Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed2 11/27/18 *SEALED*Page Filed 1 of 07/20/18 10 PagePage ID #:257 1 of 10 Page ID #:129 UNITED STATES DISTRICT COURT for the Central District of California In the Matter of the Search of: Information associated with account identified as ray.sw.chan@gmail.com that is within the possession, custody, or control of Google, Inc. ) ) ) ) ) ) Case No. 2:18-MJ-1881 WARRANT PURSUANT TO 18 U.S.C. § 2703 To: Any Authorized Law Enforcement Officer An application by a federal law enforcement officer requests the production and search of the following data: See Attachment A The data to be produced and searched, described above, are believed to contain the following: See Attachment B I find that the affidavit, or any recorded testimony, establishes probable cause to produce and search the data described in Attachment A, and to seize the data described in Attachment B. Such affidavit is incorporated herein by reference. AUTHORIZED LAW ENFORCEMENT OFFICER/S IS/ARE HEREBY COMMANDED to serve this warrant on Google, Inc. in the daytime, between the hours of 6:00 a.m. and 10:00 p.m., within 14 days from the date of its issuance. GOOGLE, INC. IS HEREBY COMMANDED to produce the information described in Attachment A within 10 calendar days of the date of service of this order. GOOGLE, INC. IS FURTHER COMMANDED to comply with the further orders set forth in Attachment B, and, pursuant to 18 U.S.C. § 2705(b), shall not notify any person, including the subscriber(s) of the account/s identified in Attachment A, of the existence of this warrant. The officer executing this warrant, or an officer present during the execution, shall prepare an inventory as required by law, and shall promptly return this warrant and the inventory to the United States Magistrate Judge on duty at the time of the return through a filing with the Clerk’s Office. AUTHORIZED LAW ENFORCEMENT OFFICER/S IS/ARE FURTHER COMMANDED to perform the search of the data provided by Google, Inc. pursuant to the procedures set forth in Attachment B. 7/20/2018 @ 1:18 pm Date and time issued: _______________________ /S/ ALEXANDER F. MACKINNON Judge’s signature Los Angeles, CA City and State: ____________________________ Alexander F. MacKinnon, U.S. Magistrate Judge Printed name and title AUSA: Veronica Dragalin (x0647) Case Document 3 Filed 11/27/18 Page 2 of 10 Page ID #:258 Case Document 2 Filed 07/20/18 Page 2 of 10 Page ID #:130 Return Case No: Date and time warrant served on provider: if; (5th Inventory made in the presence of' ?34 (Lu, 9? Inventory of data seized: 1 [Please provide a description of the information produced] 1044,,? Newt ab Aown\0o\rQer?L mu fruit. sub. dam @Wa? (LN. Certification I declare under penalty of perjury that I am an o?icer involved in the execution of this warrant, and that this inventory is correct and was returned along with the original warrant to the designated judge through a ?ling with the Clerk?s O?ice. Date: ll iquiotf) W1 Executing o?cer ?s s?nature Printeci name and title Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed2 11/27/18 *SEALED*Page Filed 3 of 07/20/18 10 PagePage ID #:259 3 of 10 Page ID #:131 ATTACHMENT A PROPERTY TO BE SEARCHED This warrant applies to information associated with the account identified as ray.sw.chan@gmail.com and being used by RAYMOND CHAN, that is within the possession, custody, or control of Google, Inc., a company that accepts service of legal process at its headquarters located in Mountain View, California, regardless of where such information is stored, held, or maintained. Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed2 11/27/18 *SEALED*Page Filed 4 of 07/20/18 10 PagePage ID #:260 4 of 10 Page ID #:132 ATTACHMENT B ITEMS TO BE SEIZED I. SEARCH PROCEDURE 1. The search warrant will be presented to personnel of Google, Inc. (the “PROVIDER”), who will be directed to isolate the information described in Section II below. 2. To minimize any disruption of service to third parties, the PROVIDER’s employees and/or law enforcement personnel trained in the operation of computers will create an exact duplicate of the information described in Section II below. 