A0 106 (Rev. 04/ 10) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Eastern District of Wisconsin In the Matter 'of the Search of: information that is stored at premises controlled by Google, 1600 Amphitheatre Parkway, Mountain View, California 94043 CaseNO. 18-M- 191 (DEJ) APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the government request a Search warrant and state under penalty of perjury that I have reason to believe that on the following person or property. See Attachment Al and A2 located in the Eastern District of Wisconsin, there is now concealed: See Attachment The basis for the search under Fed. R. Crirn P. 41(c) is: evidence of a crime; Cl contraband, fruits of crime, or other items illegally possessed; Cl property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to Violations of: Title 18, United States Code, Sections 2113(a) and 924(0) The application is based on these facts: See attached af?davit. Cl Delayed notice of days (give exact ending date if more than 30 days: is requested under 18 S. C. 3103a the basis of which 18 set forth on the attached sheet. Applicant ?3 signature TFO Matthew Gibson, FBI Printed Name and Title Sworn to before me and signed in my presence: Date: bow in), 791? Judge Sign 1W City and State: Milwaukee, Wisconsin Honorable David E. Jones \v U.S. Magistrate Judge Printed Name and Title Case Filed 02/07/19 Page 1 of 13 Document 1 AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT 1, Matthew Gibson, being ?rst duly sworn on oath, on information and belief state: I. INTRODUCTION, BACKGROUND, TRAINING, AND EXPERIENCE: 1. I make this af?davit in support of an application for a search warrant for information that is stored at premises controlled by Google, a provider of electronic communications service and remote computing service headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043. The information to be searched is described in the following paragraphs and in Attachment A. This af?davit is made in support of an application for a search warrant under 18 U.S.C. 2703(c)(1)(A) to require Google to disclose to the government copies of the information further described in Attachment B. 2. I have over 26 years of experience as a law enforcement of?cer and am currently assigned to the Milwaukee FBI Violent Crime Task Force as a Deputized Federal Task Force Of?cer. I was a Special Agent with the Federal Bureau of Investigation for over 23 years and have been an Investigator with the Milwaukee County District Attorney?s Of?ce since May, 2015. I have participated in numerous complex narcotics, money laundering, violent crime, armed bank robbery, and armed commercial robbery investigations in violation of Title 21, United States Code, Sections 841(a)(1), 843 and 846, and Title 18, United States Code, Sections 924(c), 1951, 1956, 1957, 2113, and other related offenses. I have employed a wide variety of investigative techniques in these and other investigations, including but not limited to, the use of informants, wiretaps, cooperating defendants, recorded communications, search warrants, surveillance, interrogations, public records, DNA collection, and traf?c stops. 1 have also received formal training regarding the same. As a Federal Task Force Of?cer, I am authorized to investigate violations of laws of the United States and to execute warrants issued under the authority of the United States. Case Filed 02/07/19 Page 2 of 13 Document 1 3. Based on the facts set forth in this af?davit, there is probable cause to search the information described in Attachment A for evidence of a violation of in violation of 18 U.S.C. 2113(a) (Bank Robbery) and 18 U.S.C. 924(c) (Brandishing a Firearm During a Crime of Violence). A 4. This af?davit is based upon my training and experience, my personal knowledge and information reported to me by other federal, state, and local law enforcement of?cers during the course Of their of?cial duties, all of whom I believe to be truthful and reliable. This af?davit is also based upon police reports, surveillance videos, and witness statements, that I consider to be reliable as set forth herein. 5. Because this af?davit is submitted for the limited purpose of a obtaining a search warrant, I have not included each and every fact known to me concerning this investigation. II. JURISDICTION 6. This Court has jurisdiction to issue the requested warrant because it is ?a court of competent jurisdiction? as de?ned by 18 U.S.C. 2711. 18 U.S.C. 2703(a), Speci?cally, the Court is ?a district court 0f the United States . . . that has jurisdiction over the offense investigated.? 18 U.S.C. 2711(3)(A)(i). BACKGROUND RELATING TO GOOGLE AND RELEVANT TECHNOLOGY 7. A cellular telephone or mobile telephone is a handheld wireless device used primarily for voice communication through radio signals. Cellular telephones send signals through networks of transmitter/receivers called ?cells,? enabling communication with other cellular telephones or traditional ?landline? telephones. Cellular telephones rely on cellular towers, the location of which may provide information on the location of the subject telephone. Cellular telephones may also include global positioning system technology for determining the location of the device. 