File No. SEARCH WARRANT STATE OF NORTH CAROLINA Wake in The General Court or Justice COUHIY District/Superior Court Division THE MATTER OF Data Maintained on Computer Servers of Google Inc Time Issued Date Issued wizard: Name Oprp/icant T. Jackson Name Of Additional Af?ant Name Of Additional Affiant RETURN OF SERVICE i certify that this Search Warrant was received and executed as follows: Date Received Time Received ,recs DAM Law Date Executed Time Executed ICIOQ EPM I made a search of Data maintained on computer servers of Google Inc. as commanded. i seized the items listed on the attached inventory. i did not seize any items. [3 This Warrant WAS NOT executed within forty-eight (48) hours of the date and time of issuance and hereby return it not executed. To any officer with authority and jurisdiction to conduct the search authorized by this Search Warrant: i, the undersigned, find that there is probable cause to believe that the property and person described in the application on the reverse side and related to the commission of a crime is located as described in the application. You are commanded to search the premises, vehicle, person and other place or item described in the application for the property and person in question. if the property and/or person are found, make the seizure and keep the property subject to Court Order and process the person according to law. You aredirected toexecute this Search Warrant within forty?eight (48) hours from the time indicated on this Warrant and make due returnto the? Clerk of the issuing Court. This Search Warrant is issued upon information furnished under oath or affirmation by the person(s) shown. New? print) (9 1? 6L, u. ?are Aer 54%eax/W Deputy Assistant Magistrate [j District Ct. Judge Superior Ct. Judge NOTE: When issuing a search warrant, the issuing of?cial must retain a copy of the warrant and warrant application and must prompt/y file them with the clerk. G. S. This Search Warrant was delivered to me on the date and at the time shown below when the Office of the Clerk of Superior Court is closed for the transaction of business. By signing below, i certify that i will deliver this Search Warrant to the Office of the Clerk of Superior Court as soon as possible on the Clerk?s next business day. Name Of Off er Making Return (type or print) Date Time Name Of Magistrate (type or print) Signature Of Magistrate [jam nor; be Eignatur fOf?d?rMa/rin Return .. ?t This Search Warrant was returned to the undersigned clerk on the date and time shown below. Copy - For Search of Vehicle/Premises, to Owner or Person in Apparent Control; Rev. 8/17 2017 Administrative Office of the Courts . A Department OrAgency Of Officer [Incident Number Date Time AM Name Of Clerk (type or print) ig ture Of Clerk DepAsst. saw to cliqln mi we . 2 I i Original - File Copy - For Search of a Person, to Person from Whom items Taken it No Such Person Present, Leave Copy Af? Thereon (Over) aft. Ski? OI IN THE MATTER OF: ATTACHMENT TO APPLICATION REF: FO SEARCH WARRANT Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 78.617861? SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner During the following time frame: 2145 hours Eastern and 2235 hours Eastern, on 2/13/2018, data maintained on computer servers controlled by Google, Inc. TO BE SEIZED: The facts and circumstances outlined in this affidavit brought on by Detective T. R. Jackson suggest that there is probable cause to believe evidence of the commission of the crime of Murder, a violation of North Carolina General Statute 14-17 (hereinafter ?Subject Offense), may be found within computer servers maintained or controlled by Google, Inc. or Google Payment Corp. Such accounts are described further in ATTACHMENT II (hereinafter ?the Accounts?) stored at premises controlled by Google, Inc., a company that accepts service of legal process at 1600 Amphitheatre Parkway, Mountain View, California 94043. The following material is sought for the time period of2145 hours Eastern and 2235 hours Eastern, on 2/13/2018: . l. I For each type of Google account that is assoCiated with a device that was inside the geographical area described further in ATTACHMENT II, during the time frame listed above, Google will provide ?anonymized information? regarding the Accounts that are associated with a device that was inside the described geographical area during the time frame described above. This ?anonymized information? will, include a numerical identifier for the account,?the type of account, time stamped location coordinates and the data source that this information came from if available. The information initially provided by Google will not contain any further content or information identifying the user of a particular device or account. Law enforcement officers will review this ?anonymized information? provided by Google, Inc. in an effort to narrow down the list of accounts associated with devices identified in the ?anonymized information?W Law enforcement officers will attempt to narrow down the list by reviewing the time stamped location coordinates for each account and comparing that against the known time and location information that is specific to this crime. Law enforcement officers will return a list that they have attempted to narrow down. This list will still be identified by the ?anonymized