?mm STATE OF NORTH CAROLINA WAKE In The SEARCH WARRANT mum? 0mm? IN THE MATTER oF To any of?cer with authority and jurisdiction to conduct the search authorized bar this 5am? Accounts associated with devices that were inside the area. .. Detrsissuod Time lest-red J?lv?iln Neme ?l'?ppl'ieam? Detective Brad Winston Wt Nam CMAdci?onel?Ment? RETURN oFsEercE I certil?gir that this Search Warrant was received and xecuted follows: 35 Detei?l'eoeimd Time Received AM PM oars Exceeded Tim-e Executed [3 AM El PM I made a search of l' the undersigned, ?nd that there is Probable cause to believe that the property and person deserted it th? on the reverse side and related to the commission of a crime is located as described in the application. You are commanded to search the premises. vehicle. person and other place or item described in the application for the pronertv and person in question. It the property andior person are found. matte the seizure and keep the property subject to Court Order and process the person according to law. You are directed to execute this Search Warrant within forty-eight {43} hours from the time indicated on this Warrant and make due return to the Clerk of the Issuing Court. This Search Warrant is issued upon information furnished under oath or af?rmation by the personts} shown. kgi??I ate some D?dl?it Lin ?bhw?l?x as commanded. ?ned the items listed on the attached inventory. Elmo?sc Dame-moss Close Um I Dmam Who?k I did not seize env items. El This Warrant was NOT executed within forty-eight {48) hours of the data of issuance and hereby return it not executed. This Search Warrant was delivered to me on the dete and It the time shown below when the cities of the Clerk of Superior Court Is closed for the of business. By signing below. I certify that I wilt deliver this Search to the Office oi the Cleric of Superior Court as soon as possible on the Cier?it's Mitt business day. .. G?lcerHskino?etumtTy-pe Grit-Witt gator? hi pm Statement-um!- PM Time This search returned to the under-in?ict ?lth on the taste and time shown below. Hosea-i to. Rev. 2 2012 Administrative of?ce ofthe Courts .. ammo so? imam {la Mimi/n PO 412%? i2i3l it: 7% Twat/14m (,an IN THE MATTER OF: ATTACHMENT TO APPLICATION FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: NW NE Corner SE Corner SW Corner AND A SECOND GEOGRAPHICAL AREA DESCRIBED ON 10? 11101? During the following time frame: 193%] hours Eastern through 1030 hours Eastern, on $11310]? coco hours Eastern through Will} hours Eastern on 11m li?l?l'l, data maintained on computer scrvers controlled by Google, Inc. ATTACHMENT 1- PROPERTYIEVIDENCE TO BE SEIZED: The facts and circumstances outlined in this af?davit suggest that there is probable cause to believe evidence of the commission of the crime of Sexual Battery, a violation of North Carolina General Statute 14?2133 {hereinafter ?Subject Offense), may be found within computer servers maintained or controlled by Google, Inc. or Google Payment Corp. Such accounts are described further in ATTACHMENT II (hereinafter ?the Ac counts?) stored at premises controlled by Google, lnc., a company that accepts service of legal process at 1600 Arnphitheatrc Parkway, Mountain View, California 94043. The following material is sought for the time period of 1930 hours Eastern through 2030 hours Eastern, on 81121201? AND 0600 hours Eastern through 0730 hours Eastern on 11201? 1. For each type of Google account that is associated with a device that was inside the geographical area described further in ATTACHMENT during the time frame listed above, Google will provide ?anonymity! information" regarding the Accounts that are associated with a device that was inside the desen?bed gmgraphical area during the time frame described above. This ?anonymized information? will include a numerical identi?er for the accoum, the type of account, time stamped location coordinates and the data that this information came from if available. The information initially [rovided by Google 1will not contain any further content or information identifying the user of a pmtitailar device or 2. law enforcement o?icers will review this ?anonymized information? provided by Google, Inc. in an effort to narrow down the list of accounts associated with dovices identi?ed in the ?anonymized information?. Law enforcement officers will attempt to narrow down the list by reviewing the time stamped Iom?on coordinates for each account and comparing that against the known time and location informatics: that is speci?c to this crime. 