AO 106 (Rev. 04/10) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Western District ofof Missouri __________ District __________ In the Matter of the Search of (Briefly describe the property to be searched or identify the person by name and address) Information associated with Discord User IDs, that is stored at premises controlled by Discord, more fully described in Attachment A ) ) ) ) ) ) Case No. 17-SW-00114-JTM APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location): Information associated with Discord User IDs that is stored at the premises controlled by Discord, headquartered in Campbell, California, more fully described in Attachment A. located in the Northern District of California , there is now concealed (identify the person or describe the property to be seized): See Attachment B (Items to be seized), attached hereto and incorporated by reference, which is contraband, instrumentalities, and evidence concerning enticement of a minor, travel with intent to engage in illicit sexual conduct, production, reciept and possession of child pornography in violation of 18 U.S.C. §§ 2422(b), 2423(b), 2251(a), & 2252. The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): ✔ ’ evidence of a crime; ✔ ’ contraband, fruits of crime, or other items illegally possessed; ✔ ’ property designed for use, intended for use, or used in committing a crime; ’ a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section 18 U.S.C. § 2422(b) 18 U.S.C. § 2423(b) 18 U.S.C. § 2251(a) & 2252 Offense Description Enticement of a Minor Travel with Intent to Engage in Illicit Sexual Conduct Production, Receipt and Possession of Child Pornography The application is based on these facts: See attched Affidavit in Support of Search Warrant and Attachment A (Place to be Searched) and Attachment B (Items to be Seized). ✔ ’ Continued on the attached sheet. days (give exact ending date if more than 30 days: ’ Delayed notice of under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. ) is requested Applicant’s signature Amy L. Ramsey, Special Agent (FBI) Printed name and title Sworn to before me and signed in my presence. Date: 05/04/2017 Judge’s signature City and state: Kansas City, MO John T. Maughmer, United States Magistrate Judge Printed name and title Case 4:17-sw-00114-JTM Document 1 Filed 05/04/17 Page 1 of 1 17-SW-00114-JTM AFFIDAVIT I, Agent Amy L. Ramsey, the undersigned, being duly sworn, state the following is true and correct to the best of my knowledge and belief. 1. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have been so employed since November 2008. Prior to this I was an Investigative Specialist for the FBI’s Special Surveillance Group in Boston, Massachusetts. My responsibilities involve, amongst other investigative responsibilities, investigating violations of federal law, including Title 18, United States Code (USC), Sections 2422(b); 2423(b), 2251(a), and 2252(a)(2) and (4). The following is based on my own investigation and reports made to me by other law enforcement officers. 2. I make this affidavit in support of an application for a search warrant for information associated with certain Discord accounts that are stored at premises owned, maintained, controlled, or operated by Discord, a social networking company headquartered at 1901 SO Bascom Avenue, Suite 1180, Campbell, California, 95008. This affidavit is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Discord to disclose to the Government records and other information in its possession, pertaining to the subscribers or customers operating the accounts. The information to be disclosed by Discord is described in Attachment A, which will be searched by law enforcement for the information described in Attachment B. The Government believes all information obtained will be evidence, fruits or instrumentalities of Title 18 U.S.C. § 2422(b), enticement of a minor, Title 18 U.S.C. § 2423(b), travel with intent to engage in illicit sexual Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 1 of 11 conduct, Title 18 U.S.C. § 2251(a), production of child pornography, and Title 18 U.S.C. § 2252(a)(2) and (4), receipt and possession of child pornography. 3. The facts in this affidavit come from my personal observations, my training and experience, and information obtained from other agents and witnesses. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. PROBABLE CAUSE 4. On April 9, 2017, at approximately 1:00 a.m., 12-year-old Jane Doe, date of birth 02/XX/2005, was discovered missing by her parents from the family residence in Blue Springs, Missouri. Jane Doe’s parents initially reported Jane Doe as a runaway to the Blue Springs Police Department (BSPD), and subsequently found that she was missing and possibly endangered after accessing her on-line accounts. BSPD responded to Jane Doe’s residence. Jane Doe’s parents were able to access Jane Doe’s online Facebook account and an application called “Discord.” 