Film No. File SEARCH WARRANT In the Matter of ounts associated -76.609595 6-01-2015, Google, The search of information regarding a? with the area near the Iocation5.833966, between2:30AM EST and 0" 0 maintained on computer servers controlled by Time issued [:40 1 HL Nahie bf AppliEam Detective S.B. Snowden STATE OF NORTH CAROLINA 1? the General court of Justice Wake suPerior Court Division . . 1 . g? a . To any of?cer with authority and jurisdiction to conduct the search authonzed by this Search Warrant: Qt. Name of additional Af?ant . . . . l, the undersigned, ?nd that there is probable cause to belleve that the property and person descnbed 1n the application on the reverse side and related to the of a crime is located as describe the application. Name of Additional Afflant RETURN OF SERVICE I certify that this Search WARRANT was received and executed as follows: You are commanded to search the premises, vehicle, person, and other place or item described in the application for the property and person in question. If the property and/or person are found, make the seizure and keep the property subject to Court Order and process the person according to law. Date Received Time Received +141 (zao DAMIEN Date Executed Date and Time Return You are directed to execute this Search Warrant within forty?eight (48) hours from the time indicated 0? this warrant and make due retum to the Clerk of Issuing Court. I made a search of Accounl's associal?el nLh/ 7 0 a M551: 4L 4 A gall/?1 ?57 (-1 (9:533 commanded. I seized the items listed on the attached Inventory. Cl I did not seize any items. This warrant was not executed within48 hours of the date of issuance and I hereby return it not executed yature of Of?cer aking Ret urn Di?nment or 'Agency of A. la la 3/33 -4 a, This Search Warrant is issued upon information furnished under oath by the person or persons shown. Asst. CSC clerk?rf Superior Court ul CSC . ?ggiztrate District Ct. Judgcgul?cr 10' JUdgc L/f TAPPLICATION FOR SEARCH WARRANT that the Court issue 1 - artment, berng duly sworn, reques 161 Pollce Dep - ?nd and serze I Detective S.B. Snowden of the Raveligicle and other 1tems descnbed 1n tins property arrant t0 SeaICh the pellsog? Pbaiein this app licatiOl'l- There iS prObable cause to otielregrocess name person to be 1: property and person ($3531: :e used for se arching a place to serve an arrest warrant search warran to be 01'1 arrested.) E. TO SEE ATTACHE ?owing premises: SEE ATTACHED PLACES in 0 (and) on the following 'person(s) (and) in the following Vehicle(s) . ble (and) (Name or describe other places or items to be searched, 1f apphca I SEE ATTACHED CAUSE AF FIDAV . I I a, SUBSCRIBED T0 BEFORE ME Date I Signature of Applicants? Deputy CSC Asst 1:1 Clerk of em I Cafe 2 Magistrate EIJudge In addition to the af? . bed made - - attac luded above this application the above named a licant w. . In addition to the af?d El - by: 11 testimony given . avit included above, this application IS supported by th Clerk each wit has been reduced to writing tape recorded and I have file 11 is necessary, I, . Sa ?lg ?see a ontinue the statement on an attached sheet of pageuwlith notation - 0 ?Ha . uation and include on it the signatures of applicant and Issuing This testimon If a continuatio Date the contin TION TACHMENT TO APPLICA IN THE MATTER OF: AT FOR SEARCH WARRANT The search of information regarding accounts associated with the area near the location 5.833966, -76.609595 between EST and EST, on 06-01-2015, maintained on computer servers controlled by Google, Inc. ATTACHMENT l- TO BE SEIZED: - he The facts and circumstances outlined in this af?davit suggest that there is cause to belleVe fiVl?gten?ig?g?c commission of the crime of Murder, a violation of North Carolina General Statute Ill-l7 (hereinad he r] in Offense), may be found within Google, Inc. or Google Payment Corp. accounts describe any ATTACHMENT (hereinafter ?Subject Accounts?) stored at premises controlled by .Google, pThe that accepts service 0f legal process at 1600 Amphitheatre Parkway, Mountain View, California 94 - following material is sought for the time period of EST to EST on 06-01-2015: To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts, which will be reviewed by law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of the above-mentioned Subject Offense. a. Location information. All location data, whether derived from Global Positioning System (GPS) data, cell site/cell tower triangulation/tnlateration, and precision measurement information such as timing advance or per call measurement