3. Law enforcement of?cers will return a list that they have attempted to narrow down. This list will still be identi?ed by the ?anonymized information? described above. After this review by Law Enforcement and upon request, Google, Inc. shall produce ?contextual data points with points of travel outside of the geographical area" described further in ATTACHMENT of this Application for Search Warrant. The time frame 1trill be expanded for this production of ?contextual data points with points of travel outside of the geographical area? for 30 minutes before AND 30 minutes after the initial search time periods of 1930 hours Eastern through 2030 hours Eastern, on 21?20]? AND 0600 hours Eastern through [ll-'30 hours Eastern on [Oil NEW. This expanded time frame will be from 1900 hours Eastern through 2100 hours Eastern, on 81'121'2017 AND 0530 hours Eastern through cane hours Eastern on 1611112011. Google Inc. shall provide this additional information to Law Enforcement for review. 4_ Law Enforcement officers will review this additional information along with the information? and will attempt to narrow down the list by coarparing this additional information regarding travel and time against the known tithe and location information that is speci?c to this crime. TO AND SUBSCRIBED BEFORE ME THIS ?1:1 DAYOFWED t3 . 72,04 (AMA: Sinatra-c of Applicant El Display Asst. csc?l?i?t ofSupl or. mm Page of (g Page: ?f THE MASTER OF: TU APPLICATION FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: NW Corner NE Corner SE Corner SW Corner AND A SECOND GEDGRAPHICAL AREA DESCRIBED BELOW ON 10!] Hill]? During the following time frame: 193? hours Eastern through Elm} hours Eastern, on 83121201? AND ll?llil hours Eastern through 1113!] hours Eastern on data maintained on computer servers controlled by Google, Inc. 5. After review and upon request by Law Enforcement, Google inc. shall provide identifying account information 1 CSI for the requested by Law Enforcement. This identifying account information i CSI shall include all of the following that are available: user name and subscriber information to include date of birth if available, account type and account number, email addresses associated with the account, electronic devices associated with the account and their identifying make, model and other identifying numbers, telephone numbers associated with the account including telephone numbers used to set up the account, verify the account or to receive assistance with the account, and Google Voice phone numbers associated with the account. ATTACHMENT PLACES TO BE SEARCHED: This search warrant applies to the Google Accounts associated with devices that were located inside either of the following 2 geographical areas: NW Corner 35.939843?, 48.566209?, NE Corner 35.9408?5?, - 78.562815?, SE Corner 35.938993?, 48.56593?, SW Corner 35.940345?, #3562353?, during the initial time frame between 1930 hours and 2030 hours Eastern on 3112.!2017. LOCATION and TIME: North Corner 35.948311?, -78.567996?, East Corner 48.566500", South Corner 35.946249?, 48.561450?, West Corner 35.947509, 38.568836? during the initial time frame between 060i} hours and [Wild hours Eastern on This data is maintained on computer servers that are stored at premises controlled by Google Inc., a companyr that accepts service of legal process at 1600 Amphitheatre Parkway, Mountain View, California 94043. lrnages of the 2 geographical areas on following page. TO AND SUBSCRIBED ME ?De-tr emti . was Signmue of pplicant Page Q'oflg Pages IN 3 . 0F- .v?tl?f'l II A MIN . . FUR assnnated that inaide the following geographical area: F. Corner 35.940375?.?73.562315?. SE Corner EM (?IIrner 34034:: sun A EH: GEOGRAPHICAL AREA DESCRIBED 05' During the following time ?ame: hum, Eastern lhmugh 1030 hm? Eastern. on ?.1220? ASD 0w? hm? Eastern through hours Lastern 0? Will-"31H? data maintainL-d nn mmpuler servers tuntrulled b} [300219. Inc. First gmgraphicu] area Ircgarding .Fa's'saaog ?35 935993 as 5651976Haunt?35 35557955 2.: 511'. 