File No. SEARCH WARRANT ER OF IN THE MATT . . . 6 Accounts associated devrces that were msrde the ar 51 Date (33 ed Ti?me Issued tz:3o om Nam?Of Apblicant Detective Brad Winston Name Of Additional Af?ant Name Of Additional Af?ant - I RETURN OF SERVICE i - - I certify that this Search Warrant was received and executed as follows: . Date Receiv is leer-1r Dare Executed ?7 I made a search of Time Received [1:20 DAM PM Time Executed AM [3 PM I a A- STATE OF NORTH CAROLINA In The General Court Of Justice County District/Superior Court Division . . the sea - . To any of?cer with authority and jurisdiction to condUCt aUthor'Zed by thIS Search Warrant: l. the undersigned. find that there is probable cause to PrOperty and person described in the application on the reverse side and related to the rlme IS located as described in the application. You are commanded to search the premises, vehicle, person and other place or item described in the application for the property and person in question. If the property arid/0r person are found, make the seizure and keep the property subject to Court Order and process the person according to law. You are directed to execute this Search Warrant within forty-eight (48) hours from the time indicated on this Warrant and make due return to the Clerk of the issuing Court. This Search Warrant is issued upon information furnished under oath or af?rmation by the person(s) shown. 4? I .1. .- I. rint) We; Cwii?idjeu?n? as commanded. seized the items listed on the attached inventory. 323. did not seize any items. This Warrant WAS NOT executed within forty-eight (48) hours of the date of issuance and I hereby return it not executed. a lC Main? 9 Return (Type Rev. 6/12 2012 Administrative Of?ce of the Courts ?tsearch Warrant was delivered Deputy CSC Assistant CSC I: CSC Magistrate District Ct. Judge ?tmenbr QM te and at the time shown below when the Office of the Clerk of superior Court is closed for the transaction of business_ . . I certify that I will deliverthis Search Warrant to the Of?ce of the Clerk of Superior Coun a: :?nags possible on the Clerk's next business day. ff AM PM Date Time Name O'MagiSl?ate (Type Or pm") signature or Magistrate El This Search Warrant was returned to the undersigned clerk on the date Time AM Name Of Clerk Type Or Pn'Asst .3 all? . a 055,7/ I (Over) A oat?al/VAL APPLICATION FOR SEARCH WARRANT nsert name . - I and address, or if law e?Tforcement of?cer. name. rank and agency} being duly sworn, request that place, vehicle and other items the property and person descri the Court issue a warrant to search the person, described in this application and to find and seize bed in this application. There is probable cause to believe that . scribe PrOperty to be seized; or if search warrant is to be used for searching a place to serve an arrest warrant person to be arrayed) constitutes evidence of a crime an crime, (Name crime) the identity of a person participating in 3 Burning of building or structure under construction NCGS l4-62.I and iS located (Check appropriate box(es) and ?ll-in speci?ed information) in the following premises {Give address and, if useful, describe premises) mt ?1 (and) . I: on the following person(s) (Give name(s) and, if useful, describe person(s)) (and) in the foliowmg ehicle(s) (Describe vehicle(s)) (and) licable (Name and/or descnbe other places or items to be searched, if app are maintained on computer . . - nd data 1n the attached Sald accounts a ppiicatlon. servers centre 6 00g .3, nc. ect eattac - . .The applicant swears or affirms to the followmQ fads to EStabl'Sh probable cause for the issuance of a search Warrant: See the attached Application Magistrate Date T/s/Qal?~ Name Of Applicant Type Or F?n'nt) Signature licant SWORNIAFFIRMED AND SUBSCRIBED TO BEFORE ME 17(717 Signature I A: Asstw Clea Of Superior Court Judge in addition to the affidavit included above, additional affidavits. attached, made by [Ed addition to the affidavit included a sworn testimony, given by Police De artment this application is supported by bove, this application is su Detective Brad Winston Ralei pported by This testimony has been (check appropriate box) - reduce - L__l tape recorded and More flied each with the ole to writing Rev. 6/12 me or the Cor-Irls 2012 Administrative 0 rk. - dad NOTE. if more space iS nee or any sec . sheet of paper with a notation Saying "Se tron, continue th attachment. Date Statement on an 8??th include on it the signatures Of applicant and issuing of?cial9 the Continuation and IN THE MATTER OF: ATTACHMENT TO APPLICATION Accounts associated dev FOR SEARCH WARRANT ices that were inside th ll NW Corner 35.78405 0 0 owmg geographical area: 35.7827970, ?8.6448525; ?786448210, NE Corner 35.784018?, -78.643561?, SE Corner 35.782758?, -78.643574?, SW Corner Durin th - - on Oll0Wlng time frame: 1930 hours Eastern