data, and i location, including the GPS coordinates, estimated radius, and the dates and times of all location recordings, EST to EST on 06-01-2015; b. Each device corresponding to the location data to be provided by the ?Provider? Will be iden by a numerical identi?er, without any further content or information identifying the user of a partic Law enforcement will analyze this location data to identify users who may have witnessed or Subject Offenses and will seek any additional information regarding those deVices through ti?ed only ular device. participated in the ?irther legal process. For those accounts identi?ed as relevant to the ongoing investigation through an records and upon demand, the ?Provider?. shall prov1de additional location history outsi 6 relevant accounts to determine path of travel. This additional location his area for OS 'nus the ?rst and last timestamp assoc1ated w1th the account in the ini minutes plus 0; In?travel/cohtextual location points is to eliminate outlier points where, Sui-211305532: 53:68:] ear the reported p0int(s) are not indicative of the device actually bein a a warrant.) analysis of provided de of the prede?ned tory shall not exceed 60 tial dataset. (The from the surrounding within the scope of the For those accounts identi?ed as relevant to the ongoing investigation throu records and upon demand, the ?Provider? shall prov1de the subscriber?s informati to include subscriber?s name, email addresses, services subscribed to, last 6 mont number, and registration IP. gh an analysis of provided on for those relevant accounts hs of IP history, SMS account we SWORN TO AND SUBSCRIBED BEFORE ME THIS DAY OF M, 20 I: Cl Deputy CSC El Asst. CSC CN of Sup. Ct. El Magmudge Signature of Applicant Page 0f 2 Pages I . THE MATTER OF. ATTACHMENT TO APPLICATION Th . FOR SEARCH WARRANT search of Information regarding accounts :sstociated with the area near the location 35.833966, -76.609595 ween EST and EST, on 06-01-2015, maintained on computer servers controlled by Google, Inc. ATTACHMENT H- PLACES TO BE SEARCHED: This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, and . applies to all content and other information within the Provider?s possession, custody, or control associated the Google accounts located within the geographical region bounded by the following latitudinal and longitudinal coordinates between EST to EST on 06?01?2015 (the ?Subject Accounts?): Geographical box with the following 4 (four) latitude and longitude coordinates9&3 721 Saint-Alba . . . a - IBED NTO ND SUBSCR - - Signature of Applicant Cl Deputy CSC Asst. CSC El Clerk Mag? Judge Page of 2 Pages I ATTACHMENT TO APPLICATION IN THE MATTER OF: FOR SEARCH WARRANT The search of information regarding accounts associated with the area near the location 35.833966, -76.609595 between EST and EST, on 06-01-2015, maintained on computer servers controlled by Google, Inc. ATTACHMENT - PROBABLE CAUSE AFFIDAVIT: - nt: The Af?ant swears to the following facts to establish probable cause for the issuance of a searCh warra INTRODUCTION AND AGENT BACKGROUND 1. This affiant makes this af?davit in support of an application for a search warrant for information that is maintained on computer servers controlled by Google, Inc. (?Google?), an email provider headquartered at . I600 Amphitheatre Parkway, Mountain View, California 94043. The information to be searched is described in the Attachment I and Attachment II of the proposed warrant, which consists of Google location data assocrated with a particular speci?ed location at a particular time, also speci?ed in Attachment I and Attachment II of the avit is made in support of an application for a search warrant under 18 U.S.C. 2703(c)(1)(A) to require Google to disclose to the government copies of the information ?irther described in Attachment I and Attachment 2. I, Detective Snowden, have been a sworn law enforcement of?cer for sev Raleigh. I have attended the Raleigh Police Academy and was techniques for six months. I have served eight Investigative Division as a detective since May enteen years with the city of given instruction in law enforcement years in Field Operations of 2007. I have also succ raining in search warrant preparation and execution from Wilson Tech Community College. I have investigated both misdemeanor and felony violations. 