3. The PROVIDER’s employees will provide in electronic form the exact duplicate of the information described in Section II below to the law enforcement personnel specified below in Section IV. 4. With respect to contents of wire and electronic communications produced by the PROVIDER (hereafter, “content records,” see Section II.10.a below), law enforcement agents and/or individuals assisting law enforcement and acting at their direction (the “search team”) will examine such content records pursuant to search procedures specifically designed to identify items to be seized under this warrant. The search shall extract and seize only the specific items to be seized under this warrant (see Section III below). The search team may use forensic examination and searching tools, such as “EnCase” and “FTK” (Forensic Tool Kit), which tools may use hashing and other sophisticated techniques. i Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed2 11/27/18 *SEALED*Page Filed 5 of 07/20/18 10 PagePage ID #:261 5 of 10 Page ID #:133 5. If the search team encounters immediately apparent contraband or other evidence of a crime outside the scope of the items to be seized, the team shall immediately discontinue its search pending further order of the Court and shall make and retain notes detailing how the contraband or other evidence of a crime was encountered, including how it was immediately apparent contraband or evidence of a crime. 6. The search team will complete its search of the content records as soon as is practicable but not to exceed 120 days from the date of receipt from the PROVIDER of the response to this warrant. The government will not search the content records beyond this 120-day period without first obtaining an extension of time order from the Court. 7. Once the search team has completed its review of the content records and created copies of the items seized pursuant to the warrant, the original production from the PROVIDER will be sealed -- and preserved by the search team for authenticity and chain of custody purposes -- until further order of the Court. Thereafter, the search team will not access the data from the sealed original production which fell outside the scope of the items to be seized absent further order of the Court. 8. The special procedures relating to digital data found in this warrant govern only the search of digital data pursuant to the authority conferred by this warrant and do not apply to any search of digital data pursuant to any other court order. 9. Pursuant to 18 U.S.C. § 2703(g) the presence of an agent is not required for service or execution of this warrant. ii Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed2 11/27/18 *SEALED*Page Filed 6 of 07/20/18 10 PagePage ID #:262 6 of 10 Page ID #:134 II. INFORMATION TO BE DISCLOSED BY THE PROVIDER 10. To the extent that the information described in Attachments A is within the possession, custody, or control of the PROVIDER, including any information that has been deleted but is still available to the PROVIDER, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the PROVIDER is required to disclose the following information to the government for the TARGET ACCOUNT listed in Attachment A: a. All contents of all wire and electronic communications, including services such as Gmail, associated with ray.sw.chan@gmail.com, and limited to that which occurred on or after May 24, 2018,1 and all contents associated with ray.sw.chan@gmail.com, and limited to that which occurred on or after April 1, 2013, including: i. All records (including content records and the stored application data) pertaining to the Google Document publicly available at https://docs.google.com/document/d/1PxaIuhLMVwuJEbWJ4OpUB2i1kC3i ougbLTEwjNHPjbc/edit?usp=sharing_eil&ts=5adce9d1, including logs of accounts that accessed or edited the document; ii. All records (including content records and the stored application data) pertaining to any Google service 1 To the extent it is not reasonably feasible for the PROVIDER to restrict any categories of records based on this date restriction (for example, because a date filter is not available for such data), the PROVIDER shall disclose those records in its possession at the time the warrant is served upon it. iii Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed2 11/27/18 *SEALED*Page Filed 7 of 07/20/18 10 PagePage ID #:263 7 of 10 Page ID #:135 associated with the TARGET ACCOUNT, including services such as Android, Google Play and Android Market (including payment information), Google Groups, use of Google Chrome or Google Chrome Sync (including the content of the data that is synced between different devices and the identity of such devices), Google Talk, Google Calendar, Google Docs, Google Drive, Google Services, Google+, Has Google Profile, Has Plusone, Google Photos (formerly Picasa), Tasks, iGoogle, Web History, Google Talk, Google Voice, and Hangouts; iii. All records (including content records and the stored application data) associated with the TARGET ACCOUNT pertaining to Location History and Google Maps, including custom maps, changes and edits to public places, starred places, private labels of locations, and saved locations. b. All other records and information, including: i. All records related to authenticating the user of the TARGET