and 2200 hours Eastern, on 3/16/2017, data maintained Puter servers controlled by Google, Inc. ATTACHMENT 1? TO BE SEIZED: The facts and circumstances outlined in this af?davit suggest that there is probable cause to believe evidence of the comrnission of the crime of Burning of building or structure in process of construction, a violation of North Carolina General Statute 14-62.l (hereinafter ?Subject Offense), may be found within eOmPPteT servers maintained or controlled by Google, Inc. or Google Payment Corp. Such accounts are described further in ATTACHMENT II (hereinafter ?the Accounts?) stored at premises controlled by Google, .Inc-a .a company that accepts service of legal process at 1600 Amphitheatre Parkway, Mountain View, California 94043. The following material is sought for the time period of 1930 hours Eastern through 2200 hours Eastern on 3/16/2017: 1. For each type of Google account that is associated with a device that was inside the geographical area described further in ATTACHMENT II, during the time frame listed above, Google Will provide ?anonymized information? regarding the Accounts that are associated with a device that was inside the described geographical area during the time frame described above. This ?anonymized information? will include a numerical identi?er for the account, the type of account, time stamped location coordinates and the data source that this information came from if available. The information initially provided by Google will not contain any further content or information identifying the user'of a particular device or account. 2. Law enforcement of?cers will review this ?anonymized information? provided by Google, Inc. in an effort to narrow down the list of accounts associated with devices identi?ed in the ?anonymized information?. Law enforcement of?cers will attempt to narrow down the list by reviewing the time A stamped location coordinates for each account and comparing that against the known time and location information that is speci?c to this crime. 3. Law enforcement of?cers will return a list that they have attempted to narrow down, Th be identi?ed by the ?anonymized information? described above. After this review Enforcement and upon request, Google, Inc. shall produce contextual data points with point Law 'd of the geographical area? described further in ATTACHMENT II of this A l' . 0f travel outSI 6 .- frame will be expanded for this productlon of ?Comte PP lcatlon for Search Warrant] geographical area? for 30 minutes before AND 30 data pOintS with POints of tiavzrg; (1) 1930 hours Eastern through 2200 hours Eastern 0n 3/16/2017es after the initial search 1}ng will be from 1900 hours Eastern through 2230 hours Eastern on 3/16/2017 lsGexpanded tim'e provide this additional information to Law Enforcement for review, 00gle Inc. Shall 4_ Law Enforcement of?cers will revrew additional information along With information? and will attempt to narrow down the list by comparing this add-tile regarding travel and time against the known time and location information ltlona 5. After review and upon request by Law Enforcement, Google Inc. shall information CSI for the account/s requested by Law Enforcement. SWORN AND SUBSCRIBED BEFORE ME THIS DAY OF 20 I is list will still . 1 informa' hat is speci?c to tlon Signature of Applicant Page i Ofi Pages El Deputy'csc Asst. If] Claw. Ct. El Mgi'iudge ATTACHMENT TO APPLICATION IN THE MATTER OF: FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: NW Corner -78.644821?, NE Corner 35.784018?, -78.64356l?, SE Corner 35.782758?, -78.643574?, SW Corner 35.782797?, -78.644853? . . During the following time frame: 1930 hours Eastern and 2200 hours Eastern, on 3/16/2017, data maintained on computer servers controlled by Google, Inc. information CSI shall include all of the following that are available: user name and subscriber information to include date of birth if available, account type and account number, email addresses associated with the account, electronic devices associated with the account and their identifying make, model and other identifying number's, telephone numbers associated with the account Including telephone numbers used to set up the account, verify the account or to receive assistance W1th the account, and Google Voice phone numbers associated with the account; ATTACHMENT II- PLACES TO BE SEARCHED: This search warrant applies to the Google Accounts associated with devices that were located inside the following geographical area: NW Corner 35. 784057?, -78. 644821?, NE Corner 35. 784018", ~78. 643561", SE Corner 35. 782758?, -78. 643574?, SW Corner 35. 782797?, ?78. 644853?, during the initial time frame between 1930 hours and 2200 hours on 3/16/2017. This data 15 maintained on computer servers that are stored at premises controlled by Google Inc, a company that accepts service of legal process at 1600 Amphitheatre Parkway, Mountain View, California 94043. .321 W.