AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
Western
District
ofof
Missouri
__________ District
__________
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

Information associated with a PlayStation Network
account, that is stored at premises controlled by Sony
Interactive Entertainment America LLC

)
)
)
)
)
)

Case No. 17-SW-00121-SWH

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

Information associated with a PlayStation Network account, that is stored at premises controlled by Sony Interactive
Entertainment America LLC, 2207 Bridgepointe Parkway, San Mateo CA, as more fully described in Attachment A.

located in the

Northern

District of

California

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment B (Items to be seized), attached hereto and incorporated by reference, which is contraband,
instrumentalities, and evidence concerning provision and attempted provision of material support to a designated
foreign terrorist organization, in violation of 18 U.S.C. § 2339B.

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
✔
’ evidence of a crime;
✔
’ contraband, fruits of crime, or other items illegally possessed;

✔
’ property designed for use, intended for use, or used in committing a crime;
’ a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section

18 U.S.C. § 2339B

Offense Description

Provision and attempted provision of material support to a designated foreign
terrorist organization

The application is based on these facts:

See attched Affidavit in Support of Search Warrant and Attachment A (Place to be Searched) and Attachment B
(Items to be Seized).

✔
’ Continued on the attached sheet.
days (give exact ending date if more than 30 days:
’ Delayed notice of
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

) is requested

Applicant’s signature

Michael P. Buono, Special Agent (FBI)
Printed name and title

Sworn to before me and signed in my presence.
Date:

05/12/2017
Judge’s signature

City and state: Kansas City, MO

Sarah W. Hays, United States Magistrate Judge
Printed name and title

Case 4:17-sw-00121-SWH Document 1 Filed 05/12/17 Page 1 of 1

 17-SW-00116-SWH
17-SW-00117-SWH
17-SW-00118-SWH
17-SW-00119-SWH
17-SW-00120-SWH
17-SW-00121-SWH
17-SW-00122-SWH
17-SW-00123-SWH
and
17-SW-00124-SWH

AFFIDAVIT IN SUPPORT OF SEARCH WARRANTS
I, Michael P. Buono, with the Federal Bureau of Investigation (“FBI”), being duly sworn,
state the following is true and correct to the best of my knowledge and belief:
1.

I am a Special Agent for the FBI in Kansas City, Missouri and have been assigned

to this office since June 2016. I am currently assigned to the Joint Terrorism Task Force. I
previously worked on international terrorism matters in the FBI’s Milwaukee Field Office as a
Special Agent from July 2012 to June 2016, and I supported international terrorism cases in a
surveillance capacity from 2006 to 2012 in FBI’s Atlanta Field Office. As part of my duties on
the JTTF, I have participated in investigations of organizations and individuals engaged in
terrorism or terrorist activity. Through my experience, education, and training, I have become
familiar with methods and tradecraft utilized by terrorist organizations to communicate or engage
in activities in support of terrorism. I have gained expertise in the conduct of such investigations
through training in seminars, classes, and my daily work related to these types of investigations. I
have written, executed, and assisted in search warrants on the federal level.
2.

The statements in this affidavit are based on my personal knowledge and

observations, my training and experience, my review of documents and records, and information
obtained from other agents and witnesses with direct knowledge of the facts of this case. Because

Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 1 of 32

 this affidavit is being submitted for the limited purpose of securing the requested warrants, I have
not included each and every fact known to me concerning this investigation. I have set forth only
those facts that I believe necessary to establish probable cause in support of the requested warrants.
Where statements are described in this affidavit, they are described in their sum and substance and
not necessarily verbatim.
3.

I am currently working on an FBI investigation in the Western District of Missouri

regarding of Isse Aweis Mohamud (“Mohamud”) for provision and attempted provision of
material support and resources to a designated foreign terrorist organization, in violation of 18
U.S.C. § 2339B. As described further below, on or about April 24, 2017, Mohamud, a naturalized
U.S. citizen originally from Somalia, flew by commercial airplane from Kansas City, Missouri, to
Alexandria, Egypt. The investigation has disclosed evidence that Mohamud was in contact with
one or more persons in Egypt prior to departure, and that Mohamud intended to travel to Iraq to
fight for a foreign terrorist organization.
4.

I make this affidavit in support of nine related search warrant applications, which

include social media accounts, electronic devices, and a post office box, described below, and
more fully described in each respective Attachment A (incorporated by reference).
a.
for

a

For 17-SW-00116-SWH, I make this affidavit in support of an application
search

warrant

for

information

associated

with

an

email

account

batfly2222@yahoo.com that is stored at the premises controlled by Yahoo!, Inc., an email
provider headquartered at 701 First Avenue, Sunnyvale, California 94089.

The

information and account to be searched is described in more detail in Attachment A.
b.

For 17-SW-00117-SWH, I make this affidavit in support of an application

for a search warrant for information associated with certain accounts that are stored at the

2
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 2 of 32

 premises controlled by Microsoft Online Services, headquartered at 1 Microsoft Way,
Redmond, Washington 98052-6399. The information and accounts to be searched are
described below and in Attachment A. The information sought by this search warrant
application pertains to the following Microsoft email and Skype accounts:
c.

axe2015@outlook.com (Email)
need2014@outlook.com (Email)
live:Axe2015_1 (Skype)
live:need2014 (Skype)

For 17-SW-00118-SWH, I make this affidavit in support of an application

for a search warrant for information associated with accounts associated with Facebook
User IDs 100006694384464 and 100007009898380 that are stored at the premises
controlled by Facebook, Inc., headquartered at 1601 Willow Road, Menlo Park, CA 94025.
The information and accounts to be searched are described in more detail in Attachment
A.
d.

For 17-SW-00119-SWH, I make this affidavit in support of an application

for a search warrant for information associated with Youtube and Google+ accounts that
are stored at the premises controlled by Google, Inc., headquartered at 1600 Amphitheathre
Parkway, Mountain View, California 94043. The information and accounts to be searched
are described in more detail in Attachment A. The information sought by this search
warrant application pertains to the following accounts:
e.

