Case Document 111-3 Filed 07/03/19 Page 1 of 303 Exhibit iCase Document 111-3 Filed 07/03/19 Page 2 of- 303 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of an Application for SEALED Search Warrants for Stored Electronic AGENT AFFIDAVIT Communications 3 Mag. Application for Search Warrants for Stored Electronic Communications STATE OF NEW YORK COUNTY OF NEW YORK i SS. JEFF D. DONALDS ON, being duly sworn, deposes and states: I. Introduction 1. I am a Special Agent of the Federal Bureau of Investigation assigned to the New York Field Of?ce, and have been employed by the FBI since 2010. I am currently assigned to a squad responsible for counterespionage matters and have worked in the ?eld of counterintelligence from 2010 to present. In the course of my duties as a Special Agent, I am responsible for investigating offenses involving espionage and related violations of law, including unauthorized retention, gathering, transmitting or losing classi?ed documents or materials; unauthorized removal and retention of classi?ed documents or materials; illegally acting in the United States as a foreign agent; other national security offenses; and the making of false statements. As a result of my involvement in espionage investigations and investigations involving the unauthorized disclosure or retention of classi?ed information, as well as my training in counterintelligence operations, I am familiar with the tactics, methods, and techniques of United States persons who possess, or have possessed a United States Government security clearance and may choose to harm the United States by misusing their access to classi?ed Case Document 111-3 Filed 07/03/19 Page 3 of 303 information. I am also familiar, though my training and experience with the use of computers in criminal activity and the forensic analysis of electronically stored information. 2. Basis for Knowledge. This Af?davit is based upon my participation in the investigation, my examination of reports and records, and my conversations with other law enforcement agents and other individuals, as well as my training and experience. Because this Af?davit is being submitted for the limited purpose of obtaining the Requested Information, it does not include all the facts that I have learned during the course of this investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. In addition, unless otherwise indicated, statements by others referenced in this Af?davit were not necessarily made to me, but may have been provided to me by someone else to whom I have spoken or whose report I have read (and who in turn may have had either direct or indirect knowledge of {the statement). Similarly, unless otherwise indicated, information in this Af?davit resulting from surveillance does not necessarily set forth my personal observations, but may have been provided to me by other law enforcement agents who observed the events, and to whom I have spoken or whose report I have read. II. The Target Accounts 3. I make this af?davit in support of an application for search warrants pursuant to 18 U.S.C. 2703 directed to Google, Inc., headquartered in Mountain View, CA (?Google?); Reddit, Inc., headquartered in San Francisco, CA (?Reddit?), and Github.com, headquartered in Sacramento, CA (?GitHub?), (collectively, ?Providers?), for all content and other information associated with the following ?Target Accounts?: 2017?03-14 Case Document 111-3 Filed 07/03/19 Page 4 of 303 a. The Google account associated with the email address (the ?Subject Google Account?), which is maintained and controlled by Google. b. The Reddit account associated with the account name Ll347517 (the ?Subject Reddit Account?), which is maintained and controlled by Reddit. c. The GitHub account associated with the user name (the ?Subject GitHub Account?), which is maintained and controlled by GitHub. 4. i The information to be searched is described in the following paragraphs and in Attachment A to each of the proposed warrants. Google 5. Based on my training, experience, and participation in this investigation, I know the following about Google: a. Google offers email and other Internet?based services to the public. Among other things, Google allows subscribers to maintain email accounts under the domain name gmailcom. A subscriber using Google?s services can access his or her email account from any computer connected to the Internet, and can link any variety of Google?s other Internet? based services to his/her Gmail account. b. Google maintains the following records and information with respect to every subscriber account: i. Email contents. In general, any email (which can include attachments such as documents, images, and videos) sent to or from a subscriber?s account, or stored in dra?: form in the account, is maintained on GoOgle?s servers unless and until the subscriber deletes the email. If the subscriber does not delete the email, it can remain on Goo gle?s computers 2017?03?14 10 Case Document 111-3 Filed 07/03/19 Page 5 of 303 inde?nitely. Even if the subscriber deletes the email, it may continue to be available on Google?s servers for a certain period of time. ii. Address book. Google also allows subscribers to maintain the equivalent of an address book, comprising email addresses and other contact information of other email users. Subscriber and billing information. Google collects and maintains (typically unveri?ed) identifying information about each subscriber, including, for example, name, username, address, telephone number, and alternate email addresses. Google also maintains records concerning the date on which the account was created, the Internet protocol address of the user at the time of account creation, the current status of the account active or closed), the length of service, and the types of services utilized by the subscriber. Additionally, for paying subscribers, Google maintains records of the subscriber?s means and source of payment, including any credit card or bank account number. iv. Transactional information. Google also typically retains certain transactional information about the use of each account on its system. This information can include records of lo gin session) times and durations and the methods used to connect to the account (such as logging into the account through Google?s Website). v. Customer correspondence. Google also typically maintains records of any customer service contacts with or about the subscriber, including any inquiries or complaints concerning the subscriber?s account. vi. Preserved records. Google also maintains preserved copies of the foregoing Categories of records with respect to an account, for at least 90 days, upon receiving a preservation request from the Government pursuant to 18 U.S.C. 2703(f). 