information? described above. After this review by Law Enforcement and upon request, Google, Inc. shall produce ?contextual data points with points of travel outside of the geographical area? described further in ATTACHMENT II of this Application for Search Warrant. The time frame will be expanded for this production of ?contextual data points with points of travel outside of the geographical area? for 30 minutes before AND 30 minutes afterthe initial search time period of 2145 hours Eastern and 2235 hours Eastern, on 2/13/2018. This expanded time frame will be from 2115 hours Eastern through 2305 hours Eastern on 3/16/2017. Google Inc. shall provide this additional information to Law Enforcement for review. Law Enforcement officers will review this additional information along with the "anonymized information? and will attempt to narrow down the list by comparing this additional information regarding travel and time against the known timeand location information that is specific to this crime. After review and upon request by Law Enforcement, Google Inc. shall provide identifying account information CSI for the account/s requested by Law Enforcement. This identifying account information CSI shall include all of the following that are available: user name and subscriber information to include date of birth if available, account type and account number, email addresses associated with the account, electronicdevices associated with the account and their identifying make, model and other identifying numbers, telephone numbers associated with the account including telephone numbers used to set up the account, verify the account or to receive assistance with the account, and Google Voice phone numbers associated with the account. SWORN TO AND SUBSCRIBED BEFORE NIB ,20Ia? . KER - Signature of Applicant Jae/J 'El Deputy CSC Asst. CSC El Clerk of Sup. Ct. El Mag. [El/Judge Page 1 of 4. IN THE MATTER OF: ATTACHMENT TO APPLICATION FOR SEARCH WARRANT REF: Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 35783736",? 78.617861? SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the time frame:2145 hours Eastern and 2235 hours Eastern, on 2/13/2018,. data maintained on computer servers controlled by Google, Inc. ATTACHMENT ll~ PLACES TO BE SEARCHED: ?.This search warrant applies to the Google Accounts associated with devices that were located inside the following geographical area: Location 1: NE Corner NW Corner SW Corner SEE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner During the following time frame:2145 hours Eastern and 2235 hours Eastern, on 2/13/2018, This data is maintained on computer servers that are stored at premises controlled by Google Inc., a company that accepts service of legal process at 1600 Amphitheatre Parkway, Mountain View, California 94043. SWORN TO AND SUBSCRIBED BEFORE ME Signature of Applicant r'n lN lHl: Ul-l Al IU APPLILAI FOR SEARCH WARRANT REF: Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 78.617861? SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the following time fram?e:2145 hours Eastern and 2235 hours Eastern, on 2/13/2018, data maintained on computer servers controlled by Google, Inc, ?3 i 33;. A law enforcement officer will serve this warrant by transmitting it via email or another appropriate manner to the Provider, Google Inc. The Provider is- directed to produce to the law enforcement officer an electronic copy of the information specified in ATTACHMENT l. .SWORN TO AND SUBSCRIBED BEFORE ME - 5 DAYOFJLULL ,20 lat. Signature oprplicant IN IHI: MAI itR UI-I . I AI IALHIVIENI IU APPLILAIIUN FOR SEARCH WARRANT . Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 78.617861? SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the following time frame:2145 hours Eastern and 2235 hours Eastern, on 2/13/2018, data maintained on computer servers controlled by Google, Inc. ATTACHMENT PROBABLE CAUSE AFFIDAVIT: The Affiant swears to the following facts to establish probable cause for the issuance of a search warrant: On 2/13/2018 Raleigh Police responded to 1840 Bakers. Grove Way in Raleigh in reference to a home invasion and shooting. Upon arrival they lo?cated the victim, Vernon Jefferys, deceased from a gunshot wound. It was determined that two armed men entered the victim?s residence and held him at gunpoint along with his wife and child. After searching the residence one of the suspects forced Vernon Jefferys outside into the parking lot where he was shot and killed. During the course of the investigation the area was canvassed for surveillance cameras and Several were located. A camera was located in the parking lot of 420 Hill St, Raleigh that captured the suspect vehicle, a white in color Nissan Rogue SV, parking in the lot at 2219 Hours Eastern Time. Two'suspects can be seen exiting the vehicle. while a driver remains. The suspects walk through a "cut? which emerges at the victim's residence. At 2231 Hours Eastern Time the suspects run back to the vehicle and drive off. The vehicle can be seen turning right onto Oakwood Ave from Hill St. This area is contained within Location 1 depicted above. This camera also captures the suspect vehicle as it makes a pass by. the location prior to the homicide before turning East onto Oakwood Ave at 2217 Hours. A camera was located at 1700 OakWood Ave, Raleigh. This camera catches the