Youtube account associated with need2014@outlook.com
Google+ account 112456989239606927545
Google+ account 112817789042184857158

For 17-SW-00120-SWH, I make this affidavit in support of an application

for a search warrant for information associated with Twitter accounts associated with email
addresses axe2015@outlook.com (UID: 2384157462) and need2014@outlook.com (UID:
3
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 3 of 32

 unknown) that are stored at the premises controlled by by Twitter, Inc., headquartered at
1355 Market Street, San Francisco, California 94103. The information and accounts to be
searched are described in more detail in Attachment A.
f.

For 17-SW-00121-SWH, I make this affidavit in support of an application

for a search warrant for information associated with a PlayStation Network account
associated with a Playstation4 gaming system serial number MB268546890, (LAN Cable)
Mac Address of 00:d9:d1:68:6e:4c, and Wi-Fi Mac Address of 5c:93:a2:26:d7:a3 that is
stored at premises controlled by Sony Interactive Entertainment America LLC, 2207
Bridgepointe Parkway, San Mateo, California. The information and account to be searched
is described in more detail in Attachment A.
g.

For 17-SW-00122-SWH, I make this affidavit in support of an application

for a warrant to search a Samsung cellular telephone, serial number DEC
268435462913020621, which is currently located in FBI evidence at 1300 Summit Street,
Kansas City, Missouri, and described in Attachment A.
h.

For 17-SW-00123-SWH, I make this affidavit in support of an application

for a warrant to search a Ruizu MP3 Player, which is currently located in FBI evidence at
1300 Summit Street, Kansas City, Missouri, and described in Attachment A.
i.

For 17-SW-00124-SWH, I make this affidavit in support of an application

for a search warrant for information associated with P.O. Box 11241 that is stored at
premises controlled by the United States Postal Service, located at the Antioch Station in
Kansas City, Missouri 64119, and described in Attachment A.
j.

I anticipate executing search warrants 17-SW-00116-SWH, 17-SW-00117-

SWH, 17-SW-00118-SWH, 17-SW-00119-SWH, 17-SW-00120-SWH, and 17-SW-

4
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 4 of 32

 00121-SWH requested above pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and
2703(c)(1)(A), by using the search warrants to require Yahoo, Microsoft, Facebook,
Google, Twitter and Sony to disclose to the Government copies of the records and other
information (including the content of communications) particularly described in Section I
of each respective Attachment B. Upon receipt of the information described in Section I
of Attachment B, government-authorized persons will review that information to locate the
items described in Section II of Attachment B. This Court has jurisdiction to issue the
requested warrants because it is “a court of competent jurisdiction” as defined by 18 U.S.C.
§ 2711, 18 U.S.C. §§ 2703(a), (b)(1)(A), and (c)(1)(A). Specifically, the Court is “a district
court of the United States . . . that – has jurisdiction over the offense being investigated,”
18 U.S.C. § 2711(3)(A)(i). Pursuant to 18 U.S.C. § 2703(g), the presence of a law
enforcement officer is not required for the service or execution of this warrant.
k.

For 17-SW-00122-SWH, 17-SW-00123-SWH and 17-SW-00124-SWH, I

make these search warrant applications under Rule 41 of the Federal Rules of Criminal
Procedure for a search warrant authorizing the examination of property – namely,
electronic devices and a post office box. The applied-for warrants for electronic devices,
which are in the possession of the FBI, would authorize the forensic examination of each
device for the purpose of identifying electronically stored data particularly described in
Attachment B.
5.

As set forth below, the above-listed locations are believed to contain items, more

fully described in each respective Attachment B, which constitute evidence, fruits, and
instrumentalities of violations of 18 U.S.C. § 2339B (provision of material support and resources
to a designated foreign terrorist organization) related to the travel of Mohamud from the Western

5
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 5 of 32

 District of Missouri to one or more foreign countries with the intent to join a designated foreign
terrorist organization. I assert that there is probable cause for the requested warrants based on the
following facts.
PROBABLE CAUSE
6.

On April 25, 2017, at approximately 10:55 a.m., Mohamud’s mother contacted the

Kansas City, Missouri Police Department to report Mohamud as a missing person. Mohamud’s
mother reported she dropped off Mohamud at a big box retailer to work his 1:00 p.m. to 10:00
p.m. shift on April 24, 2017. At approximately 10:00 p.m., Mohamud’s father went to the big
box retailer to pick up Mohamud, but Mohamud was not there.
7.

The FBI interviewed an employee at the big box retailer where Mohamud worked

(the “Employee”). According to the Employee, on April 24, 2017, Mohamud clocked in at work
at 1:03 p.m. The Employee later checked the store’s video cameras and saw Mohamud leave the
store at approximately 1:30 p.m. The Employee said that on April 20, 2017, Mohamud told the
Employee, “I have a lot of stuff going on in my life, a lot of stuff going on at home and I have to
do something I don’t want to do.” The Employee also reported observing a recent change in
Mohamud’s work behavior. According to the Employee, even though Mohamud had always
been consistent with his attendance at work, within the past week Mohamud failed to show for
his shift and did not notify the Employee. On another occasion, Mohamud walked out of the store
on his shift for several hours but later returned and apologized to the Employee for leaving.
8.

Mohamud took a taxi directly from the big box retailer to Kansas City International

Airport, and the FBI subsequently identified and interviewed the driver of the taxi (the “Driver”).
The Driver stated that Mohamud said he was traveling to Alexandria, Egypt to visit friends and

6
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 6 of 32

 that he planned a stay of approximately three months. The Driver stated that he observed that
Mohamud had with him only a backpack and a small tablet-like device.
9.

The FBI interviewed multiple family members throughout the course of the

investigation. Mohamud’s brother and sister expressed concerns about Mohamud traveling to
Iraq and getting involved with terrorist activities. Further, Mohamud’s brother informed the FBI
that Mohamud “wiped” the harddrive of the brother’s laptop and that prior to April 24, 2017
Mohamud deleted his (Mohamud’s) Playstation4 (“PS4”) account and data on the gaming
system. Mohamud’s brother also stated that in recent months Mohamud had installed a lock on
the door of a garage at the family’s home, was very private about the area, and did not allow anyone
to enter that room. Mohamud’s brother reported that from outside the garage he sometimes could
hear Mohamud talking on the PS4 inside the garage.
10.