- Wanton-s 'Bw?m. - I 1 I) SWORN TO AND SUBSCRIBED BEFORE ME THIS DAYOF MW .20 (1. (Abs-Cow Signature of Applicant Deputy 1:1 Asst. WSW. Ct. t1 Mag?ludge Page of Pages PLICATIO ENT TO AP SEARCH WAR AN IN THE MATTER OF: nel? . 5740, SW . I area. 8275803 ?78.643 . eographlca Corner 35.7 Accounts associated devices that were inside the NW Corner 35.784057?, -78.644821?, NE Corner - 35.7827970, -78.644853? Eastern, 2200 hour During the following time frame: 1930 hours Eastern an on computer servers controlled by Google, . . on 3/16/2017, data maintaine . t0 er appropnate manner nsmitting it via email or anoth f?cer an electronic copy A law enforcement of?cer will serve this warrant by tra forcement 0 to the law en the Provider, Google Inc. The Provider is direcfteld to pI?OduC of the information speci?ed in ATTACHMEN - DAVIT: ATTACHMENT - PROBABLE CAUSE AFFI building - - ed use apartmen . - ?ed involvmg a m1X_ The investigatio . IS, a 5 alarm ?re in Ralelgh . nd On 3/16/2017 at located at 314 West JigesllseiEZIY left the property securgd under construction ca 6 sized to be on this prope. ft onstruetion was on Ire: . has revealed that the on 3/16/2017, this 12,321,111?an Edi; mercial. There were lIlJLlI'leS 1930 hours on 3/16/20 -y heavily occupied re51 en 1a 11::th estimates of damage are the tens Ofml re ate 0 IS . - used - ireless dev1ce primarl 11 lar telephone or mObile tel?phone ls a illalidhettievghones send Signals through This applicant knows cihilt a through radio Slgnals. (Sin: a?ommunjcation with other cellula; a a C0 a: 11 Sites,? ena {on for v01ce, text, an . . 11 (1 cells or ce 1 towers, the loca 1 networks of iateelephones. Cellular telephones relyColri <13: :feIphones may also include telephones or tr?ditional 1391112: the location of the subject telephone. 0; llrecise location ofthe device. which may pr0V1d? infom?i?g} or other technology for determining a In ing system global pOSition rovides electronic. th GOOgle is a company W'hmh? amonlg 013:8 tfiligfjiibirs to obtain email licant also knows a . eluding email Semees? Googe a- 'th This appcation services to subscribers, 1; djor googlecom. Subscribers obtain an account by registering W1 corm:n ts at the domain name der?S Servlces can access 1118 or her email account from any acco . riber usmg 16- A nternet. connected to the 1 tary operatin developed a proprie . that Google hasdr?gisg Nearly every cellular phone us1n es, knowntasa??iusers.are prompted to add a Google ac le 9 . . This applican including cellular phon has an associated Goog new Android dev1ce. system for mobile devices, the Android operating system count when they ?rst turn on a - knows that Goo . . t?s training and eppenence, tth: :p?gc?ount user has en Based on app 11can bled mobile dev1ces when a ices if the device i data from AnldrOli-?zzt locatiOn data from n9PIEAnd?gmyehses this informati 0 - bled. 00 Google can a - erwces ena . . and the user has and stored such data In perpetUIty unless it -base se and location gle collects and retains location abled Google location services. 3 registered to a Google account on for location?based advertising is manually deleted by the user. ME - RIBED BEFORE I 0 AND SUBSC 20 ingNg?t-H A OF M4 . I Signature of Applicant I I f5 0 ?Magma Passiosipages Deputy Asst. El CM up. . Ned, ATTACHMENT TO APPLICATION THE MATTER OF. FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: 0 l? NW Corner 35-784057", -78.644821?, NE Corner 35.784018?, -78.643561?, SE Corner 35.782759), -78.643574 SW Come 35.782797?, -78.644853? . . ed During the following time frame: 1930 hours Eastern and 2200 hours Eastern, on 3/16/2017, data maintain on computer servers controlled by Google, Inc. . - ections, and This location information is derived from GPS data, cell Site/cell tower information, Bluetooth conn Wi-Fi access points. - - - - - erstandin and This applicant knows that location data can investrgators in forming a full?? aid/or timeline related to a speci?c criminal investigation; and may tend to Identify Potfm ersons ofinterest. suspects. Such information can also aid investigators in Inculpatrng or exculpa 1ng corn uter ?les Additionally, location information can be digitally integratedunto image, Video, at appartim?ar associated with a Google account and can indicate the geographic location of the acicout re GPS coordinates date and time digital cameras, including on cellular telephones, frequenty 0 indicating where a photo was taken in the ?metadata? of an image This a licant respectfully submits that there is probable cause to believe that information stored the ovidgg? servers associated with the Google accounts and/0r devices located at the location and time ame speci?ed in ATTACHMENT II, will contain evidence, fruits and instrumentalrtres of the Subject Offense . in ATTACHMENT II is the area in close proximity to the location of where The was committed. The speci?c longitude and latitude indicated was ihe S'lfl' Jcl?ihrough a mapping software and a screenshot of this location is included within ATTACHMENT II. lde'ml ifdavit seeks authority to collect certain speci?ed non-content and limited content information related to $135.9 1accounts that were located within the Target Area during the Target Time Period (the ?Subject Accounts?)