ma?er of Film No. File No. SEARCH WARRANT STATE OF NORTH CAROLINA In the General court of Justice WAKE Superior Court Division Accounts associated with the area near the location between 6:00pm EST and 7:00pm EST, on 11-07-2016, AND between 5:25pm EST and 6:25pm EST on 11-08?2016, maintained on computer Servers controlled by Google, Inc. Date Issued Time issued 03/08/2017 I 55 RAM PM Detective Mark Quagliarello Name of additional Af?ant Detective E.R. Emser Name of Additional Af?ant RETURN OF SERVICE I certify that this Search WARRANT was received and executed as follows: Time Received EAMDPM Date Received Date Execut 0 50/ Date and Time Return [E/Imade a earch of I Mr [114.4 I AM [NI?fl, I, as commanded. on. . . seized the items listed on the' attached Inventory. El 1 did not seize any items. This warrant was not executed within48 hours of the date of issuance and I hereby return it not executed Signature of Officer Making Return To any of?cer with authority and jurisdiction to conduct the Search authorized by this Search Warrant: I, the undersigned, find that there is probable cause to believe that the property and person described in the application on the reverse side and related to the commission of a crime 18 located as describe the application. You are commanded to search the premises, vehicle, person, and other place or item described in the application for the property and person in question. If the property and/or person are found, make the seizure and keep the property subject to Court Order and process the person according to law. You are directed to execute this Search Warrant within forty-eight (48) hours from the time indicated on this warrant and make due return to the Clerk of Issuing Court. This 363mb Warrant is issued upon information furnished under oath by the person or persons shown. *mmg Asst. El cl fSuperiO Magistrate EI- District Ct. Judge uperior CT. f- Dep; mentor Agency ofO ce . A0 - 8/83 . .. APPLICATION FOR SEARCH WARRANT I, Mark Quagliarello of the Raleigh Police Department, being duly sworn, request that the Court issue?a warrant to search the person, place, vehicle, and other items described in this application and to ?nd and seize the property and person. described in this application. There is probable 'cause to believe that (Describe property to be seized; or if search warrant is to be used for searching a place to serve an arrest warrant or other process, name person to be arrested.) SEE ATTACHED TO BE constitutes evidence of a crime and the identity of a person participating in a crime, Murder and is located (check appropriate box(s) and fill-in speci?ed information) I VA in the follouiing premises: SEE ATTACHED TO BE (and) on the following person(s) Cl (and) in the following vehicle(s) (and) (Name or describe other places or items to be searched, if applicable) The applicant swears to the following facts to establish probable cause for the issuance of a search warrant: SEE ATTACHED CAUSE SWORN AND SUBSCRIBED TO BEFORE 1NIE 0V1 Signat SWof Applicant Cl Deputy Asst El Cifyof Super@ Court Cl Magistrate Wudge - In addition to the af?davit inclu?ded above, this application is supported by additional attached, made by the above named applicant In addition to the af?davit included above, this application is supported by sworn testimony given by: This testimony has been reduced to writing tape recorded and I have ?led each with the Clerk. If a continuation is necessary, continue the statement on an attached sheet of paper with notation saying ?see attachment.? Date the continuation and include on it the signatures of applicant and issuing official. APPLICATION FOR SEARCH WARRANT I, Mark Quagliarello of the Raleigh Police Department, being duly sworn, request that the Court issue a warrant to search the person, place, vehicle, and other items described in this application and to ?nd and seize the property and person described in this application. There is probable cause to believe that (Describe property to be seized; or if search warrant is to be used for searching a place to serve an arrest warrant or other process, name person to be arrested.) SEE ATTACHED TO BE constitutes evidence of a crime and the identity of a person participating in a crime, Murder and is located (check appr0priate box(s) and ?ll-in speci?ed information) i in the following premises: SEE ATTACHED TO BE (and) on the following person(s) [1 (and) in the following vehicle(s) (and) (Name or describe other places or items to be searched, if applicable) The applicant swears to the following facts to establish probable cause for the issuance of a search warrant' SEE ATTACHED CAUSE SWORN AND SUBSCRIBED T0 BEFORE ME Elem Signa 1 Slgna of Applicant [j Magistrate $111ng In addition to the af?davit included above, this application is supported by additional affidavit(s), by the above named a licant In addition to the af?davit included above, this application is supported by sworn testimony given by: Deputy Asst CSC Cl C1 of Super@ Court