Case Document 1 Filed 03/30/18 Page 1 of 16 PagelD 1 A0 06 (Rev. 04.510) Application for a Search Warrant UNITED STATES DISTRICT COURT Ci COURT . it FILED In the Matter of the Search of 75?? RB 0 F3 3 3 (Brie?r describe the properiv to be searched ?q or identity the person by name and address) Case No. 2 . I . INFORMATION THAT IS STORED AT PREMISES CONTROLLED BY GOOGLE, 1600 AMPHITHEATRE CLERK PARKWAY, MOUNTAIN VIEW. CALIFORNIA 94043 APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (idenn'jj- the person or describe the PREMISES CONTROLLED BY GOOGLE. 1600 AMPHITHEATRE PARKWAY, MOUNTAIN VIEW. CALIFORNIA 94043. See Attachment A Section I of Affidavit of FBI Special Agent Patrick Clancy. located in the Northern District of California there is now concealed {identiijr the person or describe rite property to be seized): See Attachment A Section II of Af?davit of FBI Special Agent Patrick Clancy. The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): ?evidence of a crime; El contraband, fruits of crime, or other items illegally possessed; El property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section Offense Descri tion 18 USC 1951 Interference with commerce by threats or vio ence The application is based on thesefacts: . See Attached Af?davrt of FBI SpeCIal Agent Patrick M. Clancy dated March 30. 2018. Continued on the attached sheet. El Delayed notice of days (give exact ending date if more than 30 days: under 18 U.S.C. 3103a, the basis of which is set fonWSL Appb?c'dn! 's signature is requested Patrick M. Clancy, Special Agent, FBI Primed name and ride Sworn to before me and signed in my presence. Date: 03/30/2018 M. 73 I Judge '3 signature John A. Woodcock, Jr.. US. District Judge City and state: Portland. Maine Primed name and ride Case Document 1 Filed 03/30/18 Page 2 of 16 PagelD 2 UNITED STATES DISTRICT COURT DISTRICT OF MAINE AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT 1, Patrick Clancy, being ?rst duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this af?davit in support of an application for a search warrant for information that is maintained on computer servers controlled by Google, Inc. (?Google?), an email provider headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043. The information to be searched is described in the following paragraphs and in Section I of Attachment A, which consists of Google location data associated with a particular speci?ed accounts (?Subject Accounts?) at a particular time, as speci?ed in Section I of Attachment A. This af?davit is made in support of an application for a search warrant under 18 U.S.C. 2703(c)(1)(A) to require Google to disclose to the government copies of the information further described in Section II of Attachment A. 2. I have been a Special Agent with the Federal Bureau of Investigation for approximately 14 years and am currently assigned to the Portland Southern Maine Gang Task Force. Throughout my employment with the FBI, 1 have participated in investigations involving the execution of search warrants, including search warrants for electronic devices and documents. As a result of my training and experience, I am familiar with the techniques and methods of operation used by individuals involved in criminal activity to conceal their activities Case Document 1 Filed 03/30/18 Page 3 of 16 PagelD 3 from detection by law enforcement authorities. 3. Based on the facts set forth in this af?davit, there is probable cause to believe that the Subject Accounts identi?ed in Section I of Attachment A, associated with a particular speci?ed location at a particular speci?ed time, contain evidence, fruits and instrumentalities of a violation of Title 18, United States Code, Section 1951 (Interference with Commerce by Threats or Violence), among other statutes (the ?Subject Offenses?). This af?davit is based upon my personal knowledge, my review of documents and other evidence, and my conversations with other law enforcement of?cers, as well as my training and experience concerning the use of email in criminal activity. Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts I have learned during my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. JURISDICTION AND AUTHORITY TO ISSUE WARRANT 4. Pursuant to 18 U.S.C. 2703(a), the Government may require a provider of an electronic communications service or a remote computing service, such as the Provider, to disclose all stored content and all non-content records or other information pertaining to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules of Criminal Procedure. 5. A search warrant under 2703 may be issued by ?any district court of the United States (including a magistrate judge of such a court)? that ?has jurisdiction over the offense Case Document 1 Filed 03/30/18 Page 4 of 16 PagelD 4 being investigated.? 18 U.S.C. 2711(3)(A)(i). 