Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 1 of 37 Pageid#: 4 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF VIRGINIA IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH THE CELLULAR DEVICE ASSIGNED CALL NUMBER 540-247-5799, WITH Case No. ____________________ 5:19-mj-00009 INTERNATIONAL MOBILE SUBSCRIBER IDENTITY 310410144949965, THAT IS Filed Under Seal STORED AT PREMISES CONTROLLED BY AT&T WIRELESS. AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, Steven W. Duke, being first duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application for a search warrant for information associated with a certain cellular telephone assigned call number 540-247-5799, with International Mobile Subscriber Identity 310410144949965, (“the SUBJECT PHONE”), that is stored at premises controlled by AT&T Wireless, a wireless telephone service provider headquartered at 1025 Lenox Park Boulevard NE, Brookhaven, Georgia 30319. The information to be searched is described in the following paragraphs and in Attachment A. This affidavit is made in support of an application for a search warrant under 18 U.S.C. § 2703(c)(1)(A) to require AT&T Wireless to disclose to the government copies of the information further described in Section I of Attachment B. Upon receipt of the information described in Section I of Attachment B, government-authorized persons will review the information to locate items described in Section II of Attachment B. 2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have been since January 2009. As such, I am a law enforcement officer of the United States within Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 2 of 37 Pageid#: 5 the meaning of 18 U.S.C. § 2510(7), and am empowered by law to conduct investigations and to make arrests for offenses enumerated in 18 U.S.C. § 2516. 3. I was hired by the FBI as a Special Agent in January 2009, and successfully completed new agent training at the FBI Academy in Quantico, Virginia, in May 2009. I am currently assigned to the Winchester Resident Agency of the Richmond Field Office. As a Special Agent of the FBI, I have investigated violations of federal law and have gained experience and knowledge through investigations and training, and from discussions with law enforcement officers with experience and training in investigating violations of federal law. 4. As part of my duties as a Special Agent, I investigate criminal activity related to a number of federal violations, including mailing threatening communications, in violation of 18 U.S.C. § 876(c), and use of weapons of mass destruction, in violation of U.S.C. § 2332a(a). My experience includes, but is not limited to, conducting physical surveillance, interviewing witnesses, conducting database checks, analyzing telephone records, writing affidavits for search warrants, executing search warrants, and working with undercover agents and informants. I have become familiar with matters including, but not limited to, the means and methods used by individuals who utilize the United States Postal Service (USPS) to send threatening communications to others, and the means and methods used by individuals to harm or threaten others with explosive devices. 5. Through my training and experience, and from discussions with other law enforcement officers, I have become familiar with the methods of operations typically utilized by individuals who seek to evade law enforcement while threatening others via mailed communications, or evade law enforcement while attempting to harm or threaten others via the use of explosive devices. I know that such individuals utilize the USPS to conceal their identity 2 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 3 of 37 Pageid#: 6 from those they threaten. I am aware that such individuals typically travel to a location away from their residence to place the threatening communication(s) in the mail, and conceal their identity by using fictitious return addresses or by providing no return address. I am familiar with countermeasures used by such individuals to evade law enforcement identification, such as wearing gloves to prevent fingerprints on the threatening communication and/or explosive device, use of commonly-found stamps, and avoiding hand-written communications. 6. The facts in this affidavit come from my personal observations, my training and experience, and information obtained from other agents and witnesses. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. 