After Mohamud’s departure, the FBI has interviewed confidential source (“CS”)

who reported that Mohamud’s mother informed a person that she was afraid Mohamud travelled
to fight for an extremist group. According to the CS, Mohamud’s mother stated that Mohamud
followed Sheik Abdur Raheem Green (“Sheikh Green”) and Mohamud had a contact in Egypt
with whom he regularly communicated. It is the FBI’s belief that Sheik Green is an Islamic cleric
based in the United Kingdom, and he founded the Islamic Education and Research Academy
(IERA) for which he is curently the chairman. In 2005, Sheikh Green was banned from entering
Australia for “extremist pronouncements” he made. In 2013, five IERA members left the United
Kingdom and traveled to Syria to join the Islamic State of Iraq and al-Sham (“ISIS”), a designated
foreign terrorist organization.
11.

Records obtained as part of this investigation show that on or about January 27,

2017, Mohamud submitted an application for a U.S. passport at the Gladstone Station Post Office,

7
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 7 of 32

 7170 North Broadway, Gladstone, Missouri. In response to a question on the application asking
what countries were to be visited by the applicant, Mohamud stated “Canada.” Mohamud
attached to the application a confirmed travel itinerary for a roundtrip flight from Kansas City,
Missouri to Vancouver, Canada, departing on February 8, 2017 and returning on February 15,
2017. Further investigation disclosed that Mohamud did not board any flights on this itinerary.
12.

On January 24, 2017, three days before applying for a U.S. passport, Mohamud

opened P.O. Box 11241, located at the Antioch Station Post Office in Kansas City, Missouri.
13.

Additional review of Mohamud’s travel records identified several international

flight reservations. Mohamud was scheduled for a roundtrip flight from Kansas City, Missouri
to Alexandria, Egypt, departing on April 4, 2017 and returning on May 30, 2017. Mohamud did
not take either of these flights. Mohamud took an outbound flight from Kansas City, Missouri to
Alexandria, Egypt on April 24, 2017. A return flight from Alexandria, Egypt to Kansas City,
Missouri was originally booked for July 30, 2017, however, on April 26, 2017 a flight was booked
for Mohamud to return to Kansas City, Missouri from Alexandria, Egypt on April 27, 2017.
14.

Mohamud was detained by the Egyptian authorities at some point after April 25,

2017. On May 1, 2017, the FBI interviewed Mohamud in Cairo, Egypt. The FBI interview
revealed the following, among other things:
a.

Mohamud said he explained in a departure note to his family that he wanted

to join “the Strangers.” Mohamud stated that he had watched a YouTube video about “the
Strangers.” The FBI assesses based on Mohamud’s reference to “the Strangers” that
Mohamud may have had prior interactions with individuals associated with foreign
terrorist organizations. Based on my knowledge and experience the term “Strangers”
commonly refers to jihadists, especially foreign jihadists, who travel to fight in distant

8
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 8 of 32

 lands. These individuals refer to themselves as strangers because they claim that they
adhere to the true Islam that most Muslims neglect, and they are “strange” because they
have abandoned their countries for foreign lands to fight the final battles against the
infidels. ISIS uses the term in propaganda videos and it appears in various history books
on the Islamic State.
b.

Mohamud identified various digital, computer and communication devices

that he had owned or used, including: a ASUS laptop (at his residence); a Samsung SPHM270 flip phone (on his person); a Ruizu MP3 player (on his person); an unknown model
of a MP3 player (at his Kansas City residence); and the PS4 (at his Kansas City residence).
The FBI in Cairo received from a Foreign Service National Investigator Mohamud’s
Samsung cell phone SPH-M270, serial number DEC 268435462913020621, and Ruizu
MP3 Player. Those items are currently in the FBI’s possession.
c.

Mohamud identified various email and social media accounts, including:

Batfly2222@yahoo.com, with corresponding PlayStation and Twitter accounts;
axe2015@outlook.com, with cooresponding Facebook and Twitter accounts; and
need2014@outlook.com, with cooresponding Facebook, YouTube, Skype and Twitter
accounts. Mohamud provided consent to search all of the above mentioned devices and
accounts.
15.

Based on an FBI online search of the social media and communication accounts

referencing the email addresses provided by Mohamud, the following additional accounts were
identified:

Skype

accounts

live:Axe2015_1

and

live:need2014;

Facebook

user

IDs

100007009898380 and 100006694384464; Twitter user ID 2384157462 and an unkown user ID
associated with need2014@outlook.com; and Google+ accounts 112456989239606927545 and

9
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 9 of 32

 112817789042184857158.

Based on consent provided by Mohamud, the FBI conducted a

prelimiary review of the account with Facebook user ID 100006694384464 (the “Facebook
Account”), and the associated email account need2014@outlook.com. The review revealed the
following:
a.

The Facebook Account carried the display name was “Jason Mason.” The

FBI believes that the user of the account was Mohamud, based principally on his
admission that the account was his own, and that Mohamud used the alias “Jason Mason”
to conceal his true identity in communicating via the Facebook Account.
b.

The Facebook Account’s user page indicated that the user “liked” Anwar

al-Awlaki, who the FBI knows to have been a senior recruiter and operator for the al Qaeda
foreign terrorist organization.
c.

Communications from 2014 via the Facebook Account were identified, but

nearly all of the communications postdating 2014 appeared to have been deleted. A
February 6, 2017 email sent from need2014@outlook.com via the Facebook Account
revealed that Mohamud at that time had 13 messages, 6 group invites, and 28 friend
updates. However, the FBI’s review of the Facebook Account revealed no messages in the
inbox. The need2014@outlook.com account also contained an email stating that the
account was accessed from an unusual location in Egypt on April 26, 2017. The “deleted
items” folder for the need2014@outlook.com account was empty.
d.