1 Jane Doe’s parents found Jane Doe utilized the Discord screen name/user name “William’s Queen” and was in communication with an individual utilizing the Discord screen name/user name “King William.” BSPD requested the Missouri Information Analytic Center (MIAC) and the National Center for Missing and Exploited Children (NCMEC) perform database searches for the Discord screen names/usernames as well as Facebook Vanity Name “Willy Cruz” in an attempt to identify King William and/or Willy Cruz. The Discord username/screen name King William was identified as 22- year-old William Lee Dela Cruz (“Dela Cruz”), with a residence in Oxon Hill, Maryland. 1 Discord is described by the Google Play Store as free cross-platform voice and text chat designed specifically for on-line game users. 2 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 2 of 11 5. Jane Doe’s parents provided consent for law enforcement to access Jane Doe’s social media accounts. Investigators reviewed Jane Doe’s Facebook Account (Facebook Vanity Name “Baka Chan”) in which she communicated with “Willy Cruz,” Discord chats, and Jane Doe’s Skype account. A review of Jane Doe’s Discord account revealed in addition to communications with King William she had a separate contact in her account for a “King Willy.” Based on the review of Jane Doe’s Facebook account, Discord chats, and information also found in Jane Doe’s Skype account, Jane Doe and Dela Cruz exchanged messages between November 2016 and April 2017. Some of the messages were explicitly sexual in nature and included discussions about masturbation and sexual activity with each other. Jane Doe and Dela Cruz exchanged identifying photographs of each other and discussed Jane Doe’s age. 6. During a Discord chat, Jane Doe advised King William (Dela Cruz) she was 15 years of age and was in the seventh grade. On 2/XX/2017, Jane Doe’s birthday, Dela Cruz asked Jane Doe “[h]ow old are you now?” Jane Doe responded “15.” Dela Cruz then stated “[w]e have 3 more years” and further stated “Iloveyousomuch.” 7. Based on the information obtained from MIAC and NCMEC, Dela Cruz’s aunt, Norleen Sullivan, residence address 574 Wilson Bridge Drive, Apt B2, Oxon Hill, Maryland, was identified. BSPD contacted the Prince George’s County Police Department (PGPD), and Detective Limpton made contact with Sullivan at her residence. Sullivan provided Detective Limpton with the license plate number to her vehicle, Maryland license plate number 6CK5071, and described the car as a Nissan Versa. Sullivan told Detective Limpton that her sons, William and Jason Dela Cruz, were in possession of the vehicle. An Amber Alert was subsequently issued by the Missouri Highway Patrol (MHP), which lead to the recovery of Jane Doe on April 9, 2017, by the Wentzville Missouri Police Department. 3 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 3 of 11 8. After Jane Doe was recovered, she was interviewed at the Wentzville Missouri Police Department. During the interview Jane Doe confirmed she and Dela Cruz were in an online relationship. Jane Doe stated she met Dela Cruz online through the PC based role-play computer game “ONIGIRI” in early 2016. Jane Doe stated she and Dela Cruz stopped talking for a period of time before reconnecting in November 2016 when they began to use Skype, Discord, and Facebook Messenger to communicate. 9. On April 9, 2017, Dela Cruz was arrested by law enforcement in Wentzville, Missouri. Dela Cruz was read his Miranda rights at the Wentzville Missouri Police Department, and voluntarily agreed to speak with investigators. Dela Cruz stated he met Jane Doe online through a PC based role-playing computer game known as “ONIGIRI.” Dela Cruz stated he currently resides with his brother and Sullivan at 574 Wilson Bridge Drive, Apt B2, Oxon Hill, Maryland. Dela Cruz utilized a computer in his bedroom to communicate with Jane Doe. Dela Cruz characterized his relationship with Jane Doe as boyfriend and girlfriend. He stated Jane Doe had provided him with several different names and ages, but he believed her to be between the ages of sixteen and seventeen. He stated he knew she attended middle school. Dela Cruz received several pictures of Jane Doe and he commented that she seemed to be small. He admitted to having additional contact with Jane Doe using Facebook, Skype, and a landline telephone from his home in Maryland. 