7. Based on the facts set forth in this affidavit, there is probable cause to believe that violations of 18 U.S.C. § 876(c) and 18 U.S.C. § 2332a(a) have been committed, are being committed, and will be committed by GERALD DRAKE (DRAKE). There is also probable cause to search the information described in Attachment A for evidence, instrumentalities, contraband, or fruits of these crimes as further described in Attachment B. PROBABLE CAUSE 8. On September 23, 2017, a letter was received, via the USPS, at the visitor’s center of the Cedar Creek Battlefield Foundation (CCBF), 8437 Valley Pike, Middletown, Virginia 22645. The letter was sent in an envelope that contained, in the upper-left corner, a printed symbol commonly associated with Antifa. Online resources describe Antifa as a conglomeration of left wing, autonomous, anti-fascist militant groups who oppose far-right and white supremacist ideologies directly, rather than politically, by employing tactics such as digital activism, property damage, and physical violence. The Antifa symbol displayed on the envelope 3 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 4 of 37 Pageid#: 7 (see Figure A) included a black flag and a red flag inside a circle, with the black flag positioned in front of the red flag. Figure A 9. Your affiant is aware that this is one of the most common symbols associated with Antifa. The envelope was postmarked on September 21, 2017, at the USPS’s Northern Virginia processing center. The top of the letter also contained the same printed Antifa symbol displayed on the envelope. The letter was typed and included threatening language toward the “Cedar Creek Battlefield People.” The writer of the letter stated, “You need to cancel your coming up celebration of the Civil War on October 13, 14, 15, 2017. If you choose to continue with this farce of history, that clearly celebrates the war to keep African-Americans in chains, than we have no choice but to come and protest. We will come, and disrupt, and cause problems for all those who attend this atrocity of history. Several hundred of our supporters will attend, and slash tires, block traffic, harass Patrons, and re-enactors. We will make Charlottesville look like a Sunday picnic! Many of us have dogs, so will bring dog feces to throw on people! We will also throw cups of human urine! We might resort to actually firing guns into the camps and at the reenactors! We will put poison in the water, we will use noise to disrupt the battles and sleep! These events must stop! Our local organizer tells us he is ready to go! You have been warned, 4 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 5 of 37 Pageid#: 8 now if it is not called off, we will destroy you! You have less than 1 month to issue a cancellation notice, do it asap!” 10. On October 14, 2017, the CCBF held the planned battle reenactment at the Cedar Creek Battlefield in Middletown, Virginia. The annual event has been held since 1990, at the same battlefield on which the Civil War Battle of Cedar Creek was fought. During the afternoon hours on October 14, 2017, while the battle reenactment was occurring, an unexploded pipe bomb (see Figure B) was discovered in a sutler (Civil War era merchant) tent on the battlefield property. The pipe bomb was rendered safe by a Virginia State Police (VSP) bomb technician, and turned over to the FBI for processing. The pipe bomb device was constructed by using a metal pipe nipple, metal nuts glued to the pipe nipple, metal end caps, a 9-volt battery, black and red wires, and a mercury switch. The inside of the pipe nipple contained smokeless powder and Pyrodex (low explosive ammunition propellants), and BBs. Despite widespread media coverage of the pipe bomb discovery, your affiant is unaware of any public claims of responsibility by an individual or group. Figure B 5 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 6 of 37 Pageid#: 9 11. On November 6, 2017, an envelope containing a threatening letter was received by the Gettysburg Times, 1570 Fairfield Road, P.O. Box 3669, Gettysburg, Pennsylvania 17325, sent via the USPS. The upper-left corner of the envelope contained the same printed Antifa symbol that was displayed on the letter received by CCBF on September 23, 2017. The envelope was postmarked on November 2, 2017, at the USPS’s Northern Virginia processing center. The top of the letter contained the same printed Antifa symbol displayed on the envelope. The typed letter contained threats to run over people with trucks, set fires, and have a shooter on a rooftop or a hotel window. Based on the content and timing of the letter, the threats were made in reference to the Gettysburg Remembrance Day parade scheduled for November 18, 2017. The writer stated that these threats would be carried out if Confederate flags, or Confederate men and women, were allowed in the parade. The letter included the statement, “For proof that we did cedar creek