6. When the Government obtains records under 2703 pursuant to a search warrant, the Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 2703(a), (3). Additionally, the Government may obtain an order precluding the Provider from notifying the subscriber or any other person of the warrant, for such period as the Court deems appropriate, where there is reason to believe that such noti?cation will seriously jeopardize an investigation. 18 U.S.C. 2705(b). BACKGROUND RELATING TO GOOGLE. GOOGLE LOCATIONS SERVICES AND RELEVANT TECHNOLOGY 7. A cellular telephone or mobile telephone is a handheld wireless device used primarily for voice communication through radio signals. Cellular telephones send signals through networks of transmitter-?receivers called ?cells,? enabling communication with other cellular telephones or traditional ?landline? telephones. Cellular telephones rely on cellular towers, the location of which may provide information on the location of the subject telephone. Cellular telephones may also include global positioning system technology for determining the location of the device. 8. Google is an Internet company which, among other things, provides electronic communication services to subscribers. Google allows subscribers to obtain email accounts at the domain name gmail.com. Subscribers obtain an account by registering with Google. During the registration process, Google asks subscribers to provide basic personal information. Therefore, the computers of Google are likely to contain stored electronic communications (including retrieved and unretrieved email for Google subscribers) and information concerning 3 Case Document 1 Filed 03/30/18 Page 5 of 16 PagelD 5 subscribers and their use of Google services, such as account access information, email transaction information, and account application information. In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. 9. In my training and experience, email providers generally ask their subscribers to provide certain personal identifying information when registering for an email account. Such information can include the subscriber?s full name, physical address, telephone numbers and other identi?ers, alternative email addresses, and, for paying subscribers, means and source of payment (including any credit or bank account number). In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. Based on my training and my experience, I know that even if subscribers insert false information to conceal their identity, I know that this information often provide clues to their identity, location or illicit activities. 10. In my training and experience, email providers typically retain certain transactional information about the creation and use of each account on their systems. This information can include the date on which the account was created, the length of service, records of login session) times and durations, the types of service utilized, the status of the account (including whether the account is inactive or closed), the methods used to connect to the account (such as logging into the account via the provider?s website), and other log ?les that re?ect usage of the account. In addition, email providers often have records of the Internet Protocol address address?) used to register the account and the IP addresses associated with particular logins Case Document 1 Filed 03/30/18 Page 6 of 16 PagelD 6 to the account. Because every device that connects to the Internet must use an IP address, IP address information can help to identify which computers or other devices were used to access the email account. 11. As explained herein, information stored in connection with an email account may provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal conduct under investigation, thus enabling the United States to establish and prove each element or alternatively, to exclude the innocent from further suspicion. In my training and experience, the information stored in connection with an email account can indicate who has used or controlled the account. Further, information maintained by the email provider can show how, where, and when the account was accessed or used. Based on my training and experience, I have learned that Google also maintains records that may reveal other Google accounts accessed from the same electronic device, such as the same computer or mobile device, including accounts that are linked by Hypertext Transfer Protocol (HTTP) cookies, which are small pieces of data sent from a website and stored in a user?s Internet browser. 12. Google has developed an operating system for mobile devices, including cellular phones, known as Android. Nearly every cellular phone using the Android operating system has an associated Google account and users are prompted to add a Google account when they ?rst turn on a new Android device. 13. Based on my training and experience, I have learned that Google collects and retains location data from Android-enabled mobile devices when a Google account user has enabled Google location services. The company uses this information for location-based Case Document 1 Filed 03/30/18 Page 7 of 16 PagelD 7 advertising and location?based search results. This information is derived from GPS data, cell site-"cell tower information, and Wi-Fi access points. 