10. Dela Cruz further stated that on or about April 6, 2017, he received a message from Jane Doe in which she told him she ran away from home. She also told him her parents prohibited her from using Facebook. Dela Cruz and his brother, Jason Dela Cruz, drove to Missouri from Maryland to pick Jane Doe up. Dela Cruz stated they drove to Missouri with the intent of driving Jane Doe back to Maryland. Upon arriving in Blue Springs, Missouri, Dela 4 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 4 of 11 Cruz communicated with Jane Doe on Discord with his iPhone by WiFi connection, as the phone was not activated. Dela Cruz then went to Jane Doe’s house and picked her up. 11. After picking Jane Doe up, Dela Cruz stated they stopped at a rest stop along I-70 in Missouri, where he and Jane Doe engaged in sexual contact. Dela Cruz and Jane Doe returned to the vehicle and continued to travel eastbound on I-70 towards Maryland. During the drive, the brothers had an argument. As a result, Jason Dela Cruz dropped Jane Doe and Dela Cruz off at a service station and drove away. Dela Cruz and Jane Doe attempted to obtain a room at the Hampton Inn in Wentzville, Missouri but did not have sufficient funds for a room. Dela Cruz and Jane Doe slept on a couch in the lobby of the hotel. 12. Dela Cruz stated that during or shortly after their stay at the hotel, he realized he had received a Facebook friend request from Jane Doe’s mother. Dela Cruz accepted the request and then observed a post where Jane Doe’s mother identified her daughter as missing and stated Jane Doe was 12 years old. Dela Cruz stated that despite the information provided by Jane Doe’s mother, Dela Cruz and Jane Doe went to a secluded location in a wooded area near the U Gas service station in Wentzville, Missouri, and engaged in sexual activity for the second time. Dela Cruz indicated he knew what he did was wrong. He also stated he lied to his brother, Jason Dela Cruz, by telling him that Jane Doe was nineteen years old to conceal the fact she was under aged. 13. Following the interview with Dela Cruz, investigators located the wooded area near the U Gas service station in Wentzville, Missouri described by Dela Cruz. Investigators observed a blanket spread on the ground with numerous articles of clothing and children’s toys such as a My Little Pony sitting on the blanket. A pair of men’s underwear was located on top of 5 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 5 of 11 the blanket. A pair of girl’s/women’s panties was located near the blanket under a bag. A pink backpack was located on the blanket which displayed Jane Doe’s first name. 14. Jason Dela Cruz turned himself into authorities in a suburb of Columbus, Ohio. Jason Dela Cruz cooperated with law enforcement, was interviewed, and confirmed the above information regarding the travel and purpose of travel from Maryland to Missouri with his brother. Jason Dela Cruz knew that Dela Cruz had been “cyber” dating Jane Doe for about a year. 15. On April 10, 2017, Dela Cruz was charged by complaint in the Western District of Missouri with one count of enticement of a minor pursuant to 18 U.S.C. § 2422(b) in case number 17-MJ-00065-SWH. An indictment was returned by the Grand Jury on April 19, 2017, charging Dela Cruz with one count of enticement of a minor in violation of 18 U.S.C. § 2422(b), and one count of travel with intent to engage in illicit sexual conduct in violation of 18 U.S.C. § 2423(b). (See 17-00129-01-CR-W-DGK.) 16. At the time of Dela Cruz’s arrest, he had in his possession a white and gold colored iPhone. The iPhone was seized by law enforcement and a federal search warrant was obtained for the contents of the phone on April 17, 2017, from United States Magistrate Judge Robert E. Larsen. The search warrant was executed on April 18, 2017, and revealed that while communicating with Jane Doe via Skype on March 30, 2017, Dela Cruz took/recorded a series of approximately 22 screen shots of Jane Doe. In these screen shots Dela Cruz’s face is depicted in the photo inset on the bottom right corner of the images, and the Skype logo is depicted in the right upper corner of the larger images of Jane Doe. 17. The series of approximately 22 Skype screen shots located on Dela Cruz’s iPhone include clothed images of Jane Doe, in addition to child pornography images depicting the 6 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 6 of 11 lascivious exhibition of Jane Doe’s genitalia. The screen shot images depict Jane Doe on a bed with a My Little Pony 2 poster or picture on the wall above the bed. An example of one of the screen shot images depicts Jane Doe on the bed, nude from the waist down, on her hands and knees facing away from the camera so that her genitalia is exposed to the camera. The My Little Pony blanket is depicted in the image behind Jane Doe. In my opinion this image meets the definition of sexually explicit conduct as set forth in 18 U.S.C. § 2256. TECHNICAL BACKGROUND RELATING TO DISCORD 18. Discord owns and operates a free-access all in one voice and text chat application website of the same name that can be accessed at http://www.discordapp.com. Discord allows its users to establish accounts with Discord, and users can then use their accounts to communicate with other Discord users. When signing up for a Discord account, the user must agree to Discord’s Terms of Service. 