2 Case Filed 02/07/19 Page 3 of 13 Document 1 8. Google is an Internet company which, among other things, provides electronic communication services to subscribers. Google allows subscribers to obtain email accounts at the domain name gmailcom. Subscribers obtain an account by registering with Google. During the registration process, Google asks subscribers to provide basic personal information. Therefore, the computers of Google are likely to contain stored electronic communications (including retrieved and unretrieved email for Google subscribers) and information concerning subscribers and their use of Google services, such as account access information, email transaction information, and account application information. In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. 9. In my training and experience, email providers generally ask their subscribers to provide certain personal identifying information When registering for an email account. Such information can include the subscriber? 8 full name, physical address, telephone numbers and other identifiers, alternative email addresses, and, for paying subscribers, means and source of payment (including any credit or bank account number). In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. Based on my training and my experience, I know that even if subscribers insert false information to conceal their identity, I know that this information often provide clues to their identity, location or illicit activities. 10. In my training and experience, email providers typically retain certain transactional information about the creation and use of each account on their systems. This information can include the date on Which the account was created, the length of service, records of login session) times and durations, the types of service utilized, the status of the account (including 3 Case Filed 02/07/19 Page 4 of 13 Document 1 whether the account is inactive or closed), the methods used to connect to the account (such as logging into the account via the provider?s website), and other log ?les that re?ect usage of the accOunt. In addition, email providers often have records of the Internet Protocol address address?) used to register the account and the IP addresses associated with particular 10 gins to the account. Because every device that connects to the Internet must use an IP address, IP address information can help to identify which computers or other devices were used to access the email account. 11. As explained herein, information stored in connection with an email account may provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal conduct under investigation, thus enabling the United States to establish and prove each element or alternatively, to exclude the innocent from further suspicion. In my training and experience, the information stored in connection with an email account can indicate who has used or controlled the account. Further, information maintained by the email provider can show how, where, and when the account was accessed or used. Based on my training and experience, I have learned that Google also maintains records that may reveal other Google accounts accessed from the same electronic device, such as the same computer or mobile device, including accounts that are linked by Hypertext Transfer Protocol (HTTP) cookies, which are small pieces of data sent from a website and stored in a user?s Internet browser. 12. Google has developed an operating system for mobile devices, including cellular phones, known as Android. Nearly every cellular phone using the Android operating system has an associated Google account and users are prompted to add a Google account when they ?rst turn on a new Android device. 4 Case Filed 02/07/19 Page 5 of 13 Document 1 13. According to in 2017 Google?s Android operating system was used in more than 85% of the world?s smartphones with Apple?s OIS system being used in less than 15%. In a 3 month period ending September 2018, Kantar Worldpanel, which collected data on the US. smartphone market share, indicated Google?s Android operating systems accounted for 60.1 of the US. market while Apple?s 018 operating system accounted for 39.7%. This data was obtained from the website 14. In addition, over the past 15 years the majority of subjects I have arrested and investigated have had cellular telephones and utilized them in some capacity in furtherance of their criminal activity, such as but not limited to; arranging meetings with co?conspirators; taking photographs of bank proceeds, ?rearms, and vehicles used in robberies; using Instant Messaging and Facebook posts to sell pills stolen from pharmacies; purchasing ?rearms which were used in robberies; using web searches to ?nd pharmacies and cellular phone stores they later robbed; and sending text messages concerning robberies. Also, in numerous police reports I have reviewed as part of these criminal investigations the subjects almost always have a cellular telephone mentioned in the report or seized as evidence. 