terror attack, the bomb was pipe with end caps, 9 volt battery, mercury switch, epoxy, nuts, BB’s.” 12. On November 13, 2017, JOHN BUCHHEISTER (BUCHHEISTER), a resident of Gettysburg, Pennsylvania, who owned and operated a sutler business called The Maryland Sutler, reported to law enforcement that he received a suspicious letter in the mail. The envelope containing the letter was postmarked on November 2, 2017, at the USPS’s Northern Virginia processing center. The top of the letter contained the same printed Antifa symbol displayed on the letters received by CCBF and the Gettysburg Times. The letter was typed, and the writer stated, “Thank you so much for putting on Facebook that a teenager was arrested for the threat to Cedar Creek, it was so much easier to bring in a bomb. Do something like this again for us, we are coming to the Gettysburg Parade and speech. Thank you again for all your help in the last terror event.” 6 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 7 of 37 Pageid#: 10 13. On June 19, 2018, the Winchester Star newspaper, 2 North Kent Street, Winchester, Virginia 22601, printed an article that discussed CCBF’s plans to increase security for the 2018 Cedar Creek Battlefield reenactment. On June 29, 2018, the Winchester Star newspaper received an envelope, via USPS, that contained a threatening letter addressed to “Joe Darezzo.” JOSEPH D’AREZZO (D’AREZZO) was the president of the CCBF Board of Directors (BOD) at that time. The envelope contained a printed Antifa symbol in the upper-left corner. The symbol was similar to the symbols displayed on the previous threat letters, but the positions of the red and black flags were reversed from the way they were displayed on the previous letters. The envelope was postmarked on June 26, 2018, at the USPS’s Baltimore, Maryland, processing center. The top of the letter contained the same printed Antifa symbol displayed on the envelope, with the exception of additional words included on the circle that were not present on the envelope’s symbol. These words were “Antifascist USA” and “Action.” (see Figure C) Figure C 14. The letter writer threatened to kill D’AREZZO’s mother with a car bomb if the 2018 Cedar Creek Battlefield reenactment was not cancelled. The letter also included methods that could be used to bring weapons and destructive devices into the reenactment grounds. The writer included the statements, “Don’t think metal detectors will help, we have plastic pipe bombs…” and “If you won’t stop this celebration of slavery than maybe we need to hurt the participants to stop it instead of just the visitors.” The final line of the letter read, “We are the 7 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 8 of 37 Pageid#: 11 ones that did it to you last year, we used a bad bomb guy his mercury switch, and rocket launch wire didn’t work on the pipe bomb covered in nuts, just so you know we are real and returning.” At the bottom of the page, the letter contained a statement that the letter was also sent to Cedar Creek to warn them that they will be attacked again. 15. On June 29, 2018, the CCBF received an envelope, via USPS, that contained a threatening letter identical to the letter received by the Winchester Star newspaper on June 29, 2018. The envelope was postmarked on June 26, 2018, at the USPS’s Baltimore, Maryland, processing center. 16. On July 2, 2018, BUCHHEISTER reported to law enforcement that he received another suspicious letter, via USPS, at his residence in Gettysburg, Pennsylvania. The envelope that contained the letter was postmarked on June 29, 2018, at the USPS’s Northern Virginia processing center, and contained a printed Antifa symbol (see Figure D) in the upper-left corner. The top of the letter also contained the same printed symbol. These symbols were identical to the symbol displayed on the envelope received by the Winchester Star on June 29, 2018. Figure D 17. The typed letter was addressed to “Joe”, and the writer stated, “Since we can’t seem to get you to stop this celebration of a war to keep men in chains, maybe if we go after your volunteers that help out you will stop this. I like the idea of burning your mother alive in a car bomb.” The writer also made threats to the CCBF visitor’s center, stating, “Our many members 8 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 9 of 37 Pageid#: 12 have suggested we blow up your visitor building, or shoot it up. I like the idea of burning it to the ground.” Additional statements in the letter mentioned ways to bring weapons into the reenactment event, including, “We now have plastic bombs, so metal detectors are useless! We have found a man that is going to pose as a enactor to drive in some kind of fertilizer bomb. We have coolers, thermoses, water bottles all made into small IED’s.” The final line of the letter read, “To our great friend the Maryland sutler, let everyone know it is going to be a “Blast” at Cedar Creek this fall. We sent the above letter to them.” 18. Due to the threatening letters, and the pipe bomb discovery in 2017, the CCBF cancelled the 2018 Cedar Creek Battlefield reenactment on July 3, 2018. 