2017-03?14 Case Document 111-3 Filed 07/03/19 Page 6 of 303 c. In addition, subscriber information for the Subject Google Account indicates that the subscriber of the Subject Google Account has activated additional online Google Services, and, accordingly, the Provider also maintains, among other things, the following records and information with respect to the Subject Google Account: i. Google Drive. Google provides users with a certain amount of ?ee ?cloud? storage, currently 15 gigabytes, through the service called ?Google Drive? (users can purchase a storage plan through Google to store additional content). Users can use their Google Drive to store email, attachments, Videos, photographs, documents, and other content ?in the cloud,? that is online. A user can access content stored on Google Drive by logging into his or her Google account through any computer or other electronic device that is connected to the Internet. Users can also share ?les stored on Google Drive with others, allowing them to view, comment, and/or edit the ?les. ii. Google Docs. Google provides users with the ability to write, edit, and collaborate on various documents with other Google users through a service called ?Google Docs.? Users can use Google Docs to create online documents that can be stored on or saved to the user?s Google Drive. Users can also download such documents in various formats, such as a Microsoft Word document an OpenDocument Format Rich Text Format a PDF document or Plain Text document Google Photos. Google provides users with a certain amount of free storage for photographs, through a service called Google Photos, which allows users to manually store photographs and videos, and which automatically uploads photographs and videos taken by registered mobile devices. Google also retains the metadata?or data, that provides information about the data in question, such as the time and date of creation, the author or creator, the means 2017?03?14 12 Case Document 111-3 Filed 07/03/19 Page 7 of 303 of its creation, the purpose of the data, [among other data?mfor photos and videos that are uploaded to Google, including to Google Photos. This metadata includes what is known as exchangeable image ?le format (or ?EXif?) data, and can include GPS location information for where a photo or video was taken. iv. Google Calendar. Goo gle provides users with an online calendar, in which they can add appointments, events, and reminders, which are across registered computers and mobile devices. Users can share their calendars with other users, allowing the maintenance of ointcalendars. v. YouTube content. Google allows subscribers to maintain linked YouTube accounts, a global video?sharing website that allows users to upload and share videos with public on the Internet. Registered users can upload an unlimited number of videos and add comments to videos. vi. Google Chats and Google Hangouts content. Google allows subscribers to engage in ?chat? sessions in an instant messaging format with other Google users, the transcripts of which are generally stored in a user?s email content. Similarly, Google allows users to engage in enhanced chat sessions, called Hangouts, which permit the sharing of additional content such as videos, sounds, and images. In general, Hangouts content is stored separately from a user?s email and chat content. vii. Location History data. Google maintains recent location data, collected periodically, from mobile devices that are logged into or have used applications (or ?apps?) or services provided by Google. For example, Google collects information collected from GPS, Wi?Fi networks, cell site locations, and mobile networks to estimate a user?s location. 2017?0344 l3 Case Document 111-3 Filed 07/03/19 Page?8 of 303 Google apps and services also allow for location reporting, which allows Google to periodically store and use a device?s most recent location data in connection with a Google account. Android Services. Google also maintains information relating to Android, as it relates to an account. Android is a mobile operating system that is developed by Google, and is used on a variety of mobile devices, such as smartphones and tablet computers. Google retains information related to the Android device associated with an account, including the IMEI (the International Mobile Station Equipment Identi?er), MEID (the Mobile Equipment Identi?er), device ID, and/or serial number of the devices. Each of those identifiers uniquely identifies the device used. One device may be associated with multiple different Google and Android accounts, and one Google or Android account may be associated with multiple devices. ix. Google Voice. Google provides a telephone service that provides call forwarding and voicemail services, voice and text messaging. X. Google Payments. ?Google allows for the storage of payment information associated with a Google Account, including credit cards and bank accounts, and contains information about all transactions made with a Google account, allowing for the payment for goods (such as those purchased through Google Shopping) and bills, among other features. Xi. Web History. Google maintains searches and account browsing activity, from Chrome, Google?s proprietary web browser, as well as other Google applications. 