- The information sought from Google regarding the Subject Accounts, speci?ed in ATTACHMENT 1 to this arrant will assist in identifying which cellular devices were near the location where the crime being givestigated occurred during the time frame it is currently believed to have occurred. This information may assist law enforcement in determining which persons were present or involved with the Subject Offense under me of North Carolina maintains that the information sought-herein consists the ?Contents of communrcatrons? rs subject to the provrsrons outlined in 18 U.S.C. 2703 Such than uires only a showing that there are reasonable grounds to believe that the information sought is records, I ?3 material to an ongoing criminal investigation. See 18 U.S.C. 2703(c)(1)(A). Despite this, relfiV?ant an - d'cated that it believes a search warrant, and not a court order, is required to obtain the location 600gle has in 1h' a lication. Although the Government disagrees with Google?s position, because there is data sought [nett?sbf?ive that the information sought herein will contain evidence of the criminal offenses r0bable caus entirely of other . - the Government is seeking a search warrant in this case. - [1115 af?davrt, 5pCCl?ed 1 BEFORE ME THIS Signature of Applicant .DJudge Page of El Pages Deputy CSC As? IN THE MATTER OF: ATTACHMENT TO APPLICATION FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: NW Corner 35784057", -78.644821?, NE Corner 35.784018?, -78.64356l?, SE Corner 35.782758o, -78.643574?, SW Corner 35782797", -78.644853? During the following time frame: 1930 hours Eastern and 2200 hours Eastern, on 3/16/2017, data maintained on computer servers controlled by Google, Inc. The applicant would respect?illy request the court issue a search warrant for the material outlined in ATTACHMENT 1 of the above-mentioned premises controlled by Google. All information and facts provided in this af?davit are true and accurate to the best of the applicant?s knowledge. The applicant feels that there is suf?cient probable cause for the issuance of a search warrant for the evidence, fruits, and instrumentalities of violations of Subject Offense which may be contained within the ?lmished records. SWORN TO AND SUBSCRIBED BEFORE THIS DAY Signature ag.- Judge Page 27: of _l Pages El Deputy SC. Cl Ass STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE COUNTY OF WAKE SUPERIOR COURT DIVISION APPLICATION FOR ORDER TO PREVENT DISCLOSURE TO THE USERS WITH ACCOUNTS INVOLVED OF THE EXISTENCE OF A SEARCH WARRANT RELATED TO GOOGLE ACCOUNTS ASSOCIATED DEVICE INSIDE THE FOLLOWING AREA, DURING THE FOLLOWING TIME FRAME: Nw Corner 35.734057?, -78.644821?, NE Corner SE Corner 35.782758?, -78.643574?, SW Corner 35.782797?, -78.644853?, during the initia time frame between 1930 hours and 2200 hours on 3/16/2017. SAID SEARCH WARRANT DATED 5 90 I 1 NOW COMES Detective Brad Winston of the Raleigh Po ice Department, and petitions the Court to authorize an order to prevent disclosure of the search warrant dated 611;] to the users with accounts involved. Said search warrant authorizing the search of Google server's'for accounts associated devices that were inside the following area, during the following time frame: NW Corner 35.784057?, -78.644821?, NE Corner 35784018", -78.643561?, SE Corner 35782758", -78.643574?, SW Corner 35.782797", -78.644853?, during the initial time frame between 1930 hours and 2200 hours on 3/16/2017. Pursuant to 18 U.S.C. 2705(b), and 3103a(b), this applicant requests that the proposed order direct the provider, and all other communications providers, persons or entities who are obligated by the proposed warrant to provide assistance to the investigative agency, not to disclose in any manner, directly or indirectly, by any action or inaction, to the subscriber(s) or to any other person, the existence of the proposed warrant, in full or redacted form, the existence of the legal request or the existence of this investigation, unless otherwise ordered by this Court; and that the identity of any account users included within the search results may be redacted from any copy of the proposed warrant to be served on any service provider or other person. The existence and scope of this ongoing criminal investigation is not publicly known. As a result, premature public disclosure of this af?davit or the