3 Discord’s terms of service, Rules of Conduct and Usage state, “You agree not to use the Service in order to: violate any applicable laws or regulations, or promote or encourage any illegal activity…” 19. Discord asks users to provide basic contact information to Discord, either during the registration process or thereafter. The information may include the user’s full name, birth date, contact e-mail addresses, physical address (including city, state, and zip code) telephone numbers, screen names, websites, and other personal identifiers. Discord also assigns a user identification number to each account. 2 On April 27, 2017, I contacted Jane Doe’s mother and confirmed that displayed on the wall in Jane Doe’s bedroom, above Jane Doe’s bed, is a My Little Pony blanket. 3 Discord’s Terms of Service may be accessed online: https://discordapp.com/tos 7 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 7 of 11 20. Discord users can exchange private messages on Discord with other users as well as participate in chat room discussions, and voice chat. 21. Discord may also retain Internet Protocol (“IP”) logs for a given user ID or IP address. These logs may contain information about the actions taken by the user ID or IP address on Discord, including information about the type of action, the date and time of the action, and the user ID and IP address associated with the action. For example, if a user views a Discord profile, that user’s IP log would reflect the fact the user viewed the profile, and would show when and from what IP address the user did so. 22. Social networking providers like Discord typically retain additional information about their users’ accounts, such as information about the length of service (including start date), the types of service utilized, and the means and source of any payments associated with the service (including any credit card or bank account number). In some cases, Discord users may communicate directly with Discord about issues relating to their account, such as technical problems, billing inquiries, or complaints from other users. Social networking providers like Discord typically retain records about such communications, including records of contacts between the user and the provider’s support services, as well as records of any actions taken by the provider or user as a result of the communications. 23. The computers or servers of Discord are likely to contain all the material just described, including stored electronic communications and information concerning subscribers and their use of Discord, such as account access information, transaction information, and account activation. 24. Generally, when served with a search warrant for electronic communications, the electronic communications service provider (ECSP), such as Discord, will send the contents of 8 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 8 of 11 the specified account(s) to the investigating agency, usually on a CD or DVD, for the investigator to review. The ECSP can copy the contents of the entire account because that is within their expertise. Though the ECSP affirms that the records relate to the specified email account, the provider does not and will not undertake the examination of the contents of an account to make a determination as to what is relevant or irrelevant to the investigation. Generally, and in this case particularly, the provider is not familiar with the investigation and is not in a position to identify the victim(s) or subject(s) of the investigation. 25. The provider is neither qualified nor trained to search the account information as would a law enforcement officer. Only a trained agent, familiar with the statutory violations and facts of the case, can determine what items should or should not be seized. For these reasons, your Affiant requests the provider disclose the records listed in Section 1 of Attachment B, for the account(s) listed in Attachment A. INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 26. I anticipate executing this warrant under the Electronic Communications Privacy Act, in particular 18 U.S.C. 2703(a), 2703(b)(1)(A) and 2703(C)(1)(A), using the warrant to require Facebook to disclose to the Government copies of the records and other information (including the content of communications) particularly described in Section I of Attachment B. Upon receipt of the information described in Section I of Attachment B Government-authorized persons will review the information to locate the items described in Section II of Attachment B. CONCLUSION 27. Based on my training and experience, and the facts as set forth in this affidavit, there is probable cause to believe on the computer systems in the control of Discord there exists evidence of crimes: child enticement, 18 U.S.C.§ 2422(b); travel with intent to engage in illicit 9 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 9 of 11 sexual conduct, 18 U.S.C. §2423(b); production of child pornography, 18 U.S.C. § 2251(a); and receipt and possession of child pornography, 18 U.S.C. § 2252(a)(2) and (4). Accordingly, a search warrant is requested. 