113;th BEFQRI: 51F. IHIH ELI .20 Vi 5:1. - .LII: flu?ulnuljr'CSC . tip. I . r?~f IN THE MATTER OF: ATTACHMENT TO APPLICATION FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: NW Corner NE Corner SE Corner sw Corner AND A SECCIND GEOGRAPHICAL AREA DESCRIBED BELOW OK It)? 13201? During the following time frame: 193? hours Eastern through 1030 hours Eastern, on 3112:2017 AND hours Eastern through ?730 hours Eastern on 1an ?2017, data maintained on computer servers controlled by Google, Inc. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider, Google Inc. The Provider is directed to produce to the law enforcement officer an electronic copy of the information speci?ed in ATTACHMENT 1. ATTACHMENT - PROBABLE CAUSE AFFIDAVIT: The Af?ant swears to the following facts to establish probable cause for the issuance of a search warrant: On Sfl?l? between 1930 hours and 2030 hours Eastern, the victim in Case Pli-?43306 wasjogging along Falls of Noose Rd when she noticed a BJM approaching her from behind. The victim stepped aside to the let the snapoct pass and the suspect grabbed the victim pushing her to the ground and causing both persons to roll down a small embankment As the victim attempted to get up, the suspect tried to wrap his legs around the legs of the victim to prevent her escape. It is at this time that the suspect rubbed his genitals on the victim?s buttocks in a grinding motion. The victim was able to escape from the suspect and call 9-1-1. On l?fl between 0600 and (ll-'30 hours Eastern, the victim in Case PIT-055645 was walking to Wake?eld High School via Wake?eld Pines when she sensed someone behind her. The victim looked back to see a BM walking up behind her. This Stanled the victim who began to walk at a faster pace. When the suspect matched her pace, the victim began running. The suspect began running in pursuit of the victim. In an attempt to reach Wake?eld High School quickly, the victim ran through a small wooded area adjacent to the tennis courts of the high school. The suspect caught the victim, pushed her to the ground, and attempted to unbutton her pants and pull her shirt up- The victim kicked the suspect in the groin area and was able to escape from the suspect The suspect description in the above two incidents are similar. The incidents are within 2.0 miles of each other. Other efforts to identify the suspect have returned negative results as of the time of this search warrant application. This applicant knows that a cellular telephone or mobile telephone is a handheld wireless device primarily used for voice, text, and data cotmnunication through radio signals. Cellular telephones send signals through networks of called ?cells" or ?cell sites," enabling communication with other cellular telephones or traditional ?landlirre" telephones. Cellular telephones rely on cellular towers, the location of which may provide information on the location of the subject telephone. Cellular telephones may also include global positioning system or other technology for determining a more precise location of the device. This applicant also knows that Google is a company which, among other things, provides electronic communication services to subscribers, including email services. Google allows subscribers to obtain email accounts at the domain name gmailcom auditor google.com. Subscribers obtain an account by registering with swoon To AND soascsraen across are Lg THIS 2 *1 DAY OF dici" . l: Q?lf'i?we. Signature oprplicanl Page _Ll_ of_ [a Pages COPH THE MATTER OF: ATTACHMENT TD APPLICATION FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: NW Corner NE Corner SE Corner SW Corner AND A SECDND GEOGRAPHICAL AREA DESCRIBED BELOW Obi Illhr I ?2017 During the following time frame: 1930 hours Eastern through 103!) hours Eastern, on AND hours Eastern through 0730 hours Eastern on 10!] ?201?, data maintained on computer servers controlled by Ganglia The geographical region described in ATTACHMENT 1] is the area in close proximity to the location of where the Subject Offense being investigated was committed. The speci?c longitude and latitude indicated was identi?ed through a mapping software and a screensth of this location is