14. Location data can assist investigators in understanding the chronological and geographic context of the email account access and use relating to the crime under investigation. This geographic and timeline information may tend to either inculpate or exculpate the account owner. Additionally, information stored at the user?s account may further indicate the geographic location of the account user at a particular time location information integrated into an image or video sent via email). PROBABLE CAUSE 15. The FBI, together with the Portland, Westbrook, Falmouth, South Portland, Old Orchard Beach and Cumberland Police Departments, are conducting an investigation into the armed robberies and attempted armed robberies of nine businesses, in violation of Title 18, United States Code, Section 1951(a), among other statutes (the at the locations indicated in Attachment A, during the approximate times indicated. The approximate times are known from, among other things, eyewitness accounts and incident reporting times. The robberies are more completely described below: a. At approximately 7:35 PM. on March 20, 2018, the Riverton Gas Station located at 1585 Forest Avenue, Portland, Maine, was robbed by a white male carrying a handgun with a silver slide. The robber was described as being approximately tall with a thin build, wearing a heavy dark jacket, dark cap, and a half ski mask concealing his face. This robbery resulted in an approximate monetary loss of three hundred dollars Case Document 1 Filed 03/30/18 Page 8 of 16 PagelD 8 b. At approximately 8:11 P.M. on March 21, 2018, the Lil? Mart gas station located at 264 US Route 1, Falmouth, Maine, was robbed by a white male carrying a handgun described as resembling a Browning I-Ii-Power model. The robber was described as being approximately tall, having light blue eyes and blond hair, wearing a dark grey hooded sweatshirt, black gloves, and a black balaclava or ski mask. This robbery resulted in an approximate monetary loss of one hundred ninety eight dollars and eleven cents c. At approximately 12:48 PM. on March 22, 2018, the Good Things Variety store located at 113 Saco Street, Westbrook, Maine, was robbed by a white male carrying a black handgun described as similar to a Glock 22 model. The robber was described as being approximately tall, slim build, wearing a dark blue ?eece, a face wrap covering the lower half of his face, and black ?eece gloves. This robbery resulted in an approximate monetary loss of two hundred eighty ?ve dollars d. At approximately 8:14 P.M. on March 22, 2018, the Express Mart located at 174 Main Street, Cumberland, Maine, was robbed by a white male carrying a black pistol. The robber was described as being approximately 6? tall, thin build, wearing all black clothing including a full face mask and black gloves. This robbery resulted in an approximate monetary loss of six hundred ?fty to seven hundred dollars ($650 - $700). e. At approximately 7:49 AM. on March 24, 2018, the Daily Grind located at 820 Main Street was robbed by a white male carrying a black handgun. The robber was described as being approximately tall, thin build, having blue eyes and reddish eyebrows Case Document 1 Filed 03/30/18 Page 9 of 16 PagelD 9 wearing black khaki pants, black sweatshirt with the hood up, and a black face mask. This robbery resulted in an approximate monetary loss of two hundred forty dollars f. At approximately 8:28 PM. on March 25, 2018, the China Taste restaurant located at 1223 Washington Avenue, Portland, Maine, was robbed by a white male carrying a black semi-automatic handgun. The robber was described as being approximately tall, wearing a dark and light green camou?age hooded sweatshirt and a dark ?zip-up? covering the lower half of his face. The robber had an empty plastic bag around his left hand. This robbery did not result in a monetary loss, possibly due to a language barrier. g. At approximately 8:35 P.M. on March 26, 2018, the Subway restaurant located at 690 Bridgton Road, Westbrook, Maine, was robbed by a white male carrying a black pistol. The robber was described wearing blue jeans, dark hooded sweatshirt, and something dark covering his face. This robbery resulted in an approximate monetary loss of approximately two hundred dollars h. At approximately 8:35 P.M. on March 27, 2018, the Aroma Joe?s establishment located at 443 Western Avenue, South Portland, Maine, was the victim of an attempted robbery. A white male, wearing dark clothing including a black hooded sweatshirt with the hood up and drawstrings pulled tight so only his ?upper nose? was exposed, approached the drive?thru window and banged on the window with a black gun. The clerk described the male as being approximately the same height as a responding police of?cer, who is The clerk locked herself in the bathroom and the robber departed. This