attached, made his testimony has been reduced to writing El tape recorded and I have ?led each with the Clerk. If a continuation is necessary, continue the statement on an attached sheet of paper with notation - saying ?see attachment.? Date the continuation and include on It the Signatures of applicant and Issuing of?ciaL IN THE MATTER ATTACHMENT TO APPLICATION FOR SEARCH WARRANT Accounts associated with the area near the location 35.785556, ?78.617145 between 6:00pm EST and 7:00pm EST, on 11-07-2016, AND between 5:25pm EST and 6:25pm EST on 11-08?2016, maintained on computer Servers controlled by Google, Inc. ATTACHMENT l- TO BE SEIZED: The facts and circumstances outlined in this af?davit suggest'that there is cause to believe evidence of the commission of the crime of Murder, a violation of North Carolina General Statute 14?17 (hereinafter ?Subject Offense), may be found within Google, Inc. or Google Payment Corp. accounts described further in ATTACHMENT (hereinafter ?the Accounts?) stored at premises controlled by Google,?a company that accepts service of legal process at 1600 Amphitheatre Parkway, Mountaln View, California 94043. The following material is sought for the time period of between 6:00pm EST and 7:00pm EST, on 11-07- 2016, AND between 5:25pm EST and 6:25pm EST on 11?08-2016: 0 Each account/device corresponding to the location data described further in ATTACHMENT ll to be provided by Google will be identi?ed only by a numerical identi?er, without any further content or information identifying the user of a particular device. Law enforcement will analyze this location data to identify users who may have witnessed or participated in the Subject Offenses and will seek any additional information regarding those devices through further legal process. SWORN TO AND SUBSCRIBED BEFORE ME THIS Dialer ,7 ., CSCDASSLCEW Ct. Cl Mag?K?ii?d?g?e, zoLrL. natu pp icant Page of Pages IN THE MATTER OF: ATTACHMENT TO APPLICATION FOR SEARCH Accounts associated with the area near the location ARRANT 35.785556, -78.617145 between 6:00pm EST and 7:00pm EST, on 11-07-2016, AND between 5:25pm EST and 6:25pm EST on 11?08-2016, maintained . . on computer Servers controlled by Google, Inc. ATTACHMENT lI- PLACES TO. BE SEARCHED: This warrant applies to information associated with the Google accounts located within the geographical region de?ned as being within 150 meters of the GPS coordinates 35.785556, 48.617145 between 6:00pm EST and 7:00pm EST, on 11-07-2016, AND between 5:25pm EST and 6:25pm EST on 11-08-2016, that is stored at premises controlled by Google, a company that accepts service of legal process at MOO-Amphitheatre Parkway, Mountain View, California 94043. 15,; .rl. if; . :lf; log .a 4? I A law enforcement officer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in ATTACHMENT I. SWORN TO AND sunscmai?ierom ME OF 20:1. gnature of Applicant mas.? SC Asst. CS Cler?up Ct. El Mag. mdge Page of Pages IN THE MATTER OF: ATTACHMENT TO APPLICATION - FOR SEARCH WARRANT Accounts associated with the area near the location 35.785556, -78.617145 between 6:00pm EST and 7:00pm EST, on 11-07-2016, AND between 5:25pm EST and 6:25pm EST on 11-08-2016, maintained on computer Servers controlled by Google, Inc. ATTACHMENT Ill - PROBABLE CAUSE AFFIDAVIT: The Af?ant swears to the following facts to establish probable cause for the issuance of a search warrant: On November 08, 2016 at approximately 1815 hours, the Raleigh Police Department uniformed patrol of?cers were diSpatched to 432 Hill Street in regards to a shooting. Upon arrival, the uniformed patrol units found Nwabu Cyril Efobi deceased out front of the business. Nwabu Efobi was a cab driver for Universal Cab Company. Universal Cab Company is the business located at 432 Hill Street. Nwabu Efobi had been shot multiple times. In the course of the investigation, a video surveillance system was identi?ed that monitored and recorded the buildings at the shopping center. The cameras covered the back, front and sides of the buildings. The camera system was reviewed. On 11/08/2016 at approximately 1800 hours a black male subject is recorded walking behind the shopping center and Universal cab Company. This subject is wearing a hooded sweatshirt. The - subject comes around the side of the building to the front door area of the Universal Cab Company. The victim exits the cab company and a confrontation ensues between the cab driver and the subject. The subject shoots the cab driver multiple times and then ?ees the area on foot around the side of the business and to the rear. In the course of the investigation, the video surveillance from the building was reviewed for the days leading up to the incident. It should be noted that on 11/07/2016, the same black male subject in the hooded sweatshirt is observed behind the business on three separate times. The ?rst incident is at approximately 1810 hours and the - subject is observed walking behind the business to the front of the business. The subject then leaves and