19. On October 2, 2018, the Winchester Star newspaper printed an article titled, “Cedar Creek Battlefield Foundation President, Board Member Resign Over Safety Concerns.” The article discussed D’AREZZO’s decision to resign as the president of CCBF because he did not believe other board members were taking the threats seriously enough. 20. On October 10, 2018, an envelope was received at the CCBF visitor’s center that contained a threatening letter. Neither the envelope nor the letter contained any printed symbols. The envelope was postmarked on October 5, 2018, at the USPS’s Northern Virginia processing center. The typed letter was addressed to “Joe D’Arezzo,” and referenced his departure from the CCBF board. The writer stated, “Sorry to see you go. You were the only one there who knew what we are able to do.” The letter also contained threats to the daughters of JEANNETTE SHAFFER (SHAFFER). SHAFFER was the acting president of CCBF after D’AREZZO resigned. The writer stated, “If Jeannette Shaffer thinks she is safe, well she is right, but her children are not! If she puts together a reenactment to celebrate keeping men in chains, we will come after her girls. We have a convicted rapist that would love to introduce them to his penis.” 9 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 10 of 37 Pageid#: 13 The writer also threatened to kill specific individuals, stating, “Or we might kill Dr. Stan Hirschberg, or Tim, Pat, or a few volunteers. It looks like we are going to have to burn the store down, Pat keeps opening it up, or we could just shoot him in the morning.” The writer also made a reference to SHAWN MOWBRAY (MOWBRAY), stating, “You also have a rat in your place, our information about everything you are or were doing came from him. Yes, we like real information, but we also hate rats. You might want to get rid of him. Shawn Mowbray is your rat. We will continue to get information from our other friends.” Based on witness interviews, your affiant knows that MOWBRAY is a resident of Frederick County, Virginia, and is a Civil War reenactor. The letter writer also made a reference to D’AREZZO’s parents, stating, “You and your pretty mother, and bald headed dad are now safe, keep speaking the truth, expose this foundation for what it is, a big bunch of racists.” The final line of the letter read, “We are also looking at fun at Gettysburg if the weather cooperates this year. Electronics and fuses don’t work well in rain.” 21. On November 5, 2018, the office of the mayor of Gettsyburg, Pennsylvania, opened an envelope that the office received, via USPS, on November 2, 2018. The envelope was postmarked on October 31, 2018, at the USPS’s Harrisburg, Pennsylvania, processing center. The upper-left corner of the envelope contained an Antifa symbol that was identical to the symbol displayed at the top of the letter received by the Winchester Star on June 29, 2018. The envelope contained a letter that included the same printed symbol at the top. The typed letter was addressed to “Gettysburg Parade organizers.” The letter read, in full, “Last year it rained so much we decided to pass on blowing up bombs, driving over people, and slashing viewers with knives. Our new idea is we are going to put bombs into stores to disrupt this celebration of a war 10 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 11 of 37 Pageid#: 14 to keep men in chains. Cancel the flying of the confederate flags and post it on Facebook, then we will leave you alone. Don’t and someone is going to die.” 22. On December 1, 2018, CCBF posted an announcement on its website that it planned to host a reenactment at the Cedar Creek Battlefield in October 2019. 23. On December 7, 2018, an envelope was received at the CCBF visitor’s center that contained a threatening letter. The upper-left corner of the envelope contained an Antifa symbol that was identical to the symbol displayed on the envelope received by the office of mayor of Gettysburg, Pennsylvania, on November 2, 2018. The envelope was postmarked on December 4, 2018, at the USPS’s Harrisburg, Pennsylvania, processing center. The top of the letter contained the same printed Antifa symbol, and the letter was addressed to “Pat Kehole.” The first line of the letter included the statement, “We have seen on Facebook that you are planning to defy us and hold a reenactment in 2019. You want problems, you are going to get them.” The letter also included threats of violence against the sister and brother of PATRICK KEHOE (KEHOE), and additional threats against SHAFFER’s daughters. KEHOE is CCBF’s only full-time employee. 