A review of the older communications remaining on the Facebook Account

revealed the following communication, from April 24, 2014, in which the FBI believes that
Mohamud used the alias “Jason Mason” to communicate with an unidentified person
using the name “Ali Alami”:

10
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 10 of 32

 Jason MasonThursday, April 24, 2014 at 8:58pm CDT
I Don't know that many Brothers For i live in America and it is a Place full
of disbelievers so i don't get to see that many Brothers but Am Moving to
Syria to Join the Syrian mujahideen and Fight against those who want
Islam Gone and Those Who Kick The Muslims from their Homes from
those who destroy the Muslims Lands
Jason MasonThursday, April 24, 2014 at 9:02pm CDT
I will do that after i save enough Money to Go to Saudi Arabia and
Perform the Umrah and than Finish the Quran and Learn Arabic and Than
go to Syria and Join the mujahideen inshallah
Ali AlamiThursday, April 24, 2014 at 9:04pm CDT
Beware it's not that easy journey I hope that Allah almighty guid you to
righteous mujahideen there
Ali AlamiThursday, April 24, 2014 at 9:06pm CDT
By the way you can be one of mujahideen there where you are
Jason MasonThursday, April 24, 2014 at 9:12pm CDT
Interesting I wil lSupport them in the best way i can Inshallah and i will
Join them and fight by them
Jason MasonThursday, April 24, 2014 at 9:12pm CDT
Am thinking about becoming a Sniper Inshallah
e.

In another communication, dated April 26, 2014, Mohamud used the alias

“Jason Mason” in a private message to an unidentified person using the name “Bryce
Pitcher,” to state: “A Muslim Who loves him Muslim Brother and Sisters so Much that he
is willing to Give up his whole Life to go to Syria and Fight against those who want to Rid
of Islam he would Bring along with Him So So Much Food and Money for them and Than
he would go Join His Muslim Brothers who are fighting the Against those who Kill and
Bomb His Brothers and Sisters. He is fighting for the cause of Allah. (sic).”
f.

In another private massage, on September 18, 2014, Mohamud used the

alias “Jason Mason” to ask an unidentified person how that person learned Arabic, stating

11
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 11 of 32

 that he (Mohamud) was “from Egypt” and “need[ed] to re learn it (Arabic) again as fast
as I can.”
16.

The FBI also conducted a preliminary consent search of Mohamud’s PS4 and the

search revealed that the gaming system, including any communications, was wiped clean and reset
to the original factory condition. The factory reset occurred sometime around March 30, 2017.
17.

On May 4, 2017, Mohamud returned to the United States on a flight from Egypt

to New York City, where he was interviewed by FBI agents. Mohamud reiterated his prior
statements about joining the “Strangers.” Mohamud also stated that he applied for a U.S. passport
with the intention of traveling to Egypt. The agents asked Mohamud whether he considered
traveling to any country other than Egypt when he submitted the Application, particularly a place
closer to the United States than Egypt. Mohamud said no.
18.

Later on May 4, 2017, Mohamud traveled from New York City to Kansas City,

Missouri, where he was detained by the FBI for passport fraud, in violation of 18 U.S.C. § 1542.
On May 5, 2017, criminal complaint No. 17-MJ-00081-JTM was issued by the United States
District Court for the Western District of Missouri, charging Mohamud with one count of passport
fraud, in violation of 18 U.S.C. § 1542.
19.

Based on my training, knowledge and, experience and the training, knowledge, and

experience of other investigators working on this matter, I believe that Mohamud’s behavior is
indicative of an individual who is preparing to engage in violent extremist activities including
travel overseas to join a foreign terrorist organization.

The behavioral indicators include:

expressing frustration with employment and blaming external factors for failure in career or
relationships; deleting or manipulating social media or other online accounts, either to
misrepresent location or hide extremist activities, group membership or contacts; becoming

12
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 12 of 32

 increasingly isolated by breaking contact with family and friends; booking multiple itineraries to
areas located near conflict zones; planning or attempting to travel to a conflict zone; concealing
travel to the Middle East when applying for a U.S. passport; and preparing and disseminating a
last will or letter to loved ones. In addition, the FBI assesses that Egypt is one of the known routes
for persons trying to join a foreign terrorist group. The FBI also assesses that Mohamud rented
the P.O. Box to conceal from his family communications and material that relate to his overseas
travel and possible information bearing on his overseas contacts, including possible connections
to foreign terrorist organizations.
20.

Based on my training, knowledge and experience, I know that it is likely that

individuals who travel overseas to join a foreign terrorist organization have had prior to their
departure communications with personnel associated with the foreign terrorist organization. Such
communications, which may constitute evidence of a violation of 18 U.S.C. § 2339B, are likely to
be found inside social media and email accounts, electronic devices and post office box, identified
above, that are the subjects of the applications for the requested warrants.
BACKGROUND CONCERNING EMAIL
21.

In my training and experience, I have learned that Yahoo! Inc. (“Yahoo”) and

Microsoft Corp (“Microsoft”) provides a variety of on-line services, including electronic mail
(“email”) access, to the public. Yahoo and Microsoft allow subscribers to obtain email accounts
at a domain name (e.g., yahoo.com or outlook.com), like the email accounts for
batfly2222@yahoo.com and need2014@outlook.com, described above. 1 Subscribers obtain an

1

Outlook.com is a web-based suite of webmail, contacts, tasks, and calendaring services from
Microsoft Corp (Microsoft), which was originally founded in 1996 as Hotmail. Microsoft acquired
Hotmail in 1997, which in 2013 was replaced by Outlook.com. Outlook.com features unlimited
storage, a calendar, contacts management and close integration with OneDrive, Office Online and
Skype.
13
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 13 of 32

 account by registering with Yahoo and Microsoft. During the registration process, Yahoo and
Microsoft ask subscribers to provide basic personal information. Therefore, the computers of
Yahoo and Microsoft are likely to contain stored electronic communications (including retrieved
and unretrieved email for Yahoo and Microsoft subscribers) and information concerning
subscribers and their use of Yahoo and Microsoft services, such as account access information,
email transaction information, and account application information.

In my training and

experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account’s user or users.
22.

A Yahoo or Microsoft subscriber can also store with the provider files in addition

to emails, such as address books, contact or buddy lists, calendar data, pictures (other than ones
attached to emails), and other files, on servers maintained and/or owned by Yahoo or Microsoft.
In my training and experience, evidence of who was using an email account may be found in
address books, contact or buddy lists, email in the account, and attachments to emails, including
pictures and files.
23.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber’s full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account’s user or users. Based on my training and my experience, I know that, even
if subscribers insert false information to conceal their identity, this information often provides
clues to their identity, location, or illicit activities.