walks towards the rear of business. The subject is also observed at approximately 1833 hours walking again behind the business and to the front of the business. The subject stays outside the front of busineSs for a short time period than walks around to the rear of the business. At approximately 1840 hours, the subject is seen on camera coming around to the side of the business from the rear. The subject has a CELLULAR DEVICE in his left hand that is positioned near his left ear. The subject appears to be on the phone. On this date, the subject also comes around to the ?ont of the Universal Cab Company but leaves without incident. It should be noted that no cabs are parked in front of the business and no employees were present at the time during these three instances. This applicant knows that a cellular telephone or mobile telephone is a handheld wireless device primarily used for voice, text, and data. communication through radio signals. Cellular telephones send signals through networks of transmitter/receivers called ?cells? or ?cell sites,? enabling communication with other cellular telephones or traditional ?landline? telephones. Cellular telephones rely on cellular towers, the location of which may provide information on the location of the subject telephone. Cellular telephones may also include global positioning system or other technology for determining a more precise location of the device. SWORN TO AND SUBSCRIBE BEFORE ME ?mm, 20.11_. El Mag. 1" udge Page of Pages ATTACHMENT TO APPLICATION IN THE MATTER OF: FOR SEARCH WARRANT Accounts associated with the area near the location 35.785556, -78.617145 between 6:00pm EST and 7:00pm EST, on 11-07?2016, AND between 5:25pm EST and 6-25pm EST 7 - on 11-08?2016, maintained on computer Servers controlled by Google, Inc. This applicant also knows that Google is a company which, among other things, provides electronic communication services to subscribers, including email services. Google allows subscribers to obtain ema? accounts at the domain name gmailcom and/or googlecom. Subscribers obtain an account by registering with A subscriber using the Provider?s services can access his or her email account from any Google. computer/device connected to the Internet. 0 developed a proprietary operating system for mobile devices, oid. Nearly every cellular phone using the Android operating system This applicant knows that Google has als to add a Google. account when they ?rst turn on at including cellular phones, known as Andr has an associated Google account, and users are prompte new Android device. Based on this applicant?s training and experience, this applicant knows that Google collects and retains location data from Android?enabled mobile devices when a Google account user has enabled Google location services Google can also collect location data from non-Android devices if the device is registered to a Google account and the user has location services enabled. The company uses this information for location-based advertising and location?based search results and stored such data in perpetuity unless it is manually deleted by the user. This location mformatron is derived from GPS data, cell site/cell tower information, Bluetooth connections and i-Fi access points. This applicant knows that location data can assist investigators in forming a fuller geospatial understanding and timelme related to a specr?c criminal investigation; and may tend to identify potential witnesses and/or suspects. Such information can also aid mvesti gators in possibly inculpating or exculpating persons of interest. Additionally, location information can be digitally integrated into image, video, or other computer ?les assocrated with a Google account and can indicate the geographic location of the accounts user at a particular date and time digital cameras, including on cellular telephones, frequently store GPS coordinates indicating where a photo was taken in the ?metadata? of an image This applicant respectfully submits that there is probable cause to believe that information stored on the Providers? servers associated with the Google accounts and/or devices located at the location and timeframe Speci?ed in ATTACHMENT II, will contain evidence, fruits and mstrumentalities of the Subject Offense". The State of North Carolina maintains that the information sought herein consists entirely of ?record[s]? other than the ?contents of communications? which is subject to the provisions outlined in 18 U.S.C. 2 703(d). Such records, requires only a showing that there are reasonable grounds to believe that the information sought is relevant and material to an ongoing criminal investigation. See 18 U.S.C. 2703(c)(l)(A). Despite this, Goo gle has indicated that it believes a search warrant, and not a court order, is required to obtain the location data sought in this application. Although the Government disagrees with Google?s position, because the is SWORN TO AND SUBSCRIBED BEFORE ME 20 . igu ?e of App can THIS DA OP Page