included within II. This af?davit seeks authority to coilect certain speci?ed non-content and limited content information related to Google accounts that were located within the Target Area during the Target Time Period {the ?Subject Accounts?). The information sought from Google regarding the Subject Accounts, speci?ed in ATTACHMENT 1 to this warrant, will assist in identifying which cellular devices were near the location where the crime being investigated occurred during the time frame it is Currently believed to have occurred. This information may assist law enforcement in determining which persons were present or involved with the Subject Offense under investigation. The applicant would reapect?illy request the court issue a search warrant for the material outlined in ATTACHMENT 1 of the above?mentioned premises controlled by Google. All information and facts provided in this af?davit are true and accurate to the best of the applicant?s knowledge. The applicant feels that there is suf?cient probable cause for the issuance of a search warrant for the evidence, fruits. and instrumentalities of violations of Subject Offense which may be contained within the ?lmished records. swoatv To nan suascsteao across ME rats osvor (1351:. Are . Signature tit-Applicant Deputy El Asst {3 rk ofsua or, Magwudgc Past _Ce of" (2-- Pia-=5 THE MATTER lEllF: ATTACHMENT TD APPLICATION . . FDR SEARCH WARRANT Accounts associated dances that were inside the following geographical area: NW Corner NE Corner so Corner sw Corner AND A SECONI) GEOGMHICAL DESCRIBED BELOW 0N tuntnun During the following time frame: 1930 hours Eastern through 203? hours Eastern. on 33131011 AND tl?tl? hours Eastern through 0130 hours Eastern on 10!] 1:10.17, data maintained on computer servers controlled by Google, Inc. Google. A subscriber using the Provider's services can access his or her email account from any connected to the Internet. This applicant knows that Google has also developed a proprietary operating system for mobile devices, including cellular phones, known as Android. Nearly every cellular phone using the Android operating system has an associated Google account, and users are prompted to add a Google account when they ?rst turn on a new Android device. Based on this applicant's mining and experience, this applicant knows that Google collects and retains location data ?'oru Android?enabled mobile devices when a Google account user has enabled Google location services. Google can also collect location data from non-Android devices if the device is registered to a Google account and the user has location services enabled. The company uses this information for location-based advertising and location-based search results and stored such data in perpetuity unless it is manually deleted by the user. This location information is derived from GPS data, cell sitelcell tower information, Bluetooth connections, and Wi-Fi actress points. This applicant blows that locatim data can assist investigators in forming a fuller geospatial understanding and timelinc related to a speci?c criminal investigation; and may tend to identify potential witnesses andr?or suspects. Such information can also aid investigators in possibly inculpating or exculpating persons of interest. Additionally, location infarmation can be digitally integrated into image, video, or other computer ?les associated with a Google account and can indicate the geographic location of the accounts user at a particular date and time (cg, digital cameras, including on cellular telephones, frequently store GPS coordinates indicating where a photo was taken in the ?metadata? of an image This applicant reqrectfully submits that there is probable cause to believe that information stored on the vaiders' servers associated with the Google accounts andfor devices located at the location and timefrarne speci?ed in ATTACPMENT II, will contain evidence, fruits and instrumentalities of the Subject D??ense'. 