1 have received and continue to receive training at the Raleigh Police Academ y, as well as other agencies within the state. I have made several drug arrests, both misdemeanor and felony. ?5 3. Based on the facts set forth in this af?d identi?ed in Attachment II, associated with a evidence, fruits and instrumentalities of Murd avit, there is probable cause articular speci?ed location a er, a violation. of North Caro to believe that the Google accounts a particular specified time, contain lina General Statute 14-17. This I The Government maintains that the information sought herein consis ?contents of communications,? subgect to an order under_18 U.S.C. there are reasonable grounds to believe that the information sought is criminal investigation. See 18 U.S.C. Google haSi ired to obtain the location data sought in this application. Altho requ 1 osition because there is probable cause to believe that th (Si/(ignites (13f the federal criminal offenses speci?ed in this Af?davit, ere. ISIWORN TO AND SUBSCRIBED THIS 4 DAY OF 2013:- ts entirely of ?record[s]? 2703(d), requiring only a relevant and material to a ndicated that it believes a search warrant is ugh the Government disagrees with information sought herein will contain the Government is seeking a search warrant other than the showing that ongoing Signat re of Applicant Page 5 of Pages El Deputy CSC El Asst. CSC Clerk ofghp Mag. Eludge IN THE MATTE OF. ATTACHMENT TO APPLICATION The search of information regarding accounts FOR SEARCH WARRANT assocnated with the area near the location 35.833966, -76.609595 between EST and EST, on 06-01-2015, maintained on computer servers controlled by Google, Inc. af?dav1t is based upon my personal knowledge, my review of documents and other evidence, and my conversations. With other law enforcement of?cers, as well as my training and experience concerning the email in criminal activity. Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts I have learned during my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. se of JURISDICTION AND AUTHORITY TO ISSUE WARRANT 4. Pursuant to 18 U.S.C. 2703(a), the Government may require a provider of an electronic communications service or a remote computing service, such as the Provider, to disclose all stored Content and all non-content records or other information pertaining to a subscriber, by obtaining a warrant issued using the procedures described in Article 11 of North Carolina General Statute. 5. A search warrant under 2703 may be issued by ?a court of general criminal jurisdiction of a State authorized by the law of that State to issue search warrants? 18 U.S.C. 6. When the Government obtains records under 2703 pursuant to a search warrant, the Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 2703(a), (3). Additionally, the Government may obtain an order precluding the Provider from notifying the subscriber or any other person of the warrant, for such period as the Court deems appropriate, where there is reason to believe that such noti?cation will seriously jeopardize an investigation. 18 U.S.C. 2705(b). ATING TO GOOGLE, GOOGLE LOCATIONS SERVICES AND RELEVANT BACKGROUND REL TECHNOLOGY 7. A cellular telephone or mobile telephone is a handheld wireless device primarily used for voice, text, and data through radio signals. Cellular telephones send signals through networks of transmitter/receivers called ?cells,? enabling communication with other cellular telephones or traditional ?landline? telephones. Cellular telephones rely on cellular to information on the location of v-es .- eager-i; 1.: - Ce t6 clef.? cludeglobal positioning system tee? a I (35/ 2, (.3 31?5- JFWTEWFB 6mm ?7 gmailcom and/org?- far w. .. g. the Provider?s servicescan access . or her email cunt from any computer connected to the Internet. 201'. 8. Googleisi?i HJJLULJ :?G-is Crew?; Wire"? . 't?v?i?a'm's rallmmorttiezttv {Lumf zen 7? G35 10 subscribers, incl ELZW ?RV-dew? tar-cw are 0? ?the domain name - -. an: 90 by registering With Google. A subscriber using indr 'fg?tashas developed an Operating System for mobile devices, including cellular phones, known as 01 a proprietary operating system. Nearly eve cellular hone us? - . sworn?: TO AND SUBSCRIBED the Andm?d Operatlng THIS 2 DAY OF 20E. I j? El Deputy CSC El Asst. CSC El Clerk 0 . t. Mag. t] Judge Page ft of 2 Pages Ignatur 0 pp [cant IN THE MATTER OF: ATTACHMENT TO APPLICATION FOR SEARCH WARRANT The search of information regarding accounts associated with the area near the location 35.833966, -76.609595 between EST and EST, on 06-01-2015, maintained on computer servers controlled by Google, Inc. system has an associated Google account, and users are prompted to add a Google account when they ?rst turn on a new Android device. 