requested warrant could alert potential criminal targets that they are under investigation, causing them to destroy evidence, flee from prosecution, or otherwise seriouslyjeopardize the investigation. In light of the serious nature of the crime under investigation, premature revelation of this investigation may alert dangerous targets that they. have been identi?ed by others and endanger the safety of witnesses who have been cooperating with the Government. Accordingly, there is reason to believe that, were the Provider to notify subscribers or users of the Subject Accounts or others of the existence of the warrant, the investigation would be seriously jeopardized. Pursuant to 18 2705(a) I therefore respectfully request that the Court direct the Provider not to notify any person of the existence Of the wa for a period of 90 days from Issuance, subject to extension upon application to the Court, if necessary. Fran . - as I respectfully request that the acco - Similar r6350 7 mpanymg warrant and all a ers - - F0 seal until the court orders ?hem/153, except that the Government be permit?t - herewith be mamtained undeirde copies of the warrant and affidavit as need be to personnel assisting it in the $11522? ?srther (girder ofthis Court garter and to disclose 'those materials as necessary to comply discovery and dgisclosure prosecutions related to this matter. any declares under penalty of perjury that the regoing is true and correct his declaration was executed on 5? (I 513] 4? 0w edge and The Applican belief and that 20/ SUBMITTED THE EFORE ME THIS Wk! 9:31-7? RESPECTFULLY NORTH CAROLINA SUPERIORCOIPT JUDGE NAME <2 0 3 5% PRINTED PRINTED Gilt er NM, STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE COUNTY OF WAKE SUPERIOR COURT DIVISION COURT ORDER TO PREVENT DISCLOSURE TO THE USERS WITH ACCOUNTS INVOLVED OF THE EXISTENCE OF A SEARCH WARRANT RELATED TO GOOGLE ACCOUNTS ASSOCIATED DEVICE INSIDE THE FOLLOWING AREA, DURING THE FOLLOWING TIME FRAME: NW Corner 35.7840570, -78.644821?, NE Corner 35.7840180, ?78.643561?, SE Corner 35782758", -78.643574?, SW Corner 35.782797?, -78.644853?, during the initial time frame between 1930 hours and 2200 hours on 3/16/2017. SAID SEARCH WARRANT DATED 5/ v; 90:1!? THIS MATTER having come before me on a petition by the Raleigh Police Department and it appearing to the court that public release of the information related to this search warrant would be detrimental to an ongoing criminal investigation related to this search warrant dated 5 I 5' [qu authorizing the search of Google servers for accounts associated devices that were inside the following area, during the following time frame: NW Corner 35.784057?, -78.644821?, NE Corner 35.784018?, -78.643561?, SE Corner 35.782758", -78.643574?, SW Corner 35.782797", -78.644853?, during the initial time frame between 1930 hours and 2200 hours on 3/16/2017. Pursuant to 18 U.S.C. 2705(b), 3123(d), and 3103a(b), it is ordered that the provider, and all other communications providers, persons or entities who are obligated by the proposed order to provide assistance to the investigative agency, not to disclose in any manner, directly or indirectly, by any action or inaction, to the subscriber(s) or to any other person, the existence of the proposed warrant, in full or redacted form, the existence of the legal request, or the existence of this investigation, unless otherwise ordered by this Courtiand that the identity of any account users included within the search results may be redacted from any copy of the proposed warrant to be served on any service provider or other person. Speci?cally, being as disclosure of the requested order and investigation would likely result in continued ?ight from testimony, a modi?cation of the suspect?s activities or the activities of those with whom the suspect communicates and associates, or the destruction or tampering of evidence; and would otherwise seriously jeopardize the investigation; the applicant further requests, pursuant to the delayed notice provisions of 18 U.S.C. 2705(a), for an order delaying any notification to the subscriber or customer that may be required by 18 U.S.C. 2703(b) to obtain the contents of communications, for a period of ninety (90) days. THEREFORE, BE IT SO ORDERED that the search warrant, dated 5 I i DO not be disclosed to the users with accounts involved or other parties for a period of ninety (90) days. Said search warrant authorizing the search of Google servers for accounts associated devices that were inside the following area, during the following initial time frame: NW Corner 35.784057?, -78.644821?, NE Corner 35.7840180, 78.643561", SE Corner 355327530, -78.643574?, sw Corner 35.7327970, 434544353", during the initial time frame between 1930 hours and 2200 hours on 3/16/2017. This 5!?day of MAM ,203 summon COURT Wm: . (2 ob PRINTED I