ACCOUNT, including use of two-factor authentication or App passwords used to allow access via a mobile device and the identity of those devices accessing the TARGET ACCOUNT; ii. All records relating to any settings applied by the user of the TARGET ACCOUNT to cause a message to expire, to require a recipient to insert a password value to read a message, to control a recipient’s ability to forward a message, or to retract access to a message already sent. III. INFORMATION TO BE SEIZED BY THE GOVERNMENT iv Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed2 11/27/18 *SEALED*Page Filed 8 of 07/20/18 10 PagePage ID #:264 8 of 10 Page ID #:136 11. For the TARGET ACCOUNT listed in Attachment A, the search team may seize: a. All information described above in Section II.10.a that constitutes evidence, contraband, fruits, or instrumentalities of violations of 18 U.S.C. §§ 371 (Conspiracy), 666 (Bribery and Kickbacks Concerning Federal Funds), 1341, 1343, and 1346 (Deprivation of Honest Services), 1951 (Extortion), and 1956 (Money Laundering), and 31 U.S.C. § 5324(a)(3) (Structuring a Financial Transaction to Evade a Reporting Obligation), those violations involving RAYMOND CHAN, JOSE HUIZAR, GEORGE ESPARZA, WEI HUANG, RICKY ZHENG, GEORGE CHIANG, DERON WILLIAMS, FUER YUAN, YAN YAN, CURREN PRICE, JOEL JACINTO, AVE JACINTO, and SHAWN KUK, occurring after April 1, 2013, namely: i. Information relating to who created, accessed, or used the TARGET ACCOUNT, including records about their identities and whereabouts. ii. All records relating to JOSE HUIZAR, GEORGE ESPARZA, WEI HUANG, RICKY ZHENG, GEORGE CHIANG, DERON WILLIAMS, YAN YAN, CURREN PRICE, MASON SITU, LINCOLN LEE, JOEL JACINTO, AVE JACINTO, SHAWN KUK, SHENZHEN NEW WORLD GROUP, SHENZHEN NEW WORLD INVESTMENT, INC., HAZENS, the LA Hotel Downtown, the Sheraton Universal Hotel, and Luxe Hotel. iii. All records relating to Las Vegas, including any receipts, reservation confirmations, flight itineraries, photographs, and bank records relating to Southwest Airlines, the Palazzo, Caesar’s Palace, the Wynn, and the Cosmopolitan. v Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed2 11/27/18 *SEALED*Page Filed 9 of 07/20/18 10 PagePage ID #:265 9 of 10 Page ID #:137 iv. All financial records relating to JOSE HUIZAR, his mother (ISIDRA HUIZAR), and his brother (SALVADOR HUIZAR), and their respective bank accounts including, but not limited to, those ending in #0843, #2634, #3900 and #3208. v. All records relating to development projects in and around Los Angeles that relate to foreign investors to include, but not limited to, HAZENS, GREENLAND, OCEANWIDE and other foreign investors not yet identified. vi. All records relating to Salesian High School Gala, Proposition HHH, El Grito, and other fundraising expeditions/campaign contributions. vii. All records relating to projects in and around Los Angeles, in which HUIZAR or HUIZAR’s staff, KUK, ESPARZA, JACINTO, CHAN, CHIANG, or WILLIAMS assisted in acquiring permits, licenses or other official city processes. viii. All records related to meetings, event invitations, dinners, fundraising events, and community events including radar screens. ix. All records related to La Vue, Ho Kee Café, and other meeting locations being utilized by the violators. b. All records and information described above in Section II.10.b. IV. PROVIDER PROCEDURES 12. IT IS ORDERED that the PROVIDER shall deliver the information set forth in Section II within 10 days of the service of this warrant. The PROVIDER shall send such vi Case Case 2:18-mj-01881-DUTY 2:18-mj-01881-DUTY *SEALED* Document Document 3 Filed211/27/18 *SEALED*Page Filed 10 07/20/18 of 10 Page Page ID #:266 10 of 10 Page ID #:138 information to: SA Andrew Civetti 11000 Wilshire Blvd. Los Angeles, CA 90024 310-996-4564 (Phone) 310-996-3764 (Fax) ACivetti@fbi.gov 13. IT IS FURTHER ORDERED that the PROVIDER shall provide the name and contact information for all employees who conduct the search and produce the records responsive to this warrant. 14. IT IS FURTHER ORDERED, pursuant to 18 U.S.C. § 2705(b), that the PROVIDER shall not notify any person, including the subscriber(s) of the account identified in Attachment A, of the existence of the warrant, until further order of the Court, until written notice is provided by the United States Attorney’s Office that nondisclosure is no longer required, or until one year from the date the PROVIDER complies with this warrant or such later date as may be set by the Court upon application for an extension by the United States. Upon expiration of this order, at least ten business days prior to disclosing the existence of the warrant, the PROVIDER shall notify the agent identified in paragraph 12 above of its intent to so notify. vii