15. Based on my training and experience, I have learned that Google collects and retains location data from Android?enabled mobile devices when a Google account user has enabled Google location services. The company uses this information for location-based advertising and location-based search results. This information is derived from GPS data, cell site/ cell tower information, and Wi?Fi access points. 16. Location data can assist investigators in understanding the chronological and geographic context of the email account access and use relating to the crime under investigation. 5 Case Filed 02/07/19 Page 6 of 13 Document 1 This geographic and timeline information may tend to either inculpate or exculpate the account owner. Additionally, information stored at the user?s account may further indicate the geographic location of the account user at a particular time location information integrated into an image or video sent via email). IV. PROBABLE CAUSE 17. On 10/13/2018, two unidenti?ed male subjects and . committed an armed robbery of the Great Midwest Bank which is located at 600 Hartbrook Drive, #117 in Hartland, WI. The UNSUBS entered the bank at approximately 9:02 am. through the front door of the GMB. UNSUB #1 approached the teller counter and engaged the two bank employees while UNSUB #2 loitered behind UNSUB Shortly thereafter, UNSUB #2 leapt over the counter, displayed a handgun and ordered both employees to the ?oor. UNSUB #2 removed a plastic garbage bag, opened it up and the UNSUBS began taking money from the teller drawers and placing it into the plastic bag. The UNSUBS asked one of the bank employees for the keys to the vault which the employee provided to the UNSUBS. The UNSUBS entered the vault and removed three drawers of cash from the vault. The UNSUBS were very calm and very polite during the robbery despite the fact they had dif?culty opening the vault and despite the fact the UNSUBS were in the GMB- for approximately 7 minutes. The UNSUBS ?ed through the north facing rear door of the GMB at approximately 9:09 am. with the stolen US. currency, one teller drawer, two vault drawers, and the set of keys used to open the vault. External surveillance cameras from a neighboring business showed the UNSUBS walking north from the bank towards a path through a tree line located behind the GMB which abutted a residential neighborhood. 6 Case Filed 02/07/19 Page 7 of 13 Document 1 18. According to interviews with the two bank employees, there were no customers in the bank at the time UNSUB #1 and UNSUB #2 entered the bank. No one else entered the bank during the duration of the robbery. 19. Hartland, Wisconsin is a town with a population of approximately 9,110 according to the 2010 census. 20. I From a review of surveillance videos and witness descriptions UNSUB #1 was described as an African-American male, approximately 40 to 48 years of age, bearded or unshaved face, subject wearing a light green zip up hooded jacket, blue jeans, black shoes, sunglasses, and a green stocking cap. UNSUB #2 was described as a male subject wearing a black hooded sweatshirt, blue jeans, black shoes, and gloves. UNSUB #2 had the hood up over his head and his face covered with some type of cloth in order to conceal his identity. 21. Google Maps identi?ed the Great Midwest Bank, 600 Hartbrook Drive, #117, Hartland, WI, location using latitude/longitude data as 43.110877, -88.337330. 22. A neighborhood canvass was conducted by law enforcement following the GMB robbery which included the stores in the strip mall where GMB is located. An employee of Design Xchange which is located at 600 Hartbrook Drive, #114 in Hartland, WI, adjoining Great Midwest Bank, advised law enforcement of suspicious activity between 2:30 pm. and 3:30 pm. on 10/12/2018. The DX employee advised that an unidentified African-American male subject entered the DX, looked around the DX for a short period of time, and left. The DX store is a consignment store that sells home decor products. The DX employee thought the activity was suspicious based on the expression on the subject?s face and his interaction with the employee. As the subject entered the store it appeared to the DX employee that the subject did not expect DX to be a home decor store. The subject also appeared to be confused when the DX employee 7 Case Filed 02/07/19 Page 8 of 13 Document 1 approached him and asked if he needed any assistance. The subject did not stay inside of the DX for veryplong and did not appear to be interested in any of the products inside of the store. The employee described this individual as an African-American male, approximately 38 to 48 years of age, 5?6? to 5?8? tall, unshaved, with a stocky build. 