suspect vehicle traveling west on Oakwood Ave toward Tarboro Rd at 2205 Hrs. The same camera captures the suspect vehicle traveling East on Oakwood Ave toward Raleigh at 22:17 Hours. This area is contained within Location 1 depicted above. A camera was located at 2041 lVIilburnie Rd, Raleigh. This camera captures the suspect vehicle traveling North on Raleigh and then turning West onto lVlilburnie Rd at 2218 Hours. This area is contained within Location 1 depicted above. A camera was located at the intersection of Oakwood Ave and Tarboro Rd. This camera captures the suspect vehicle turning South onto Tarboro Rd from Oakwood Ave at 2205 Hours. The same camera captures the suspect vehicle traveling West through the intersection at 2233 Hours. This area is contained within Location 2 depicted above. The information above reveals that the suspects made at least two passes by the homicide location prior to the murder of Vernon Jefferys. Video surveillance confirms that the suspects made these passes within Location 1 and Location 2 depicted above. This applicant knows that a cellular telephone or mobile telephone is a handheld wireless device primarily used for voice, text, and data communication through radio signals. Cellular telephones send signals through networks of transmitter/receivers called ?cells? or ?cell sites,? enabling communication with other cellular telephones or traditional ?landline? telephones. Cellular telephones rely on cellular towers, the location of which may provide information on the SWORN TO AND SUBSCRIBED BEFORE ME 5? DAYOF ,20 \61 . fl . Signature of Applicant ,4/9 Deputy El Asst. Clerk of Sup. Ct. lVlag. I/ge Page 4 of 4 El lN IHI: IVIAI or: IU APPLILAIIUN FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 78.617861" SE Corner and Location 2: NE Corner NW Corner 35. 784698", ~78. 622614? SW Corner 35. 783923?, ?78. 622654 SE Corner 35. 783940?, ~78. 621428? During the following time frame: 2145 hours Eastern and 2235 hours Eastern. on 2/13/2018, data maintained on computer servers controlled by Google, Inc. location of the subject telephone. Cellular telephones may also include global positioning system or other technology for determining a more precise location of the device. This applicant also knows that Google is a company which, among other things, provides electronic communication services to subscribers, including email services. Google allows subscribers to obtain email accounts at the domain name gmail.com and/or google.com. Subscribers obtain an account by registering with Google. A subscriber using the Provider?s services can access his or her email account from any computer/device connected to the Internet. This applicant knows that Google has also developed a proprietary operating system for mobile. devices, including cellular phones, known as Android. Nearly every cellular phone using the Android operating system has an associated Google account, and users are prompted to add a Google account when they first turn on a new Android device. Based on this applicant? 5 training and experience, this applicant knows that Google collects and retains location data from Android? enabled mobile devices when a Google account user has enabled Google location services. Google can also collect location data from non? ?Android devices if the device is registered to a Google account and the user has location services enabled The company uses this information for location? based advertising and location? based search resUlts and stored such data in perpetuity unless it is manually deleted by the user. This location information is derived from GPS data, cell site/cell tower information, Bluetooth connections, and Wi Fi access points. This applicant knows that location data can assist investigators in forming a fuller geospatial understanding and timeline related to a specific criminal investigation; and ?may tend to identify potential witnesses and/or suspects. Such information can also aid investigators in possibly inculpating or exculpating persons of interest. Additionally, location information can be digitally integrated into image, video, or other computer files associated with a Google account and can indicate the geographic location of the accounts user at a particular date and time digital cameras, including on cellular telephones, frequently store GPS coordinates indicating where a photo was taken in the ?metadata? of an image file). This applicant respectfully submits that there is probable cause to believe that information stored on the Providers? servers associated withthe Google accounts and/or devices located at the location and timeframe specified in ATTACHMENT ll, will contain evidence, fruits and instrumentalities of the Subject Offense1 The information sought from Google regarding the Subject Accounts, specified in ATTACHMENT to this warrant, will assist in identifying which cellular devices were near the location where the crime being investigated occurred during the time frame it is currently believed to have occurred. This information may assist law enforCement in determining which persons were present or involved with the Subject Offense under investigation. 