28. This Court has jurisdiction to issue the request warrant because it is “a court of competent jurisdiction” as defined by 18 U.S.C 2711, 18 U.S.C. 2703(a), 2703(b)(1)(A) and 2703(C)(1)(A). Specifically, the court is a district court of the United States that has jurisdiction over the offense being investigated. 29. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer not required for the service or execution of this warrant. 30. Based on the foregoing, I request that the court issue the proposed search warrant. Because the warrant will be served on Discord who will then compile the requested records at a time convenient to it, reasonable cause exists to permit the execution of the requested warrant at any time in the day or night. 10 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 10 of 11 31. I further request that the court order that all papers in support of this application, including the affidavit, search warrant, and search warrant return, be sealed until further order of the court. These documents could potentially identify the minor victim in the case, in violation of 18 U.S.C. § 3509(d). Accordingly, there is good cause to seal these documents because the confidentiality of information concerning minor victims is a right afforded to victims of crime through 18 U.S.C. § 3509. However, I seek authority to release the documents as discovery in related criminal cases without the need for these pleadings to be unsealed. Respectfully Submitted, _____________________________ Amy L. Ramsey Special Agent Federal Bureau of Investigation Sworn and subscribed before me this 4thday of May, 2017. UNITED STATES MAGISTRATE JUDGE 11 Case 4:17-sw-00114-JTM Document 1-1 Filed 05/04/17 Page 11 of 11 17-SW-00114-JTM ATTACHMENT A Property to be Searched This warrant applies to information associated with the Discord users: William’s Queen#5042 King William #3067 King Willy #3362 that is stored at premises owned, maintained, controlled, or operated by Discord, a company headquartered at 1901 SO Bascom Avenue, Suite 1180, Campbell, California, 95008. Case 4:17-sw-00114-JTM Document 1-2 Filed 05/04/17 Page 1 of 1 17-SW-00114-JTM ATTACHMENT B Particular Things to be Seized I. Information to be disclosed by Discord To the extent the information described in Attachment A is within the possession, custody, or control of Discord, Discord is required to disclose the following information to the Government for each user ID listed in Attachment A: (a) All contact information, including full name, user identification number, birth date, contact e-mail addresses, physical address (including city, state, and zip code), telephone numbers, screen names, websites, and other personal identifiers; (b) All Photoprints, including all photos uploaded by that user ID and all photos uploaded by any user that have that user tagged in them and any exif/metadata information associated with the photos; (c) All other communications and messages made or received by the users, including all private messages and pending requests; (d) All IP logs, including all records of the IP addresses that logged into the account and intra-session IPs; (e) The length of service (including start date), the types of service utilized by the user, and the means and source of any payments associated with the service (including any credit card or bank account number); (f) All privacy settings and other account settings; and Case 4:17-sw-00114-JTM Document 1-3 Filed 05/04/17 Page 1 of 2 (g) All records pertaining to communications between Discord and any person regarding the user or the user’s Discord account, including contacts with support services and records of actions taken. II. Information to be seized by the Government All information, described above in Section I, that constitutes fruits evidence and instrumentalities of violations of 18 U.S.C. § 2422(b), enticement of a minor, 18 U.S.C. § 2423(b) travel with intent to engage in illicit sexual conduct, 18 U.S.C. § 2251(a) the production of child pornography, and 18 U.S.C. § 2252(a)(2) and (4), receipt and possession of child pornography since January 2016, including information pertaining to the following matters: (a) Communications between the users identified in Attachment A; (b) Records relating to who created, used or operated the accounts identified in Attachment A; (c) Records relating to enticement of minors or an interest in the enticement of minors; (d) Records relating to travel with intent to engage in illicit sexual conduct; (e) Records relating to the production, receipt, or possession of visual depictions of minors engaged in sexually explicit conduct as defined in 18 U.S.C. § 2256(2); and (f) Records relating to a sexual interest in minors. 2 Case 4:17-sw-00114-JTM Document 1-3 Filed 05/04/17 Page 2 of 2