14
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 14 of 32

 24.

In my training and experience, email providers typically retain certain transactional

information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in (i.e.,
session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider’s website), and other log files that reflect usage of the
account. In addition, email providers often have records of the Internet Protocol address (“IP
address”) used to register the account and the IP addresses associated with particular logins to the
account. Because every device that connects to the Internet must use an IP address, IP address
information can help to identify which computers or other devices were used to access the email
account.
25.

In my training and experience, in some cases, email account users will

communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider’s support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account’s user or users.
26.

This application seeks a warrant to search all responsive records and information

under the control of Yahoo and Microsoft, providers subject to the jurisdiction of this court,
regardless of where Yahoo and Microsoft have chosen to store such information. The Government
intends to require the disclosure pursuant to the requested warrant of the contents of wire or

15
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 15 of 32

 electronic communications and any records or other information pertaining to the customers or
subscribers if such communication, record, or other information is within Yahoo’s and Microsoft’s
possession, custody, or control, regardless of whether such communication, record, or other
information is stored, held, or maintained outside the United States. 2
27.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy”
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained
by the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime

2

It is possible that Yahoo and Microsoft store some portion of the information sought outside of
the United States. In Microsoft Corp. v. United States, 2016 WL 3770056 (2nd Cir. 2016), the
Second Circuit held that the government cannot enforce a warrant under the Stored
Communications Act to require a provider to disclose records in its custody and control that are
stored outside the United States. As the Second Circuit decision is not binding on this court, I
respectfully request that this warrant apply to all responsive information – including data stored
outside the United States – pertaining to the identified account that is in the possession, custody,
or control of Yahoo and Microsoft. The Government also seeks the disclosure of the physical
location or locations where the information is stored.
16
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 16 of 32

 under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user’s account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner’s state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner’s motive and intent to
commit a crime (e.g., communications relating to the crime), or consciousness of guilt (e.g.,
deleting communications in an effort to conceal them from law enforcement).
BACKGROUND CONCERNING SONY ACCOUNT
28.

Regarding the PS4, Sony can search its records for information related to account

setup and online activity based on a serial number and MAC Address. The PS4’s serial number
was MB268546890, the LAN Cable Mac Address was 00:d9:d1:68:6e:4c, and the Wi-Fi Mac
Address was 5c:93:a2:26:d7:a3. Sony will be requested to conduct a thorough review of their
records pertaining to online activity.
29.

In general, as with email account providers, providers like Sony ask each of their

subscribers to provide certain personal identifying information when registering for an account.
This information can include the subscriber’s full name, physical address, telephone numbers and
other identifiers, e-mail addresses, and, for paying subscribers, a means and source of payment
(including any credit or bank account number).
30.

Providers typically retain certain transactional information about the creation and

use of each account on their systems. This information can include the date on which the account
was created, the length of service, records of log-in (i.e., session) times and durations, the types of
service utilized, the status of the account (including whether the account is inactive or closed), the

17
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 17 of 32

 methods used to connect to the account, and other log files that reflect usage of the account. In
addition, providers often have records of the Internet Protocol address (“IP address”) used to
register the account and the IP addresses associated with particular logins to the account. Because
every device that connects to the Internet must use an IP address, IP address information can help
to identify which computers or other devices were used to access the account.
31.

In some cases, account users will communicate directly with a provider about issues

relating to their account, such as technical problems, billing inquiries, or complaints from other
users. Providers typically retain records about such communications, including records of contacts
between the user and the provider’s support services, as well records of any actions taken by the
provider or user as a result of the communications.
32.

There are various ways to communicate and share information via a PS4. Sony

maintains logs for PlayStation Network online identities from various sections to include “All
Friends”, “Favorite Groups”, “Following”, “Now Playing”, “Players Met”, “Friend Requests”,
“Communities”, “Events”, “Messages”, “Party”, “Profile Settings”, “Recent Activities”, and
“Trophies”.
BACKGROUND ON TWITTER
33.

Twitter, Inc. (“Twitter”) owns and operates a free-access social-networking website

of the same name that can be accessed at www.twitter.com. Twitter allows its users to create their
own profile pages, which can include a short biography, a photo of themselves, and location
information.

Twitter also permits users to create and read 140-character messages called

“Tweets,” and to restrict their Tweets to individuals whom they approve. These features are
described in more detail below.

18
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 18 of 32

 34.

Upon creating a Twitter account, a Twitter user must create a unique Twitter

username, or handle, and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
username/handle, password, and name without having to open a new Twitter account.
35.

Twitter asks users to provide basic identity and contact information, either during

the registration process or thereafter. This information may include the user’s full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user’s profile was created, the date and time at which the account
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access a given Twitter account.
36.

A Twitter user can post a personal photograph or image (also known as an “avatar”)

to his or her profile, and can also change the profile background or theme for his or her account
page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile pages.
37.

Twitter also keeps IP logs for each user. These logs contain information about the

user’s logins to Twitter including, for each access, the IP address assigned to the user and the date
stamp at the time the user accessed his or her profile.
38.

As discussed above, Twitter users can use their Twitter accounts to post “Tweets”

of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, or handle, often proceeded by the
@ sign, Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for

19
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 19 of 32

 each account, Twitter provides the user with a list of other users who have made a “favorite” or
“retweeted” the user’s own Tweets, as well as a list of all Tweets that include the user’s
username/handle (i.e., a list of all “mentions” and “replies” for that username).
39.

Twitter users can include photographs or images in their Tweets. Each Twitter

account also is provided a user gallery that includes images that the user has shared on Twitter,
including images uploaded by other services.
40.

When Twitter users want to post a Tweet that includes a link to a website, they can

use Twitter’s link service, which converts the longer website link into a shortened link that begins
with http://t.co. This link service measures how many times a link has been clicked.
41.