24. After reviewing the contents of the aforementioned threatening letters with members of the CCBF BOD, and reviewing board meeting minutes, your affiant determined there was information in the 2018 threat letters that was specifically discussed at CCBF board meetings in 2018. A) At the CCBF board meeting on April 29, 2018, the board decided to prohibit spectators from bringing backpacks into the 2018 Cedar Creek Battlefield reenactment event. SHAFFER advised your affiant that the board decided a limited number of items would be allowed, such as diaper bags and purses. The threat letter 11 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 12 of 37 Pageid#: 15 received by the Winchester Star on June 29, 2018, specifically noted that a diaper bag could be used to bring a destructive device into the reenactment. B) At CCBF board meetings on November 5, 2017; March 3, 2018; and April 29, 2018, the board discussed the option of only allowing invited spectators to attend the 2018 Cedar Creek Battlefield reenactment. In interviews, CCBF board members stated that the plan to deny access to the general public was not publicly announced by CCBF. The threat letter received by the Winchester Star on June 29, 2018, warned that, “If you won’t stop this celebration of slavery than maybe we need to hurt the participants to stop it instead of just the visitors.” In the threat letter received by BUCHHEISTER on July 2, 2018, the writer warned that, “Since we can’t seem to get you to stop this celebration of a war to keep men in chains, maybe if we go after your volunteers that help out you will stop this.” CCBF board members advised your affiant that these threats suggested the writer of the letters was familiar with their plan to close the event to members of the general public. C) At the CCBF board meeting on March 3, 2018, the board discussed the option of hiring private security for the 2018 Cedar Creek Battlefield reenactment event. The board also discussed the possibility of having the Frederick County, Virginia, Sheriff’s Office (FCSO) assist with security at the event. SHAFFER advised your affiant that the board asked FCSO to provide hand-held metal detectors for use at the 2018 reenactment. In the letter received by BUCHHEISTER on July 2, 2018, the writer stated, “We now have plastic bombs, so metal detectors are useless!” When interviewed, two board members advised your affiant that the potential use of metal detectors was discussed at a board meeting in 2018, and they believed the 12 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 13 of 37 Pageid#: 16 writer of the threat letter seemed to be familiar with their plan to use the metal detectors. 25. In the threatening letter received by the CCBF on October 10, 2018, the writer threatened to kill specific individuals, stating, “Or we might kill Dr. Stan Hirschberg, or Tim, Pat, or a few volunteers.” Based on witness interviews, your affiant learned that the individual identified as “Tim” is not publicly associated with the CCBF as a board member or employee. This individual worked as a volunteer at the CCBF visitor’s center in 2018. When interviewed, multiple CCBF board members stated that the writer of the letter seemed to be familiar with the daily operations of the visitor’s center during 2018, based on the identification of “Tim” in the letter. Based on interviews and a review of CCBF records, your affiant is aware that the CCBF is a small organization with one full-time employee, twelve members of the BOD, and a small number of volunteers. 26. In the letter received by CCBF on October 10, 2018, the writer mentioned that “Pat” continued to open up the CCBF visitor’s center store, despite the previous threats to burn it down. KEHOE is the CCBF’s only full-time employee, and he was responsible for operating the visitor’s center during the summer months of 2018. KEHOE advised your affiant that very few people were aware that he opened the CCBF visitor’s center building, on a limited basis, after the threats received in late June 2018. One of the individuals who was aware that KEHOE continued to open the visitor’s center on a limited basis was GERALD DRAKE (DRAKE). KEHOE provided this information to DRAKE at a Civil War Roundtable meeting in Winchester, Virginia, on October 4, 2018. 