed in Paddock?s attack and over 500 were reportedly injured. The preliminary reviews of the crime scenes in and around the Mandalay Bay led investigators to determine that in addition to ?ring upon the crowds at the festival grounds, Paddock also . ?red several high-caliber ri?e shots at large fuel tanks within the property line of the McCarran International airport property. Multiple bullet impacts were located on the tank, which investigators believe was an attempt by Paddock to explode the tanks. 11. As the investigation progressed, investigators learned that Paddock planned the attack meticulously and took many methodical steps to avoid detection of his plot and to thwart the eventual law enforcement investigation that would follow. The steps included the apparent 1 The! search warrant for this location was approved by - .A copy of that search warrant is attached hereto as Eichibit 1. destruction and/or cencealinent of digital storage media and the use of anonymously attributed communications devices. Based on your A?iant?s training and experience, it is his belief that the methodical nature of the planning employed by Paddock, coupled with his efforts to undermine the preceding investigation, are factors indicative of a level of sophistication which is commonly found in mass casualty events such as this. However, your Af?ant notes that this ?nding was . not fully-developed in this case until several days into the investigation, after the subject premises had been searched in the hours immediately after the attack unfolded. 12. The investigation has also revealed that Paddock may have been treated for yet unidenti?ed medical conditions, and that he spent signi?cant time and expense prior to the attack purchasing and caching the weapons and other instrumentalities he used in the shooting. Some of these items included glass cutters, suitcases and a pre-paid cellular telephone. This cache included a substantial amount of ammunition, glass cutters, numerous suitcases, and at least one identi?ed pro-paid cellular telephone. 13. Investigators are currently conducting analysis of available ?nancial records. To date, this analysis has revealed that Paddock made the purchases of items used in the attack throughout the last approximately 12 months. A large portion of the ammunition and ?rearms accessory purchases appear to have been made through Internet based retailers. Law enforcement continues to investigate the sourcing of purchases made by Paddock preceding the attack. at? Subsequent to her identi?cation as Paddock's companion and cohabitant at the subject premises, Marilou Danely returned to the United States and was thereafter voluntarily interviewed by law enforcement with her attorney present. During the interview, Danley corroborated much of what had been previously deduced by investigators, but she was adamant 2 Tannerite is the brand name of a commercially available binary explosive commonly used as a reactive ri?e target in shooting sports it can also be a precursor chemical for an improvised explosive devices. C31 that she had no prior inclination of Paddock intentions to conduct the attack. While investigators obtained a DNA buccal swab sample from Danley, she spontaneously stated that her ?ngerprints would likely be found on Paddock?s ammunition because she occasionally participated in loading magazines. Barney has not been arrested and she has agreed to cooperate with investigators. Although, the investigation to date has not produced any conclusive evidence that Danley aided Paddock, had foreknowledge of his plans, or has been deceptive with law enforcement, this aspect of the investigation is still the subject of intensive review. Therefore, your Af?ant asserts, for the purposes of this a?idavit, that although there is currently no evidence to suggest criminal involvement by Danley, investigators are not yet prepared to rule this possibility out. 15. Investigators have reviewed the ?ndings of the initial search of the subject premises and have determined that an additional, more exhaustive search is required. The proposed search would be focused on ?nding items of evidence or instrumentalities that may have been concealed inside or within the curtilage of the subject premises. In addition, the search will include a more thorough effort to identify any forensic trace evidence that may be located inside or Within the curtilage of the subject premises. PROBABLE CAUSE 3.6. Your A?iant believes that probable cause exists for this Court to authorize the proposed search, and that this probable cause is relatively unchanged from the probable cause that existed in the hour after the attack when the initial search was conducted. Additionally, information received from Danley during her interview and further investigation of the crime scene, as well as a fuller understanding of Paddock?s mode of planning the attack, lead your Ai?ant to believe there is probable cause that additional evidence of the subject offenses may be located in the subject residence. The primary identi?ed resident of the subject premises, Stephen Paddock, is deceased and as such, no longer holds standing at 137 2 Babbling Brook Court. Investigators are currently unable to determine Danley?s standing to provide consent to conduct this subsequent