A Twitter user can “follow” other Twitter users, which means subscribing to those

users’ Tweets and site updates. Each user profile page includes a list of the people who are
following that user (i.e., the user’s “followers” list) and a list of people whom the user follows
(i.e., the user’s “following” list). Twitter users can “unfollow” users whom they previously
followed, and they can also adjust the privacy settings for their profile so that their Tweets are
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into “lists” that display on the right side
of the user’s home page on Twitter. Twitter also provides users with a list of “Who to Follow,”
which includes a few recommendations of Twitter accounts that the user may find interesting,
based on the types of accounts that the user is already following and who those people follow. A
“shoutout” is a slang term to request others to follow another Twitter user.
42.

In addition to posting Tweets, a Twitter user can also send Direct Messages (DMs)

to one of his or her followers. These messages are typically visible only to the sender and the
recipient, and both the sender and the recipient have the power to delete the message from the

20
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 20 of 32

 inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a particular
user, but older DMs are stored on Twitter’s database.
43.

Twitter users can configure the settings for their Twitter accounts in numerous

ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates will
not be sent to the user’s phone.
44.

Twitter includes a search function that enables its users to search all public Tweets

for keywords, usernames, or subject, among other things. A Twitter user may save up to 25 past
searches. Twitter users can also make posts searchable by topic by use of a “hashtag,” which is a
word or phrase prefixed with the “#” sign.
45.

Twitter users can connect their Twitter accounts to third-party websites and

applications, which may grant these websites and applications access to the users’ public Twitter
profiles.
46.

If a Twitter user does not want to interact with another user on Twitter, the first

user can “block” the second user from following his or her account.
47.

In some cases, Twitter users may communicate directly with Twitter about issues

relating to their account, such as technical problems or complaints. Social-networking providers
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider’s support services, as well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented from
using Twitter’s services.

21
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 21 of 32

 48.

As explained herein, information stored in connection with a Twitter account may

provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user’s account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a
search warrant at a residence. For example, profile contact information, communications, “tweets”
(status updates) and “tweeted” photos (and the data associated with the foregoing, such as date and
time) may be evidence of who used or controlled the Twitter account at a relevant time. Further,
Twitter account activity can show how and when the account was accessed or used. For example,
as described herein, Twitter logs the Internet Protocol (IP) addresses from which users access their
accounts along with the time and date. By determining the physical location associated with the
logged IP addresses; investigators can understand the chronological and geographic context of the
account access and use relating to the crime under investigation. Such information allows
investigators to understand the geographic and chronological context of Twitter access, use, and
events relating to the crime under investigation. Additionally, Twitter builds geo-location into
some of its services. If enabled by the user, physical location is automatically added to “tweeted”
communications. This geographic and timeline information may tend to either inculpate or
exculpate the Twitter account owner. Last, Twitter account activity may provide relevant insight
into the Twitter account owner’s state of mind as it relates to the offense under investigation. For
example, information on the Twitter account may indicate the owner’s motive and intent to commit

22
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 22 of 32

 a crime (e.g., information indicating a criminal plan) or consciousness of guilt (e.g., deleting
account information in an effort to conceal evidence from law enforcement).
49.

Therefore, the computers of Twitter are likely to contain all the material described

above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other account
information.
BACKGROUND ON FACEBOOK
50.

Facebook, Inc. (“Facebook”) owns and operates a free-access social networking

website of the same name that can be accessed at http://www.facebook.com. Facebook allows its
users to establish accounts with Facebook, and users can then use their accounts to share written
news, photographs, videos, and other information with other Facebook users, and sometimes with
the general public.
51.

Facebook asks users to provide basic contact and personal identifying information

to Facebook, either during the registration process or thereafter. This information may include the
user’s full name, birth date, gender, contact email addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook
also assigns a user identification number to each account.
52.

Facebook users may join one or more groups or networks to connect and interact

with other users who are members of the same group or network. Facebook assigns a group
identification number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a “Friend Request.” If the recipient of a “Friend Request”
accepts the request, then the two users will become “Friends” for purposes of Facebook and can

23
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 23 of 32

 exchange communications or view information about each other. Each Facebook user’s account
includes a list of that user’s “Friends” and a “News Feed,” which highlights information about the
user’s “Friends,” such as profile changes, upcoming events, and birthdays.
53.

Facebook users can select different levels of privacy for the communications and

information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook
users, or to anyone with access to the Internet, including people who are not Facebook users. A
Facebook user can also create “lists” of Facebook friends to facilitate the application of these
privacy settings. Facebook accounts also include other account settings that users can adjust to
control, for example, the types of notifications they receive from Facebook.
54.

Facebook users can create profiles that include photographs, lists of personal

interests, and other information. Facebook users can also post “status” updates about their
whereabouts and actions, as well as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming “events,”
such as social occasions, by listing the event’s time, location, host, and guest list. In addition,
Facebook users can “check in” to particular locations or add their geographic locations to their
Facebook posts, thereby revealing their geographic locations at particular dates and times. A
particular user’s profile page also includes a “Wall,” which is a space where the user and his or
her “Friends” can post messages, attachments, and links that will typically be visible to anyone
who can view the user’s profile.
55.

Facebook allows users to upload photos and videos, which may include any

metadata such as location that the user transmitted when s/he uploaded the photo or video. It also
provides users the ability to “tag” (i.e., label) other Facebook users in a photo or video. When a

24
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 24 of 32

 user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the
photo or video. For Facebook’s purposes, the photos and videos associated with a user’s account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that user tagged in them.
56.

Facebook users can exchange private messages on Facebook with other users.

These messages, which are similar to email messages, are sent to the recipient’s “Inbox” on
Facebook, which also stores copies of messages sent by the recipient, as well as other information.
Facebook users can also post comments on the Facebook profiles of other users or on their own
profiles; such comments are typically associated with a specific posting or item on the profile. In
addition, Facebook has a chat feature that allows users to send and receive instant messages
through Facebook. These chat communications are stored in the chat history for the account.
Facebook also has a Video Calling feature, and although Facebook does not record the calls
themselves, it does keep records of the date of each call.
57.

If a Facebook user does not want to interact with another user on Facebook, the

first user can “block” the second user from seeing his or her account.
58.