27. The reference to MOWBRAY in the letter received by CCBF on October 10, 2018, was discussed during multiple witness interviews. In that letter, the writer stated, “You 13 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 14 of 37 Pageid#: 17 also have a rat in your place, our information about everything you are or were doing came from him. Yes, we like real information, but we also hate rats. You might want to get rid of him. Shawn Mowbray is your rat. We will continue to get information from our other friends.” Multiple witnesses, including MOWBRAY, stated that MOWBRAY was a volunteer worker at the CCBF visitor’s center building renovation in 2014, but has not been directly affiliated with CCBF, in any capacity, since that time. He was not privy to information that was discussed at CCBF board meetings, and did not spend substantial time at the CCBF visitor’s center. MOWBRAY presented a petition to the CCBF BOD at a meeting on July 29, 2018, and asked the board to reconsider its decision to the cancel the 2018 Cedar Creek Battle reenactment. Following his presentation of the petition, MOWBRAY left the board meeting and did not participate in any further discussions with the board. CCBF board members stated that it was highly unlikely that MOWBRAY could have passed sensitive or private CCBF information to the writer of the threatening letters, even unwittingly. 28. Multiple individuals interviewed revealed that MOWBRAY was involved in an incident with DRAKE at the 2014 Cedar Creek Battle reenactment. DRAKE and MOWBRAY both worked as volunteers at the CCBF visitor’s center in 2014, and both were members of the same Confederate reenactor unit. DRAKE and his friend, DARRELL GRIFFITHS (GRIFFITHS), were removed from the reenactment unit after the incident involving MOWBRAY. The incident occurred when an unknown individual provided anonymous information to DRAKE and GRIFFITHS that their unit commander, DUFFY MILLER (MILLER), planned to sneak into the reenactment without paying the entry fee. KEHOE advised your affiant that MOWBRAY was later suspected of being the individual who provided the anonymous information. Based on the information, DRAKE and GRIFFITHS created posters 14 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 15 of 37 Pageid#: 18 and placed them around the battlefield property and in the CCBF visitor’s center. The posters advertised MILLER’s intentions to sneak into the event, and encouraged other reenactors to stop him. MILLER learned about the posters, became upset, and removed DRAKE and GRIFFITHS from his unit. After DRAKE and GRIFFITHS were removed from their unit, MOWBRAY continued to participate in the annual Cedar Creek Battle reenactment, including the 2017 event. However, he did not volunteer to work for CCBF after 2014. MOWBRAY advised your affiant that he was shocked to learn that his name was included in the threatening letter. He stated that the 2014 incident with DRAKE and GRIFFITHS was the only time he has been involved in a controversy at the Cedar Creek Battlefield reenactment. 29. CCBF records and multiple witness interviews confirmed that DRAKE worked in the CCBF visitor’s center as a volunteer in May and June 2018. Multiple witnesses advised that DRAKE was very interested in discussions between board members and KEHOE while they were present together in the CCBF visitor’s center. Following the discovery of the pipe bomb in 2017, KEHOE occasionally made jokes about future Cedar Creek events that were similar to the “blast” comment that was made in the letter received by BUCHHEISTER on July 2, 2018. Witnesses observed that DRAKE may have been present in the visitor’s center when KEHOE made such jokes. CCBF records documenting the presence of volunteers in the visitor’s center revealed that DRAKE was present with KEHOE on multiple days during May and June of 2018. These events suggest DRAKE may have received information from KEHOE that was later used to draft the threatening letters. 30. DRAKE has not participated in the battle reenactment at Cedar Creek since he was removed from his reenactor unit in 2014. However, he volunteered at the Cedar Creek reenactment in 2016 and 2017. He worked in the reenactor registration tent at the 2017 event, 15 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 16 of 37 Pageid#: 19 and because he was a volunteer, had access to the entire event. The reenactor registration tent was located outside the battlefield property, in a large field to the Northeast of the battlefield. The registration tent opened on Wednesday, October 11, 2017, and closed at approximately 12:00pm on Saturday, October 14, 2017. SHAFFER and her daughters volunteered to work in the spectator parking lot for the 2017 event, as they have for several consecutive years. When interviewed, SHAFFER noted that she is not a close friend of DRAKE, but believed he would definitely be familiar with her daughters because they have volunteered at the past several Cedar Creek reenactments. 