robbery did not Case Document 1 Filed 03/30/18 Page 10 of 16 PagelD 10 result in a monetary loss. i. At approximately 3:38 PM. on March 29, 2018, the China Eatery restaurant located at 5 Ocean Park Road, Old Orchard Beach, Maine, was robbed by a white male carrying a black handgun. The robber was described as being to in height, thin build, with blond hair, bright blue eyes, wearing black pants, blue sweatshirt, and a ski mask or scarf covering his face. This robbery resulted in a monetary loss of approximately ?ve hundred dollars EVIDENCE, FRUITS ANQINSTRUMENTALITIES 16. Based on the foregoing, I respectfully submit that there is probable cause to believe that information stored on the Providers? servers associated with the Google accounts accessed at particular speci?ed locations at a particular speci?ed times, as speci?ed in Section I of Attachment A of the proposed warrant, will contain evidence, fruits and instrumentalities of the Subject Offenses. 17. In particular, the geographical region bounded by the latitudinal and longitudinal coordinates indicated in Section I of Attachment A to the proposed warrant re?ects the area within a polygon bounded by four points for the nine locations provided, and the times speci?ed in Section I of Attachment A to the proposed warrant re?ects the period between shortly before and after the robberies (the ?Target Time Period?). The speci?c longitudes and latitudes indicated in Attachment A were identi?ed through a mapping software, which matched the longitudes and latitudes indicated in Attachment A as corresponding to the crime locations. This Application seeks authority to collect certain location information related to Google Case Document 1 Filed 03/30/18 Page 11 of 16 PagelD 11 accounts that were located within the Target Areas during the Target Time Periods (the ?Subject Accounts?). The information sought from Google regarding the Subject Accounts, speci?ed in Section II of Attachment A to the proposed warrant, will identify which cellular devices were near two or more of the locations where the robberies occurred at the date and time the robberies occurred, and may assist law enforcement in determining which persons were present or involved with the robberies under investigation. REQUEST FOR NON-DISCLOSURE AND SEALING 18. Based on the forgoing, I respectfully request that the Court issue the proposed search warrant. Because the warrant will be served on Google who will then compile the requested records at a time convenient to it, reasonable cause exists to permit the execution of the requested warrant at any time in the day or night. 19. The existence and scope of this ongoing criminal investigation is not publicly known. As a result, premature public disclosure of this af?davit or the requested warrant could alert potential criminal targets that they are under investigation, causing them to destroy evidence, ?ee from prosecution, or otherwise seriously jeopardize the investigation. In light of the violent nature of the crime under investigation, premature revelation of this investigation may alert dangerous targets that they have been identi?ed by others and endanger the safety of witnesses who have been cooperating with the Government. 20. Accordingly, there is reason to believe that, were the Provider to notify subscribers of the Subject Accounts or others of the existence of the warrant, the investigation 10 Case Document 1 Filed 03/30/18 Page 12 of 16 PagelD 12 would be seriously jeopardized. Pursuant to 18 U.S.C. 2705(b), I therefore respectfully request that the Court direct the Provider not to notify any person of the existence of the warrant for a period of 180 days from issuance, subject to extension upon application to the Court, if necessary. 21. For similar reasons, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. CONCLUSION 22. Based on the foregoing, I respectfully request that the warrant sought herein pursuant to the applicable provisions of the Stored Communications Act, 18 U.S.C. 2703(b)(1)(A) (for contents) and 2703(c)(1)(A) (for records and other information), and the relevant provisions of Federal Rule of Criminal Proced% Patrick M. Clancy Special Agent Federal Bureau of Investigation Sworn to before me this 301" day of March, 2018 JOHN A. WOODCOCK, JR. UNITED STATES DISTRICT JUDGE DISTRICT OF MAINE 11 Case Document 1 Filed 03/30/18 Page 13 of 16 PagelD 13 ATTACHMENT A I. Subject Accounts and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, and applies to information further described in Section 11 below within the Provider?s possession, custody, or control associated with any devices using Google Location Services, utilizing either WIFI, GPS or Bluetooth based locations, (excluding cell-based locations) in TWO OR MORE of following locations at the listed times (the ?Subject Accounts?): A) 7:10 pm. to 7:40 pm. on March 20, 2018: Within a 4-point polygon bounded by the following points: A. Latitude 43.6979028 and Longitude -70.3082553; B. Latitude 43.6978770 