10. Based on my training and experience, I have learned that Google collects and retains location data from Android-enabled mobile devices when a Google account user has enabled Google location serVICes. Goog eh can also collect location data from non?Android devices if the device is registered to a Google account and 6 user as location services enabled. The company uses this information for location-based advertismg and location?based search results. This location informatio is derived from GPS data, cell site/cell tower information, and Wi-Fi access points. 1 1. Location data can assist investigators in understanding a fuller geographic picture and timeline, which may tend to identify potential witnesses, as well as possibly inculpating or exculpating account owners. . Additionally, location information digitally integrated into image, video, or other computer ?les sent Via email can further indicate the geographic location of the accounts user at a particular time digital cameras, including on cellular telephones, frequently store GPS coordinates indicating where a photo was taken in the metadata of image PROBABLE CAUSE 12. On 06/01/2015 at approximately Raleigh Police personnel responded to a 911 call at 1721 Saint Albans Drive concerning a subject shot. Upon their arrival Raleigh Police personnel located the victim, Adrian Pugh, deceased just inside the front door to his residence. Mr. Pugh was located deceased after being shot one time in the torso. Two witnesses across the street from the reSidence reported hearing Mr. Pugh in an argument. During the altercation they heard multiple shots and called 911 immediately. One witness Watched as the unknown suspect used the light from his cellular phone to either light a path to a vehicle or look for something on the ground. The unknown suspect was then seen ?eeing west toward Wake Forest Rd in a dark colored vehicle. EVIDENCE. FRUITS AND IN STRUW Based on the foregoing, I respectfully submit that there is probable cause 1tzcired on the Providers? servers associated with the Google accounts accessed at a particular speci?ed time, as speci?ed in Attachment II of the pr0posed Warrant and instrumentalities of the Subject Offenses. to believe that information particular speci?ed location at Will contain evidence, fruits 13. In particular, the geographical region bounded by the latitudinal and longitudinal COOl?dinates indicated in Attachment II and the time spec1?ed in Attachment I to the proposed Warrant re?ects the period between EST to EST on 06-01-2015. The speci?c longitude and latitude indicated in Attachme . . nt was identi?ed through a mapping software, which matched the longitud SWORN TO AND SUBSCRIBED BEFORE ME and latitude indicated in Attachment II THIS DAY OF Signature 0 Applicant Deputy CSC Cl Asst. CSC GIN of Sup. t. El Mag. aludge Page of 7 Pages IN THE MATTER OF: ATTACHMENT TO APPLICATION FOR SEARCH WARRANT The search ofinformation regarding accounts associated with the area near the location 35.833966, -76.609595 between EST and EST, on 06-01-2015, maintained on computer servers controlled by Google, Inc. as corresponding to the area of where the crime scene in this case is located. This Application seeks authority to collect certain location information related to Google accounts that were located within the Target Area during the Target Time Period (the ?Subject Accounts?). 14. The information sought from Google regarding the Subject Accounts, speci?ed in Attachment 1 to the proposed warrant, will identify which cellular devices were near the location where the crime occurred and may assist law enforcement in determining which persons were present or involved with the crime under investigation. The requested information includes: a. Location information. All location data, whether derived from Global Positioning System (GPS) data, cell site/cell tower triangulation/trilateration, and precision measurement information such as timing advance or per call measurement data, and Wi?Fi location, including the GPS coordinates, estimated radius, and the dates and times of all location recordings, during the Target Time Period; Each device corresponding to the location data to be provided by Google will be identi?ed only by a numerical identi?er, without any further content or information identifying the user of a particular device. Law enforcement will analyze this location data to identify users who may have witnessed or participated in the Subject Offenses and will seek any additional information regarding those devices through further legal process. REQUEST FOR NON-DISCLOSURE AND SEALING 15. Based on the forgoing, I respectfully request that the Court issue the proposed search warrant. Because the warrant will be served on Google who will then compile the requested records at a time convenient to it, reasonable cause exists to permit the execution of the requested warrant at any time in the day or night. 