search. Therefore, although the FBI might already have all necessary authority to conduct the proposed search, your Af?ant is seeking this search warrant out of an abundance of caution to be certain that any search conducted will comply with the Fourth Amendment and other applicable laws. CONCLUSION 18. Based upon the aforementioned facts and circumstances, it is your A?ant?s opinion that there is probable cause that the subject premises may contain evidence and instrumentalities concerning violations of the subject offenses herein. Your Af?ant?s training and experience provides the basis 'for his belief that a search of the subject premises will yield these items. As such, your Af?ant seeks this Court?s authorization to conduct a search of the subject premises as fully described in Attachment for the items sought to be seized as described in Attachment Christopher Mo eak ,Special Agent Federal Bureau of Investigation SWORN TO AN SUBSCRIBED before me is 13' day of ANCY J. KOPPE UNITED A . MAGISTRATE JUDGE Attachment Description of Propertleremise to be Searched 1372 Babbling Brook Court Mesquite, Clark County, Nevada The subject premises is described as a one story, single family residence of apparent stucco frame construction. The premises are situated in the northeast corner Babbling Brook Court, which is a cul-de-sac. The premises faces approximately southwest and is located approximately 100 feet from the intersection of Babbling Brook Court and Cool Springs Lane. I The residence is painted tan and the house numbers ?1372? are af?xed to the exterior wall facing the street. Attachment Particular Items to he Seized a thorough, microsc0pic examination and documentation of the subject premises to discover trace evidence, including but not limited to: ?ngerprints, blood, hair, ?bers and other bodily ?uid samples; ?rearms to include handguns, shotguns and ri?es, spent casings or live ammunition for the same, ?rearm accessories such as magazines or cylinders, ?rearm cleaning materials, and paperwork associated with the ownership of ?rearms; United States and foreign currency, precious metals, jewelry, property deeds and other negotiable ?nancial instruments including: stocks, bonds, securities, cashier?s checks, money drafts, and letters of credit; books, records, receipts, notes, ledgers, personal checks and other papers relating to the transportation, ordering, and purchase of ?rearms, ?rearms accessories, ammunition, explosives or explosives precursor materials, or material relating to any ideological extremism; books, records, invoices, receipts, records of real estate transactions, bank statements and related records, gambling receipts and records, passbooks, money drafts, letters of credit, money orders, bank drafts, and cashier checks, bank checks, safe deposit box keys, money wrappers, and other items evidencing the obtaining, secreting, transfer, andior concealment and {or expenditure of money; any and all ?nancial, credit card and bank account information including but not limited to bills and payment records, including those relating to the purchase of ?rearms, ?rearms accessories, ammunition, explosives, explosives precursor materials, body armor, range ?nding devices, scopes and other optical devices, glass cutters, and gas masks; any and all records relating to the medical or treatment of Stephen Paddock or Marilou Danley; all types of safes and the contents thereof, including but not limited to, wall safes, floor safes, freestanding safes, locked strong boxes, and locked containers; photographs, including still photos, negatives, video tapes, ?lms, undevelOped film and the contents therein, slides; cellular telephones address andfor telephone books, digital pagers, address and/or telephone books, Rolodex indices, electronic organizers, and papers re?ecting names, addresses, telephone numbers, pager numbers, fax numbers, e-mail addresses, Facebook account information and other contact information related to con-conspirators, ?nancial institutions, and other individuals or businesses with whom a ?nancial relationship exists; papers, ticketspnotes, receipts, and other items relating to domestic and international travel. 1. any and all electronic storage devices, including: computer hard drives and external memory devices such as ?oppy disks, ?thumb drives? (USB electronic storage drives), and compact disk and/or storage devices.3 :11. records evidencing occupancy or ownership of the premises described above, including, but not limited to, utility and telephone bills, mail envelopes, or addressed correspondence; 11. records or other items which evidence ownership or use of computer equipment found in the target location, including, but not limited to, sales receipts, bills for Internet access, and handwritten notes; 0. any and all records pertaining to the rental of self-storage units and post of?ce boxes; p. chemicals and other compounds which may constitute explosives or explosive precursors; and q. improvised, commercial or military grade explosive devices, detonators, initiators, any components thereof, or any other weapon of mass destruction. 3 Electronic equipment shall be seized, but not searched. Supplemental search warrant wiil be requested prior to the searching of seized electronic items. -