of__ Pages 'Clerk?d . Ct. Cl Mag. Mil?go IN THE MATTER OF: ATTACHMENT TO APPLICATION . FOR SEARCH WARRANT Accounts associated with the area near the location 35.785556, -78.617145 between 6:00pm EST and 7:00pm EST, on 11-07-2016, AND between 5:25pm EST and 6:25pm EST on 11-08-2016, maintained 0n computer Servers controlled by Google, Inc. The geographical region described in ATTACHMENT II is the area in close proximity to the location of where the Subject Offense being investigated was committed. The speci?c longitude and latitude indicated was identi?ed through a mapping software and a screenshot of this location is included within ATTACHMENT II. This af?davit seeks authority to collect certain speci?ed non?content and limited content information related to Google accounts that were located within the Target Area during the Target Time Period (the ?Subject Accounts?). The information sought from Google regarding the Subject Accounts, speci?ed in ATTACHMENT I to this warrant, will assist in identifying which cellular devices were near the location where the crime being investigated occurred during the time frame it is currently believed to have occurred. This information may assist law enforcement in determining which persons were present or involved with the Subject Offense under investigation. The applicant would respectfully request the court issue a search warrant for the material outlined in ATTACHMENT I of the above-mentioned premises controlled by Google. All information and facts provided in this af?davit are true and accurate to the best of the applicant?s knowledge. The applicant feels that there is suf?cient probable cause for the issuance of a search warrant for the evidence, fruits, and instrumentalities of violations of Subject- Offense which may be contained within the records. probable cause to believe that the information sought herein will contain evidence of the criminal offenses Speci?ed in this af?davit, the Government is seeking a search warrant in this case. SWORN TO AND SUBSCRIBED BEFORE ME to mil. @Mag. [3115ng Page of Pages STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE . - SUPERIOR COURT COUNTY OF WAKE . DIVISION APPLICATION FOR ORDER TO PREVENT DISCLOSURE OF THE EXISTENCE OF A SEARCH WAR RANT FOR SEARCHES RELATED TO GOOGLE ACCOUNTS ASSOCIATED WITH THE AREA NEAR THE LOCATION 35.785556, -78.617145 between 6:00pm EST and 7:00pm EST, on 11-07- 2016, AND between 5:25pm EST and 6:25pm EST on 11-08-2016, MAINTAINED ON COMPUTER SERVERS CONTROLLED BY GOOGLE, INC., DATED 03/08/2017 NOW COMES Raleigh Police Department, Detective Mark Quagliarello, and petitions the Court to authorize the search of Google servers for accounts associated with the area near the locatlon 35.785556, -78_617145_ between 6:00pm EST and 7:00pm EST, on 11-07-2016, AND between 5:25pm EST and 6:25pm EST on 11-08- 2016. Pursuant to 18 U.S.C. 2705(1)), and 3103a(b), this applicant'requests that the proposed order direct the provider, and all other communications providers, persons or entities who are obligated by the proposed warrant to provide assistance to the investigative agency, not to disclose in any manner, directly or indirectly, by any action or inaction, to the subscriber(s) or to any other person, the existence of the proposed warrant, in full or redacted form, the existence of the legal request or the existence of this investigation, unless otherwise ordered by this Court; and that the identity of any account users included Within the search results may be redacted from any copy Of the proposed warrant to be Served on any service provider or other person. The existence and scope of this ongoing criminal investigation is not publicly known. AS a result, premature public disclosure of this af?dant or the requested warrant could alert potential criminal targets that they are under investigation, causing them to destroy evidence, ?ee from prosecution, or otherwise seriously jeopardize the investigation. In light Of the serious nature of the crime under investigation, premature revelation Of this investigation may alert dangerous targets that they have been identi?ed by others and endanger the safety Of witnesses who have been cooperating With the Government. Accordingly, there is reason to believe that, were the Provider to notify subscribers of the Subject Accounts or others of the existence of the warrant, the investigation W0111d be 1333;111:113? Pi eopardized.. Pursuant to 18 U.S.C. 2705 I therefore respectfully request that the Court direct the b? to not to 110ny any person of the existence of the warrant for a period Of 90 days from Issuance, su J60 extensmn upon application tO?the Court, if necessary. The Applicant declares under penalty of perjury that the foregoing is true and correct to the best Of my knowledge and belief and that this declaration was executed on March 08, 2017. RESPECTFULLY SUBMITTED THE 8 March 2017 FORE ME THIS 8 March 2 17 AH . 