and Longitude -70.3053427; C. Latitude 43.6960219 and Longitude -70.3053529; and D. Latitude 43.6959888 and Longitude -70.3082553, which corresponds to the Riverton Gas Station, located at 1585 Forest Avenue, Portland, Maine. B) 7:46 pm. to 8:16 pm. on March 21, 2018: C) 12:23 pm. Within a 4-point polygon bounded by the following points: A. Latitude 43.7262833 and Longitude -70.2338529; B. Latitude 43.726251 1 and Longitude ?70.2309282; C. Latitude 43.7242234 and Longitude ?70.2309133; and D. Latitude 43.7242126 and Longitude -70.2337786, which corresponds to the Lil Mart, located at 264 US Route 1, Falmouth, Maine. to 12:53 pm. on March 22, 2018: Within a 4-p0int polygon bounded by the following points: A. Latitude 43.6743182 and Longitude -70.3741012; B. Latitude 43.6743182 and Longitude -70.3710381; C. Latitude 43.6723843 and Longitude -70.3710381; and D. Latitude 43.6723750 and Longitude -70.3741012, which corresponds to the Good Things, located at 113 Saco Street. Westbrook, Maine. D) 7:49 pm. to 8:19 pm. on March 22, 2018: Case Document 1 Filed 03/30/18 Page 14 of 16 PagelD 14 Within a 4-point polygon bounded by the following points: A. Latitude 43.782375? and Longitude -70.2587237; B. Latitude 43.7823522 and Longitude -70.2552521; C. Latitude 43.7804136 and Longitude -70.2552716 and D. Latitude 43.7804136 and Longitude -70.2587497, which corresponds to the Express Mart, located at 174 Main Street, Cumberland, Maine. E) 7:24 am. to 7:54 am. on March 24, 2018: Within a 4-point polygon bounded by the following points: A. Latitude 43.6771399 and Longitude -70.3661392; B. Latitude 43.6771399 and Longitude -70.3633727; C. Latitude 43.6753106 and Longitude -70.3633653; D. Latitude 43.6753160 and Longitude -70.3661764, which corresponds to the Daily Grind, located at 820 Main Street. Westbrook, Maine. F) 8:03 pm. to 8:33 pm. on March 25, 2018: Within a 4-point polygon bounded by the following points: A. Latitude 43.6959810 and Longitude -70.2853316; B. Latitude 43.695967? and Longitude -70.2825910; C. Latitude 43.6940800 and Longitude -70.2826096; and D. Latitude 43.6940833 and Longitude -70.2853501, which corresponds to the China Taste Restaurant, located at 1223 Washington Avenue, Portland, Maine8:40 pm. on March 26, 2018: Within a 4-point polygon bounded by the following points: A. Latitude 43.7147115 and Longitude -70.3355798; B. Latitude 43.7146814 and Longitude -70.3327242; C. Latitude 43.7128286 and Longitude -70.3327159; and D. Latitude 43.7128166 and Longitude -70.3355713, which corresponds to the Subway restaurant, located at 690 Bridgton Road, Westbrook, Maine. H) 8:10 pm. to 8:40 pm. on March 27, 2018: Within a 4-point polygon bounded by the following points: A. Latitude 43.6437283 and Longitude -70.3302177; B. Latitude 43.6437349 and Longitude -70.3272665; C. Latitude 43.6418139 and Longitude -70.3272526; D. Latitude 43.6418239 and Longitude -70.3301853, which Case Document 1 Filed 03/30/18 Page 15 of 16 PagelD 15 corresponds to the Aroma Joe?s establishment located at 443 Western Avenue, South Portland, Maine. I) 3:13 pm. to 3:43 pm. on March 29, 2018: Within a 4?point polygon bounded by the following points: A. Latitude 43508345? and Longitude -70.4110681; B. Latitude 43.508327? and Longitude -70.4084470; C. Latitude 43.5064448 and Longitude -70.4084803; and D. Latitude 43.5064809 and Longitude -70.41 11097, which corresponds to the China Eatery restaurant, located at 5 Ocean Park Road, Old Orchard Beach, Maine. Information to Be Provided by the Provider To the extent that the information described in Section I is within the possession, custody, or control of the Provider, including any information that has been deleted but is still available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. 2703(f), the Provider is required to disclose the following information to the government for each account or identi?er listed in Section I: a. All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any credit or bank account number); b. All location data, whether derived from Global Positioning System (GPS) data, cell sitetcell tower triangulation/trilateration, and precision measurement information such as timing advance or per call measurement data, and Wi-Fi location, including the GPS coordinates and the dates and times of all location recordings, for the time period described in Section c. All images, videos, or other ?les containing the integrated or embedded location data Case Document 1 Filed 03/30/18 Page 16 of 16 PagelD 16 re?ecting that the ?le was created during the time period described in Section and d. The types of service utilized. In addition, for any Google accounts linked to the accounts or identi?ers listed in Attachment A by HTTP cookies, recovery email address, or telephone number, the Provider is required to disclose all records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any credit or bank account number). This warrant is not intended to include Cell Site Location Information (CSLI) estimates.