1 The State of North Carolina maintains that the information sought herein consists entirely of ?record[s]? other than the ?contents of communications? which is subject to the provisions outlined in 18 U.S.C. 2703 Such records, requires only a showing that there are reasonable grounds to believe that the information sought is relevant and material to an ongoing criminal investigation. See 18 U.S.C. 2703(c)(1)(A). Despite this, Google has indicated that it believes a search warrant, and not a court order, is required to obtain the location data sought in this application. Although the Government disagrees with Google?s position, because there is probable cause to believe that the information sought herein will contain evidence of the criminal offenses speci?ed in this af?davit, the Government is seeking a search warrant in this case. - SWORN TO AND BEFORE ME DAYOF Jmet oj? fly/M Signature of Applicant l3 Deputy CSC El Asst. CSC El Clerk of Sup. Ct. El Mag. El??ldge Page 5 of 4 IN lHi: or: AI lU APPLILAHUN FOR SEARCH WARRANT Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 78.617861? SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the following time frame:2145 hours Eastern and 2235' hours Eastern, on 2/13/2018,. data maintained on computer servers controlled by Google, lnc. The applicant would respectfully request the court issue a search warrant for the material outlined in ATTACHMENT of the above?mentioned premises controlled by Google. All information and facts provided in this affidavit are true and accurate to the best of the applicant?s knowledge. The applicant feels that there is sufficient probable cause for the issuance of a search warrant for the evidence, fruits, and instrumentalities of violations of Subject Offense which may be contained within the furnished records. SWORN TO AND SUBSCRIBED BEFORE ME ?Mews?. THIS DAYORWLL ,20 t- 4/ Signature of Applicant . El Deputy CSC Asst. CSC El Clerk ofSup. Ct. El Mag. El?dge Page 6 of4 STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE - COUNTY OF WAKE SUPERIOR COURT DIVISION REF: Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 78.617861o SE Corner and Location 2: NE Corner NW Corner 35. 784698?, ~78. 622614? SW Corner 35. 783923?, -78. 622654 SE Corner 35. 783940?, -78. 621428?During the following time frame. 2145 hours Eastern and 2235 hours Eastern, on 2/13/2018, data maintained on computer servers controlled by Google, Inc. APPLICATION FOR ORDER TO PREVENT DISCLOSURE TO THE USERS WITH ACCOUNTS INVOLVED OF THE EXISTENCE OF A SEARCH WARRANT RELATED TO GOOGLE ACCOUNTS ASSOCIATED DEVICE INSIDE THE FOLLOWINGAREA, DURING THE FOLLOWING TIME FRAME: Location 1: NE Corner NW Corner SW Corner SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the following time frame: 2145 hours Eastern and 2235 hours Eastern, on SEARCH WARRANT DATED 3/8/2018. NOW COMES Detective T. R. Jackson of the Raleigh Police Department, and petitions the Court to authorize an order to prevent disclosure of the search warrant dated 3/8/2018 to the users with accounts involved. Said search warrant authorizing the search of Google servers for accounts associated devices that were inside the following area, during the following time frame: Location 1i NE Corner NW Corner SW Corner SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the following time frame: 2145 hours Eastern and 2235 hours Eastern, on 2/13/2018 Pursuant to 18 U.S.C. 2705(b), and 3103a(b), this applicant requests that the proposed order direct the provider, and all Other communications providers, perSons or entities who are obligated by the proposed warrant to provide. assistance to the investigative agency, not to disclose in any manner, directly or indirectly, by any action or inaction, to the subscriber(s) or to any other person, the existence of the proposed warrant, in full or redacted form, the existence of the legal request or the existence of this investigation, unless otherwise ordered by this Court, and that the identity of any account users included within the search results may be redacted from any copy of the proposed warrant to be served on any service provider or other person. The existence and scope of this ongoing criminal investigation is not publicly known. As a result, premature public disclosure of this affidavit or the requested warrant could alert potential criminal targets that they are under investigation, causing them to destroy evidence, flee from prosecution, or otherwise seriously jeopardize the investigation. In light of the serious nature of the crime under investigation, premature revelation of this investigation may alert dangerous targets that they have been identified by others and endanger the safety of witnesses who have been cooperating with the Government. Accordingly, there is reason to believe that, were the Provider to notify subscribers or users of the Subject Accounts or others of the existence of the warrant, the investigation would be seriously jeopardized. Pursuant to 18 U.S.C. 2705(a), I therefore respectfully request that the Court direct the Provider not to notify any person of the existence of the warrant for a period of 90 days from issuance, subject to extension upon application to the Court, if necessary. For similar reasons, I respectfully request that the accompanying warrant and all papers submitted herewith be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and affidavit as need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Page 1 of4 STATE OF NORTH CAROLINA I I IN THE GENERAL COURT OF JUSTICE COUNTY OF WAKE SUPERIOR COURT DIVISION REF: . Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 78.617861? SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the following time frame:2145 hours Eastern and 2235 hours Eastern, on 2/13/2018, data maintained on computer servers controlled by Google, Inc. The Applicant declares under penalty of perjury that the foregoing is true and correct to the best of my knowledge and belief and that this declaration was executed on 3/8/2018. SWORN EFORE ME ON March 8, 2018 NORTH CAROLINA SURERIOR COURTJUDGE . I NAME ISIgnafureI (Signature) - . Z?c IQ PRINTED Page 2 of4 STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE COUNTY OF WAKE. SUPERIOR COURT DIVISION REF: Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 35.783736?- Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the following time frame:2145 hours Eastern and 2235 hours Eastern, on 2/13/2018, data maintained on computer servers controlled by Google, Inc. ORDER TO PREVENT DISCLOSURE TO THE USERS WITH ACCOUNTS INVOLVED OF THE EXISTENCE OF A SEARCH WARRANT RELATED TO GOOGLE ACCOUNTS ASSOCIATED DEVICE INSIDE THE FOLLOWING AREA, DURING THE FOLLOWING TIME FRAME: Location 1: NE Corner NW Corner SW Corner 78.617861" SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the following time frame: 2145 hours Eastern and 2235 hours Eastern, on SEARCH WARRANT DATED 3/8/2018. THIS MATTER having come before me on a petition by the Raleigh Police Department and it appearing to the court that public rele?ase?of the information related to this search warrant would be detrimental to an ongoing criminal investigation related to this search warrant dated 3/8/2018, authorizing the search of Google servers for accounts associated devices that were inside the following area, during the following time frame: Location 1: NE Corner NW Corner SW Corner SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner during the initial time frame between2145 hours Eastern and 2235 h0urs Eastern, on 2/13/2018. Pursuant to 18 U.S.C. 2705(b), 3123(d), and 3103a(b), it is ordered that the provider, and all other communications providers, persons or entities who are obligated by the proposed order to provide assistance to the investigative agency, not to disclose in any manner, directly or indirectly, by any action or inaction, to the subscriber(s) or to any other person, the existence of the proposed warrant, in full or redacted form, the existence of the legal request, or the existence of this investigation, unless otherwise ordered by this Court; and that the identity of any account users included within the search results may be redacted from any copy of the proposed warrant to be served on any service provider or other person. Specifically, being as disclosure of the requested order and investigation would likely result in co'ntinuedflight from testimony, a modification of the suspect?s activities or the activities of those with whom the suspect communicates and associates, or the destruction or tampering of evidence; and would otherwise seriously jeopardize the investigation; the applicant further requests, pursuant to the delayed notice provisions of 18 U.S.C. 2705(a), for an order delaying any notification to the subscriber or customer that may be required by 18 U.S.C. 2703(b) to obtain the contents of communications, for a period of ninety (90) days. Page 3 of 4 STATE OF NORTH CAROLINA . I IN THE GENERAL COURT OF JUSTICE 7 COUNTY OF WAKE SUPERIOR COURT DIVISION REF: Accounts associated devices that were inside the following geographical area: Location 1: NE Corner NW Corner SW Corner 35.7837363- 78617861" SE Corner and Location 2: NE Corner NW Corner SW Corner SE Corner the folloWing time frame:2145 hours Eastern and 2235 hours Eastern, on 2/13/2018, data maintained on computer servers controlled by Google, Inc. THEREFORE, IT IS ORDERED that the search warrant dated 3/8/2018, not be disclosed to the users with accounts involved or other parties for a period of ninety (90) days. Said search warrant authorizing the search of Google servers for accounts associated devices that were inside the following area, during the following initial time frame: Location 1: NE Corner NW Corner SW Corner SE Corner 35. 783583", -78. 613167? and Location 2: NE Corner 35. 784619?, ~78. Corner 35. 784698?, ~78. 622614? SW Corner 35. 783923?, ~78. 622654 SE Corner 35. 783940?, ~78. 621428?, during the initial time frame between2145 hours Eastern and 2235 hours Eastern, on 2/13/2018. SWORN BEFORE ME ON March 8,2018 NORTH CAROLINA SUPERIOR COURT JUDGE (Signature) Raw/rat PRINTED Page 4 of 4 STATE OF NORTH CAROLINA ln The General Court Of Justice Wake County District SUperior Court Division IN THE MATTER OF: Name Data Maintained on Computer Servers of Google Inc OF PROPERTY Date or Search G.S. -257 6-5?20?1 9 l, the undersigned officer, executed a search of: Data Maintained on Computer Servers of Google Inc Person, Place Or Vehicle Searched Data Maintained on Computer Servers of Google This search was made pursuant to a search warrant issued by: Wake County Magistrate a consent to search given by: other legal justification for the search: The following items were seized: Data maintained by Google Nothing Further 206 (Over) Rev. 6/87 Original?File Copy~Person Whose Property Seized