4,3179% (zen/c STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE - SUPERIOR COURT COUNTY OF WAKE DIVISION ORDER TO PREVENT DISCLOSURE OF THE EXISTENCE OF A SEARCH WARRANT FOR SEARCHES RELATED TO GOOGLE ACCOUNTS ASSOCIATED WITH THE AREA NEAR THE LOCATION 35.785556, ?78.617145 between 6:00pm EST and 7:00pm EST, on 11-07-2016, AND between 5:25pm EST and 6:25pm EST on 11?08-2016, MAINTAINED ON COMPUTER SERVERS CONTROLLED BY GOOGLE, INC., DATED 03/08/2017 THIS MATTER having come before me on a petition by the Raleigh Police Department and it appearing to the I court that release of the information in a search warrant dated 03/08/2017, authorizing the search of Google servers for accounts aSSOCIated with the area near the location 35.78555 6, -78.61 7145 between 6:00pm EST and 7:00pm EST, on 11?07-2016, AND between 5:25pm EST and 6:25pm EST on 11?08?2016 would be detrimental to an ongoing criminal investigation. Pursuant to 18 U.S.C. 2705(b), 3123(d), and 3103a(b), it is ordered that the provider, and all other communications providers, persons or entities who are obligated by the proposed order to provide assistance to the investigative agency, not to disclose in any manner, directly or indirectly, by any action or inaction, to the subscriber(s) or to any other person, the existence of the proposed warrant, in full or redacted form, the existence of the legal request, or the existence of this investigation, unless otherwise ordered by this Court; and that the identity of any account users included within the search results may be redacted from any copy of the proposed warrant to be served on any service provider or other person. Speci?cally, being as disclosure of the requested order and investigation would likely result in continued ?ight from testimony, a modi?cation of the suSpect?s activities or the activities of those with whom the suspect communicates and associates, or the destruction or tampering of evidence; and would otherwise seriously jeopardizethe investigation; the applicant further requests, pursuant to the delayed notice provisions of 18 U.S.C. 2705 for an order delaying any noti?cation to the subscriber or customer that may be required by 18 U.S.C. 2703(b) to obtain the contents of communications, for a period of ninety (90) days. THEREFORE, BE IT SO ORDERED that the search warrant, dated 03/08/2017 authorizing the search of Google servers for accounts associated with the area near the location 35.785556, ?78.6l7l45 between 6:00pm EST and 7:00pm EST, on 11?07-2016, AND between 5:25pm EST and 6:25pm EST on 11?08?2016 be not disclosed by Google to the PROVIDER for a period of ninety (90) days. Th' 08 day of arch, 017. 30 pi; con KI Jobbing (.9on '13 am Ll) ETATE OF NORTH CAROLINA been, Wake County In The General Court Of Justice District Superior Court Division IN THE MATTER OF: Name Accounts associated with the area near the location 35.785556, INVENTORY 0F ITEMS SEIZED ~78.6[7 I45 between 6:00pm EST and 7:00pm EST, on PURSUANT TO SEARCH 1-07?2016, and between 5:25pm EST and 6:25pm EST on (3.5. 15A-223, 15A-254. -257 l, the undersigned officer, executed a search of; Pmson, Promises Or Vehicle Searched Date or Search Accounts associated with the area near the location 35.785556, 48.617145 between 6:00pm EST and 7:00pm EST, on 1 1?07-20 e, and between 5:25pm EST and 6:25pm EST on 1 1-08-2016, maintained 03/03/2017 on computer servers controlled bv Gooele. lnc. This search was made pursuant to El 1. a search warrant issued by: Swen? Court Judge (W. consent to search given by: 3. other legal justification for the search: The following items were seized: Data retrieved and reviewed associated with accounts associated with the area near the location 35.785556, -78.6 1 7145 between 6:00pm EST and 7:00pm EST, on 1 1?07-2016, and between 5:25pm EST and 6:25pm EST on 1 1-08-2016, maintained on computer servers controlled by (Boogie, lnc. AOC-CR-ZOS, Rev. 5198 (Over) 0 1998 Administrative Office of the Courts ongm' ma COW . mm" Whose Propeny salmd [items Seized Continued: 1. I left a copy of this inventory with the person named below, who is: a. the owner of the premises searched. b. the owner of the vehicle searched. c. the person in apparent control of the premises searched. d. the person in apparent control of the vehicle searched. e. the person from whom the items were taken. i2} 2. As no person was present, I left a copy of this inventory: [3 a. in the premises searched, identified on the reverse. b. in the vehicle searched, identified on the reverse. aim;- And Add-res Of era-mi To Whom A Copy Of This inventory Was Delivered. if Any p/?w lhe law enforcem . Ft orderpact to 9 entified below Will hold the seized Pmperty SU SWORN AND I, I SUBSCRIBED TO BEFORE ME Iii?io Of 1 aw Enforcer . Detective Name Arid Address Of Agency Raleigh Police Deparfjment lork (If t? Aswan-int CSC 5240 Greens Dan?)! . Marin-tram Raleigh, NC 276 I 6 I ACKNOWLEDGMENT or RECEIPT V90 8 COpy or this inventory. I jziil/ l. the underSignerL recei of Person Inv'otilmy Side Two, Rev. 5/98 0 1998 Administrative Office of the Courts