Facebook has a “like” feature that allows users to give positive feedback or connect

to particular pages. Facebook users can “like” Facebook posts or updates, as well as webpages or
content on third-party (i.e., non-Facebook) websites. Facebook users can also become “fans” of
particular Facebook pages.
59.

Facebook has a search function that enables its users to search Facebook for

keywords, usernames, or pages, among other things.
60.

Each Facebook account has an activity log, which is a list of the user’s posts and

other Facebook activities from the inception of the account to the present. The activity log includes

25
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 25 of 32

 stories and photos that the user has been tagged in, as well as connections made through the
account, such as “liking” a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user’s Facebook page.
61.

Facebook Notes is a blogging feature available to Facebook users, and it enables

users to write and post notes or personal web logs (“blogs”), or to import their blogs from other
services, such as Xanga, LiveJournal, and Blogger.
62.

The Facebook Gifts feature allows users to send virtual “gifts” to their friends that

appear as icons on the recipient’s profile page. Gifts cost money to purchase, and a personalized
message can be attached to each gift. Facebook users can also send each other “pokes,” which are
free and simply result in a notification to the recipient that he or she has been “poked” by the
sender.
63.

Facebook also has a Marketplace feature, which allows users to post free classified

ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.
64.

In addition to the applications described above, Facebook also provides its users

with access to thousands of other applications (“apps”) on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user’s access or
use of that application may appear on the user’s profile page.
65.

Facebook uses the term “Neoprint” to describe an expanded view of a given user

profile. The “Neoprint” for a given user can include the following information from the user’s
profile: profile contact information; news feed information; status updates; links to videos,
photographs, articles, and other items; notes; wall postings; friend lists, including the friends’
Facebook user identification numbers; groups and networks of which the user is a member,
including the groups’ Facebook group identification numbers; future and past event postings;

26
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 26 of 32

 rejected “Friend” requests; comments; gifts; pokes; tags; and information about the user’s access
and use of Facebook applications.
66.

Facebook also retains Internet Protocol (“IP”) logs for a given user ID or IP address.

These logs may contain information about the actions taken by the user ID or IP address on
Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook profile,
that user’s IP log would reflect the fact that the user viewed the profile, and would show when and
from what IP address the user did so.
67.

Social networking providers like Facebook typically retain additional information

about their users’ accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number).

In some cases, Facebook users may

communicate directly with Facebook about issues relating to their accounts, such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
Facebook typically retain records about such communications, including records of contacts
between the user and the provider’s support services, as well as records of any actions taken by
the provider or user as a result of the communications.
68.

As explained herein, information stored in connection with a Facebook account

may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Facebook user’s “Neoprint,” IP log, stored electronic communications, and other data retained by
Facebook, can indicate who has used or controlled the Facebook account. This “user attribution”

27
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 27 of 32

 evidence is analogous to the search for “indicia of occupancy” while executing a search warrant
at a residence. For example, profile contact information, private messaging logs, status updates,
and tagged photos (and the data associated with the foregoing, such as date and time) may be
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook
account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their
accounts along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understand the chronological and geographic context of the
account access and use relating to the crime under investigation. Such information allows
investigators to understand the geographic and chronological context of Facebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo-location into
some of its services. Geo-location allows, for example, users to “tag” their location in posts and
Facebook “friends” to locate each other. This geographic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may
provide relevant insight into the Facebook account owner’s state of mind as it relates to the offense
under investigation. For example, information on the Facebook account may indicate the owner’s
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from
law enforcement).
69.

Therefore, the computers of Facebook are likely to contain all the material

described above, including stored electronic communications and information concerning
subscribers and their use of Facebook, such as account access information, transaction information,
and other account information.

28
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 28 of 32

 ELECTRONIC STORAGE AND FORENSIC ANALYSIS
70.

Based on my knowledge, training, and experience, I know that electronic devices

can store information for long periods of time. Similarly, things that have been viewed via the
Internet are typically stored for some period of time on the device. This information can sometimes
be recovered with forensic tools.
71.

There is probable cause to believe that things that were once stored on the devices

may still be stored there, for at least the following reasons:
a.

Based on my knowledge, training, and experience, I know that computer

files or remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted or viewed via the Internet. Electronic files
downloaded to a storage medium can be stored for years at little or no cost. Even when
files have been deleted, they can be recovered months or years later using forensic tools.
This is because when a person “deletes” a file on a computer, the data contained in the file
does not actually disappear; rather that data remains on the storage medium until it is
overwritten by new data.
b.

Therefore, deleted files, or remnants of deleted files, may reside in free

space or slack space—that is, in space on the storage medium that is not currently being
used by an active file—for long periods of time before they are overwritten. In addition, a
computer’s operating system may also keep a record of deleted data in a “swap” or
“recovery” file.
c.

Wholly apart from user-generated files, computer storage media—in

particular, computers’ internal hard drives—contain electronic evidence of how a computer
has been used, what it has been used for, and who has used it. To give a few examples,

29
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 29 of 32

 this forensic evidence can take the form of operating system configurations, artifacts from
operating system or application operation, file system data structures, and victual memory
“swap” or paging files. Computer users typically do not erase or delete this evidence,
because special software is typically used for that task. However, it is technically possible
to delete this information.
d.

Similarly, files that have been viewed via the Internet are sometimes

automatically downloaded into a temporary Internet directory or “cache.”
72.

Forensic evidence. As further described in Attachment B, this application seeks

permission to locate not only electronically stored information that might serve as direct evidence
of the crimes described in the warrant, but also forensic evidence that establishes how the devices
were used, the purpose of their use, who used them, and when. There is probable cause to believe
that this forensic electronic evidence might be on the devices because:
a.

Data on the storage medium can provide evidence of a file that was once on

the storage medium but has since been deleted or edited, or of a deleted portion of a file
(such as a paragraph that has been deleted from a word processing file). Virtual memory
paging systems on traditional computers can leave traces of information on the storage
medium that show what tasks and processes were recently active. Web browsers, email
programs, and chat programs store configuration information on the storage medium that
can reveal information such as online nicknames and passwords. Operating systems can
record additional information, such as the attachment of peripherals, the attachment of USB
flash storage devices or other external storage media, and the times the computer was in
use. Computer file systems can record information about the dates files were created and
the sequence in which they were created.