16. The existence and scope of this ongoing criminal investigation is not publicly known. premature public disclosure of this af?davit or the requested warrant could alert potential criminal targets that they are under investigation, causing them to destroy evidence, ?ee from prosecution, or otherwise seriously jeopardize the investigation. In light of the violent nature of the crime under investigation, premature revelation of this investigation may alert dangerous targets that they have been identi?ed by others and endanger the safety of witnesses who have been cooperating with the Government. As a result, 17. Accordingly, there is reason to believe that, were the Provider to notify subscribers of the Subject Accounts or others of the existence of the warrant, the Investigation would be seriously jBOpardized. Pursuant to 18 C. 2705(b), I therefore respectfully request that the Court direct the Provider not to notify any person of the existence of the warrant for a period of 90 days from issuance, subject to extension upon application to the Court, if necessary. SWORN TO AND SUBSCRIBED BEFORE ME DAY OF 205;- Signature of Applicant :1 Deputy Asst. ClerMup. Ct. El Mag. 2 Judge Page of 1 pagt,S aha -. IN THE MATTER OF: ATTACHMENT TO APPLICATION FOR SEARCH WARRANT The search of information regarding accounts associated with the area near the location 35.833966, -76.609595 between EST and EST, on 06?01-2015, maintained on computer servers controlled by Google, Inc. 18. For similar reasons, I respectfully request that this af?davit and all papers submitted herew1th be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as need be to personnel it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply With discovery and disclosure obligations in any prosecutions related to this matter. . CONCLUSION Based on the foregoing, I respectfully request that the warrant sought herein pursuant to the applicable provisions of the Stored Communications Act, 18 U.S.C. ?2703(b)(1)(A) (for contents) and 2703(c)(1)(A) (for records and other information), and the relevant provisions of North Carolina General Statute. SWORN TO AND SUBSCRIBED BEFOREME THIS 2 DAY OF ,20 . Signature of Applicant El Deputy CSC El Asst. CSC El Clerk?OWt. El Mag. Sludge Page 2 of 2 Pages STATE OF NORTH CAROLINA Wake In The General Court Of Justice County District Superior Court Division IN THE MATTER OF: ?m INVENTORY OF ITEMS SEIZED See below PURSUANT TO SEARCH G.S. 15A-223. -254. -257 I, the undersigned of?cer. executed a search of: Person, Premises Or Vehicle Searched Date or Search The search of information regarding accounts associated with the area near the location 04/07/2017 5.833966, -76.609595 between EST and EST, on 06-01?2015, maintained on computer servers contraolled by Google, Inc This search was made pursuant to 1. a search warrant issued by: Judge 2. consent to search given by: El 3. other legal justi?cation for the search: The following items were seized: Data Items Seized Continued: 1. I left a copy of this inventory with the person named below, who is: a. the owner of the premises searched. b. the owner of the vehicle searched. c. the person in apparent control of the premises searched. d. the person in apparent control of the vehicle searched. e. the person from whom the items were taken. 2. As no person was present, I left a copy of this inventory: a. in the premises searched, identi?ed on the reverse. b. in the vehicle searched, identi?ed on the reverse. Name And Address Of Person To Whom A Copy Of This inventory Was Delivered. If Any Google, Inc. The law enforcement agency identi?ed below will hold the seized property subject to court Order. m: Of?ce . SWORNIAFFIRMED AND SUBSCRIBED TO BEFORE ME S.B. Sno den fypeorpnm) . I Date Name (type 0mm!) 3'9 . Law Enforc men! Of?cer '1 l- Signature 'Title OfLaw?EnforcEment Officer [j Notary Detective Date My Commission Expires Name And Address Of Agency Raleigh Police Department SEAL County Where Notarized 6716 SIX Forks Rd. Raleigh, NC 27617 El Deputy DAssistant ass Clerk or Supertbr Court Magistrate l, the undersigned, received a copy of this inventory. Date . Signature Of Person Receiving inventory Side Two, Rev. 3/16 (6) 2016 Administrative Of?ce of the Courts