23. Based on my training and experience I know that robbery suspects often use utilize mobile cellular devices as tools in furtherance of their robbery conspiracies. For example, 1 know that robbery suspects often use accomplices as lookouts or getaway drivers and communicate with these accomplices through cell phones. Oftentimes, suspects conduct pre-robbery surveillance to determine the number of people inside of the store or the presence of law enforcement. In this instance it is probable that that the UNSUBS had a getaway driver waiting for them in a vehicle in the neighborhood north of the GMB. The UNSUBs entered the GMB through the front door of the bank. In addition, the UNSUBS were not seen on neighboring surveillance video approaching the building from the rear of the GMB before the robbery, but they ?ed out the rear of the GMB after the robbery. This indicates that the UNSUBs were dropped off in front of the GMB and picked up in the neighborhood north of the GMB. Witnesses stated the UNSUBs were extremely calm during the robbery despite the fact they spent approximately 7 minutes inside of the GMB and had dif?culty unlocking the door to the vault. Investigators, who are familiar with the case, believe that the UNSUBS conducted surveillance on the GMB during the afternoon of 10/12/2018 based on the observation of the DX employee and the physical description of the subject seen by the DX employee being similar to Also, the UNSUBS actions in entering the front of GMB and ?eeing out the rear door indicated a level of planning which would have required some familiarity with the area around GMB. 8 Case Filed 02/07/19 Page 9 of 13 Document 1 V. CONCLUSION 24. Based on the forgoing, it is probable that the unknown subjects of this investigation had cellular telephones which utilized either Goo gle?s Android or Apple 018 operating systems. I request that the Court issue the proposed search warrant. Because the warrant will be served on Goo gle who will then compile the requested records at a time convenient to it, reasonable probable cause eXists to permit the execution of the requested warrant at any time in the day or night. VI. REQUEST FOR SEALING I 25. It is further requested that the Court order that all papers in support of this application, including the af?davit and search warrant, be sealed until further order of the Court. These documents discuss an ongoing criminal investigation that is neither public nor known to all of the targets of the investigation. Accordingly, there is good cause to seal these documents because their premature disclosure may give targets an opportunity to ?ee/continue ?ight from prosecution, destroy or tamper with evidence, change patterns of behavior, notify confederates, or otherwise seriously jeopardize the investigation. 9 Case Filed 02/07/19 Page 10 of 13 Document 1 ATTACHMENT A1 BANK ROBBERY LOCATION Property 0 Be Searched This Warrant applies to information associated with all Google accounts that, during the time period described below, were accessed from a mobile device located in the geographic region described below. 1. Date: October 13, 2018 Bank Robbery Location: 43.110877, ?88.337330 (Latitude/Longitude) Time Period: 08:50 am. CST to 09:20 am. CST Radius: 30 meters around location coordinate This warrant calls for information that is stored at premises controlled by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043. 10 Case Filed 02/07/19 Page 11 of 13 Document 1 ATTACHMENT A2 BANK ROBBERY LOCATION BANK ROBBERY LOCATION ~88.337330 ude: 43.110877 600 Hartbrook Dr it itude/Long Lat #117, Hartland, WI. 1V6 3 dwest Bank 1 Great 30 meters Rad 11 Filed 02/07/19 Page 12 of 13 Document 1 Case 2 ATTACHMENT Particular Things to be Seized I. Information to be disclosed by Google (the ?Provider?) To the extent that the information described in Attachment A is within the possession, custody, or control of the Provider, including any information that has been deleted but is still available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. 2703 the Provider shall provide responsive data (as described in Attachments A1 and A2) pursuant to the following process: 1. Goo gle shall query location history data based on the Initial Search Parameters (as described in Attachments A1 and A2). 2. For each location point recorded within the Initial Search Parameters, Goo gle shall produce anonymized information specifying the corresponding unique device ID, timestamp, coordinates, display radius, and data source, if available (the ?Anonymized List?). 3. Law enforcement shall review the Anonymized List to remove devices that are not relevant to the investigation, for example, devices that were not in the location for a suf?cient period of time. If additional location information for a given device ID is needed in order to determine whether that device is relevant to the investigation, law enforcement may request that Google provide additional location coordinates for the Time Period that fall outside of the Target Location. These contextual location coordinates may assist law enforcement in identifying devices that were located outside the Target Location, were not within the Target Location for a long enough period of time, were moving through the Target Location in a manner inconsistent with the facts of the underlying case, or otherwise are not relevant to the investigation. 4. For those device IDs identi?ed as relevant pursuant to the process described above, law enforcement may request that Google Provide subscriber information for the Google Account associated with each identi?ed device ID. 12 Case Filed 02/07/19 Page 13 of 13 Document 1