31% 6. Based on my training, experience, and participation in this investigation, I know the following ab out Reddit: 2017?0344 14 Case Document 111-3 Filed 07/03/19 Page 9 of 303 a. Reddit operates several products and services, including reddit.com, redditgiftscom, and associated Reddit mobile applications. The most popular product is reddit.com, which provides an online forum where people can create communities (known as ?subreddits?) in which users can communicate online. b. Each subreddit on reddit.com has its own page, subject matter, users, and moderators. Users post stories, links, and media to these communities, and other users can comment and can ?upvote? or ?downvote? a post. c. The information that is collected by Reddit varies depending on what services the user utilizes. For example, if the user signs up to post on the website reddit.com, Reddit users can choose to provide their name and other contact information (including, but not limited to, their email address), although'though users can also choose not to do so. If the user signs up to Reddit Gifts, the user may be asked to provide Reddit With personal information such, name, address, telephone number, age, perSonal interests, and email address. The user may also be required to provide log-in information for an existing Reddit Account or to create one before using Reddit Gifts. Git?Hub. 7. Based on my training, experience, and participation in this investigation, I know the following about GitHub: 8. Based on my training, experience, and participation in this investigation, I know the following about GitHub: a. GitHub is a webnbased Git, or version control repository, and Internet?hosting service, that can be accessed at GitHub allows Internet users to host code, manage projects, and build software alongside millions of other developers. 2017?03-14 15 Case Document 111-3 Filed 07/03/19 Page 10 of 303 b. A user must create an account in order to contribute content to the site, but public repositories can be browsed and downloaded by others. When an individual registers for an account, they are able to discuss, manage, create repositories, submit contributions to others' repositories, and/or review changes to code. Users are represented in GitHub?s system as personal GitHub accounts. Each user has a personal pro?le, and can own multiple repositories. Users can create or be invited to join organizations, or to collaborate on another user's repository. A repository is one of the most basic GitHub elements. It can contain project ?les (including documentation), and stores each ?le's revision history. 1 c. A variety of information is available on GitHub about users and their repositories. Public user pro?les can include username, repoSitories that the user has starred, other GitHub users the user follows, and those that follow the user. A user may also choose to not share his or her real name, avatar, af?liated company, location, public email address, personal web page, or organizations to which the user belongs. d. GitHub provides social networking?like functions such as feeds, followers, wilds (using wild software called Gollum) and a social network graph to display how developers work on their versions of a repository and what version is newest. e. GitHub can be accessed on GitHub.com, or through GitHub Enterprise on one?s own server, or in a private cloud using Amazon Web Services. GitHub Enterprise is similar to GitHub?s public service, but is designed for use by large~scale enterprise software development teams where the enterprise wishes to host their repositories behind a corporate ?rewall. 2017?03? 14 l6 Case Document 111-3 Filed 07/03/19 Page 11 of 303 Jurisdiction to Issue the Requested Warrants 9. Pursuant to Title 18, United States Code, Sections 2703(a), the Government may require a provider of an electronic communications service or a remote computing service, such as Google, Reddit, or GitHub, to disclose all stored content and all non- content records or other information pertaining to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules of Criminal Procedure. 10. A search warrant under Section 2703 may be issued by ?any district court of the United States (including a magistrate judge of such a court)? that ?has jurisdiction over the offense being investigated.? 18 U.S.C. 2711(3)(A)(i). 11. When the Government obtains records under Section 2703 pursuant to a search warrant, the Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 2703(a), (3). Additionally, the Government may obtain an order precluding the Provider from notifying the subscriber or any other person of the warrant, for such period as the Court deems appropriate, where there is reason to believe that such noti?cation will seriously jeopardize an investigation. 18 U.S.C. j? 2705(b): IV. The Subject Offenses 12. For the reasons detailed below, I believe that there is probable cause to believe that the Target Accounts contain evidence, fruits, and instrumentalities of the unauthorized possession and, inter alia, the communication of national defense information to someone not entitled to receive it, in violation of Title 18, United States Code, Section 793(d); (ii) the unlawful retention of national defense information, in violation of Title 18, United States Code, Section 793(e); exceeding authorized access to a computer in order to obtain national defense information with reason to believe that information could be used to the injury of the 10 2017?03?14 17 Case Document 111-3 Filed 07/03/19 Page 12 of 303 United States and the advantage of a foreign nation and willfully transmitting that information to a person not entitled to receive it, in violation of Title 18, United States Code, Section 103 and (iv) intentionally exceeding authorized access to a computer and thereby obtaining information from a department or agency of the United States, in violation of Title 18, United States Code, Section 1030(a)(2)(B) (collectively the ?Subject Offenses?). V. Probable Cause A. WildLeaks Publication of Classi?ed CIA Information 13. Based on my review of publicly available material on the Internet, including on the website wil