30
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 30 of 32

 b.

Forensic evidence on a device can also indicate who has used or controlled

the device. This “user attribution” evidence is analogous to the search for “indicia of
occupancy” while executing a search warrant at a residence.
c.

A person with appropriate familiarity with how an electronic device works

may, after examining this forensic evidence in its proper context, be able to draw
conclusions about how electronic devices were used, the purpose of their use, who used
them, and when.
d.

The process of identifying the exact electronically stored information on a

storage medium that are necessary to draw an accurate conclusion is a dynamic process.
Electronic evidence is not always data that can be merely reviewed by a review team and
passed along to investigators. Whether data stored on a computer is evidence may depend
on other information stored on the computer and the application of knowledge about how
a computer behaves. Therefore, contextual information necessary to understand other
evidence also falls within the scope of the warrant.
e.

Further, in finding evidence of how a device was used, the purpose of its

use, who used it, and when, sometimes it is necessary to establish that a particular thing is
not present on a storage medium.
f.

I know that when an individual uses an electronic device to make posts on

social media or communicate with victims as described in this affidavit, the individual’s
electronic device will generally serve both as an instrumentality for committing the crime,
and also as a storage medium for evidence of the crime. The electronic device is an
instrumentality of the crime because it is used as a means of committing the criminal
offense. The electronic device is also likely to be a storage medium for evidence of crime.

31
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 31 of 32

 From my training and experience, I believe that an electronic device used to commit a
crime of this type may contain: data that is evidence of how the electronic device was used;
data that was sent or received; and other records that indicate the nature of the offense.
73.

Nature of examination.

Based on the foregoing, and consistent with Rule

41(e)(2)(B), the warrants I am applying for would permit the examination of the devices consistent
with the warrant. The examination may require authorities to employ techniques, including but
not limited to computer-assisted scans of the entire medium, that might expose many parts of the
device to human inspection in order to determine whether it is evidence described by the warrants.
74.

Manner of execution. Because this warrant seeks only permission to examine a

device already in law enforcement’s possession, the execution of this warrant does not involve the
physical intrusion onto a premises. Consequently, I submit there is reasonable cause for the Court
to authorize execution of the warrant at any time in the day or night.

_____________________________
Michael P. Buono, Special Agent
Federal Bureau of Investigation
12th day of May, 2016.
Subscribed and sworn before me this _____

____________________________
HONORABLE SARAH W. HAYS
Chief United States Magistrate Judge
Western District of Missouri

32
Case 4:17-sw-00121-SWH Document 1-1 Filed 05/12/17 Page 32 of 32

 ATTACHMENT A
(17-SW-121-SWH)
Location to Be Searched
This warrant applies to information associated with the PlayStation Network account associated
with a PlayStation 4 gaming system serial number MB268546890, LAN Cable Mac Address of
00:d9:d1:68:6e:4c, and WiFi Mac Address of 5c:93:a2:26:d7:a3. This is stored at the premises
owned, maintained or operated by Sony Interactive Entertainment America LLC, 2207
Bridgepointe Parkway, San Mateo, California.

Case 4:17-sw-00121-SWH Document 1-2 Filed 05/12/17 Page 1 of 1

 ATTACHMENT B
(17-SW-00121-SWH)
Items to Be Seized
I.
Information to be disclosed by Sony Interactive Entertainment America LLC
(“Sony”):
below

1.
To the extent that the information described in Attachment A (“Location to Be
Searched”) is within the possession, custody, or control of, Sony, including any emails, records,
files, logs, or information that have been deleted but are still available to Sony, or have been
preserved pursuant to a request made under 18 U.S.C. § 2703(f), Sony. is required to disclose the
following information to the Government for the account listed in Attachment A:
a.
The contents of all communications associated with the account, included
stored or preserved copies of emails, chats, or other messages sent to and from the account, draft
emails, and the source and destination addresses associated with each email, the date and time at
which each email was sent, and the size and length of each email;
b.
All records or other information regarding the identification of the
account, to include full name, physical address, telephone numbers and other identifiers, records
of session times and durations, the date on which the account was created, the length of service,
the types of service utilized, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses provided
during registration, methods of connecting, log files, and means and sources of payment
(including any credit or bank account number);
c.

The types of services utilized; and

d.
All records pertaining to communications between Sony and any person
regarding the account, including contacts with support services and records of actions taken.
II.

Information to be seized by the Government

2.
All information described above in Section I that constitutes contraband, fruits,
evidence and instrumentalities of violations of Title 18, United States Code, Section 2339B,
including, for each account listed on Attachment A (“Location to Be Searched”), and
information pertaining to the communications related to the activities described in the supporting
affidavit since January 2014, to the date of this warrant, and involving the following matters:
a.
Records, communications, documents, files or photographs, in whatever
form, which evidence the ownership and identify the user, or location of the user, of the accounts
listed in Attachment A;

Case 4:17-sw-00121-SWH Document 1-3 Filed 05/12/17 Page 1 of 2

 b.
Communications, in any form, received or sent by the user of any account
listed in Attachment A which relate to the overseas travel, persons located overseas, persons
travelling overseas;
c.
Communications, in any form, received or sent by the user of any account
listed in Attachment A which are with or relate to persons associated in any way with any
designated foreign terrorist organization;
d.
Communications, in any form, received or sent by the user of any account
listed in Attachment A which relate to support or efforts to support any designated foreign
terrorist organization;
e.
Communications, in any form, received or sent by the user of any account
listed in Attachment A which relate to the activities of any designated foreign terrorist
organization;
f.
Communications, in any form, received or sent by the user of any account
listed in Attachment A which relate to attaining membership in or association with any
designated foreign terrorist organization;
g.
Records, communications, documents, files or photographs, in whatever
form, which evidence the identity of persons communicating with the user of any account listed
in Attachment A about foreign travel or activities of any designated foreign terrorist
organization; and
h.
Records, communications, documents, files or photographs, in whatever
form, which evidence the deletion or removal of communications sent or received via any
account listed in Attachment A.

2
Case 4:17-sw-00121-SWH Document 1-3 Filed 05/12/17 Page 2 of 2