'l'he State of North Carolina maintains that the information sought herein consists entirely of ?record[s]? other than the ?contents of which is subject to the provisions outlined in 18 U.S.C. 2703(d). Such records, requires only a showing that there are reasonable grounds to believe that the information sought is relevant and material to an ongoing criminal investigation. Sec 13 U.S.C. 2703(c)(1)(A). Despite this, Google has indicated that it believes a search warrant, and not a court order, is required to obtain the location data sought in this application. Although the disagrees with Gocgle?s position, because there is probable cause to believe that the information sought herein will contain evidence of the criminal offenses speci?ed in this af?davit, the Government is seeking a search warrant in this case. swears To AND Werner: serous so: . . MIL. Signature of Applicant Page 5 of in: Pages Con STATE OF NORTH CAROLINA IN THE GENERAL COURT or JUSTICE COUNTY OF WAKE SUPERIOR count" DIVISION APPLICATION FOR ORDER TO PREVENT DISCLOSURE TO THE USERS WITH ACCOUNTS INVOLVED OF THE OF A SEARCH WARRANT RELATED TO GOOGLE ACCOUNTS ASSOCIATED DEVICE THE FOILOWING 2 AREAS, DURING THE FOILOWG THREE NW Corner 35.939343?, 43.566209?, NE Corner 35.940375?, #8562815?. SE Corner 35338998?, #8565979?, SW Corner 35.940345?, 38.562353?, during the initial time frame between 1930 hours and 1031} hours Eastern on Billiltll'r'. 2" LOCATION and TIME: North Corner 35.948311?, 48.557996?, East Corner 35.947052?, #8566500?, South Corner 35.946149?, -73.56745ll?, West Corner 35.94??508?, 43.563836" during the initial time frame tween hours and Willi hours Eastern on SAID SEARCH WARRANT DATED I Sid I?ll - NOW COMES Detective Brad Winston of the Raleigh lice Dep nt, and petitions the Court to authorize an order to prevent disclosme of the search warrant dated I 1?7 any; to the users with accounts involved. Said search warrant authorizing the search of Google serverit for accouiits associated devices that were inside the following areas, during the following time frames NW Corner 35.939843?, assesses?, NE Corner 35.940375?; 38.562315?, SE Comer 35.933998?, SW Corner 35.940345?, -78.562353?, during the initial time frame between 1930 hours and 2030 hours Eastern on 831230?. 2ml LOCATION and TIME: North Corner 35.948311?, 38.567996?, East Corner South Corner 35.946249?, -73.567450?, West Comer 38.568336? during the initial time frame between 0600 hours and 0730 hours Eastern on lx'2017. Pursuant to [3 U.S.C. Tl??fb), and 3103afb], this applicant requests that the proposed order direct the provider, and all other communications providers, persons or entities who are obligated by the proposed waJTant to provide assistance to the investigative agency, not to disclose in any manner, directly or indirectly, by any action or inaction, to the mbecribeds} or to any other person, the existence of the proposed warrant, in full or redacted form, the existence of the legal request lite existence of this investigation, unless otherwise ordered by this Court; and that the identity of any account! Inc-rs inchatled within the search results may be redacted from any copy of the proposed warrant to be served on any service provider or other person. The and scope of this ongoing criminal investigation is not publicly known. As a result, premature public disclosure of ?sh af?davit or the requested warrant could alert potential criminal targets that they are under investigation, causing them to demoy evidence, ?ee ?om prosecution. or otherwise seriously jeopardize the investigation. In light of the serious nature of the crime under investigation, premature revelation of this investigation may alert dangerous targets that they have been identi?ed by others and endanger the safety of witnesses who have been cooperating with the Government. Accordingly, there is reason to believe that, were the Provider to notify subscribers or users of the Subject Accounts or others of the existence of the warrant, the investigation would be seriously jeopardized. Pursuant to 18 U.S.C. 2705(a), 1 therefore respect?illy requ?t that the Court direct the Provider not to notify any person of the existence of the wanant for a period of 90 days from W, subject to extension upon application to the Court, if necessary. For similar reasons, I respect?illy request that the accompanying warrant and all papers submitted herewith be maintained under seal until the Corn-t orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose duos-e materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. The Applicant declares under penalty of peijm'y that the foregoin is toes and correct to the best of my knowledge and betiefand that this declaration was execrned on (51 33:7 . .90 l5}. ?ff? Rolf} swo REMETHIS ?5511'! tTt; AFFIANTS NAME NORTH CAROLINA SUPE chase/o "17* true-tiers tarmac STATE OF NORTH CAROLINA THE GENERAL COURT OF JUSTICE COUNTY OF WAKE SUPERIOR COURT DIVISION COURT ORDER TO PREVENT DISCLOSURE TO THE USERS WITH ACCOUNTS INVOLVED OF THE EXISTENCE OF A SEARCH WARRANT RELATED TO GOOGLE ACCOUNTS ASSOCIATED DEVICE INSIDE THE I AREAS, DURING THE TIME Niall" Corner 35.939843?, NE Corner #3562015?, SE Corner 35.933998?, #8565979?, SW Corner 35.940345?, -70.562353?, during the initial time frame between 1930 hours and 1030 hours Eastern on $132017. LOCATION and TM: North Corner 35.943311?, 333.567996", East Corner 35347052", South Corner 35.946249?, -73.567450?, West Corner 35.949503?, 48.568881? during the initial ti frame hveen 0600 hours and 0730 hottrs Eastern on SEARCH DATED i 17 Cl :0 1. THIS MATTER having come before me on a petition by the Raleigh Police Department and it appearing to the court that public release of the information related to this search arrant we be detrimental to an ongoing criminal investigation related to this search warrant dated i 17 2,994 authorizing the search of Google servers for accounts associated devices that were inside the followibg area, during the following time frame: NW Corner 35.939343: w?3.566209?, NE Corner 35.9403r5=, assassin, SE Corner 35333993?. assess?rs?, SW Comer 35.940345?, 43562353", during the initial time frame betWeen 1930 hours and 2030 hours Eastern on Bill??li?. 2":l LOCATION and TM: North Corner 35.94331l?. 33.567996?, East Corner 35.947052?, 38.566500?, South Corner 35.946249?. West Corner 35.941503?, 38.568336? during the initial time frame between 0600 hours and 0130 hours Eastern on l?fl lilo} Pursuant to 18 U.S.C. 2905(b), 3123(d}, and 3103atb], it is ordered that the provider, and all other conununications providers, persons or entities who are obligated by the proposed order to provide assistance to the investigative agency, not to disclose in any manner, directly or indirectly, by any action or inaction, to the subscribeds) or to any other person, the existence of the proposed warrant, in full or redacted form, the exists-not: of the legal request, or the existence of this investigation. unless otherwise ordered by this Court; and that the identity of any account users included within the search results may be redacted from any copy of the proposed warrant to be served on any service provider or other person. Speci?cally, being as disclosure of the requested order and investigation would likely result in continued ?ight from testimony, a modi?cation of the suspect?s activities or the activities of those with whom the suspect communicates and associates, or the destruction or tampering of evidence; and would otherwise seriously jeopardize the investigation; the applicant further requests, pursuant to the delayed notice provisions of 18 U.S.C. 2T05(a}, for an order delaying any noti?cation to the subscriber or customer that may be required by 13 U.S.C. 21'03fb) to obtain the contents of communications, for a period of ninety (90) days. THEREFORE, BE IT SO ORDERED that the search warrant, dated 1? C34 [2225 ii, not be disclosed to the users with accounts involved or other parties for a period of ninety (90) days. Said search warrant authorizing the search of Google servers for accounts associated devices that were inside the following area, during the following initial time frame: NW Corner 35.784057?, 48.644821?, NE Corner 35.734018?, - 98.643561?, SE Corner 35.182958?, 48.643574?, SW Corner 35.782797?, -78.644353?, during the initial time fume between 1930 hours and 2200 hours on Thisthe__2?_?ldayof 009' ,2033: MW <71. (at Buy-tat: PRINTED CGPW .51" STATE OF NORTH CAROLINA Vim Th H: [i ?t5? [331mg (Eagpe?gr Cour?lig?sjon IN THE MATTER OF: Name is chums INVENTORY OF ITEMS SEIZED *8 05 I PURSUANT TO SEARCH we maidc- 910 m- m0- I. the undersigned of?cer, exewted a search of: Ed?w El amuse-armgwenhy maximum-5mm: awn Original-FI- AME-206. Rm. SHE $21116. Adm-mm: Dfliue tithe Calm