31. At the time of the pipe bomb discovery on October 14, 2017, DRAKE had one registered vehicle, a blue 2017 Hyundai Tucson. The vehicle color is designated by Hyundai as “Caribbean Blue,” and physical surveillance has revealed that it is a very distinctive shade of blue. A civilian drone operator provided the FBI with video footage captured during the Cedar Creek reenactment weekend in 2017. Surveillance camera video footage from a business near the battlefield property was also provided to the FBI. On the drone video footage, a vehicle closely resembling DRAKE’s was observed parked next to the reenactor registration tent during the evening hours on Friday, October 13, 2017. SHAFFER confirmed that she observed DRAKE at this registration tent during the afternoon or evening hours of October 13, 2017. The business’s surveillance camera footage showed a similar vehicle entered the battlefield property gate at approximately 2:57pm on Saturday, October 14, 2017. The drone video footage showed that this same vehicle was parked inside the battlefield property at approximately 3:10pm. The pipe bomb was discovered at approximately 3:40pm. The reenactor registration tent was taken down at approximately 9:00am on Saturday, October 14, 2017, and registration was moved to the CCBF visitor’s center. The registration closed completely at approximately 12:00pm. The 16 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 17 of 37 Pageid#: 20 vehicle observed on the business’s surveillance camera footage, similar in appearance to DRAKE’s vehicle, traveled from the direction of the visitor’s center building as it approached the entrance to the battlefield gate at approximately 2:57pm. 32. In September 2004, DRAKE was an inmate at the jail in Auglaize County, Ohio. On September 14, 2004, the Auglaize County Sheriff’s Office submitted a report to the FBI Cleveland Field Office, documenting an incident that occurred in the jail on September 13, 2004. Officers at the jail discovered a series of drawings in the possession of another inmate, who advised that the drawings were made by DRAKE. DRAKE later confirmed to jail officials that he created the drawings to convince the other inmate that he was familiar with explosives. DRAKE created eight pages of hand-drawn diagrams of explosive devices, including pipe bombs, a grenade, a propane bomb, a Coleman fuel bomb, and a CO2 cartridge bomb. The pipe bomb diagrams were similar to the pipe bomb discovered at the Cedar Creek Battle reenactment in 2017. The diagrams created by DRAKE included a mercury switch, gunpowder, BBs added to the gunpowder for additional shrapnel, and a rocket launcher igniter. Although a rocket launcher igniter was not found with the pipe bomb discovered at Cedar Creek, the threatening letter received by the Winchester Star on June 29, 2018, referenced a “rocket launch wire,” and seemed to suggest that the pipe bomb included one. It is possible the igniter was initially present on the pipe bomb, but destroyed or lost when the device was rendered safe by the Virginia State Police. The Cedar Creek pipe bomb did contain a mercury switch, smokeless powder, and BBs. The drawings included hand-written instructions on how to manufacture the various explosive devices, and the exact materials that should be used. DRAKE noted that the pipe nipple should be “black iron” rather than galvanized pipe, which is consistent with the appearance of the pipe nipple used for the Cedar Creek pipe bomb. The instructions for the pipe bomb device included 17 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 18 of 37 Pageid#: 21 statements that the pipe nipple and end caps should be bought or stolen. After reviewing the drawings and written instructions, it is your affiant’s belief that DRAKE appeared to be familiar with the construction of pipe bombs, precisely how they should be manufactured, and methods the manufacturer could use to avoid being identified. These drawings are shown below (see Figure E): 18 Case Document 3-1 Filed 02/08/19 Page 19 of 37 Pageid#: 22 Figure RKka [ail/HG, inanfsl?rtr ?r Bouln' snip hullwire me it's ?Ekate- Me 6r Bah)?. H3 Hi"! l?ul??hj Plight. - ""iarm'c? $1 ?ow km! N- am? it: Fuuw +va- n. 6 Old? ?paid gulp . ya? migh- butt ran-J"- of 11.! rack; f9?;3?cr bu"? 5333f A'F'h-clq Altman-for (IEPI wir: 0' Pow .5an: yo: mu? her but W?Irt ?rm owl-:3 tank-{1+ S'Ftel loan-b 4.13:. Tofu; Til W?pvth 69+ Ox. QRQP Windup AIKPM Cluck QHL Opr- +11: H4: Seconl Remix or Sump f+ ctr-F- Cum-nu WIN-5 ?Hw. m?inuf: thank ?gvr ?waif ox; Slew-x P?w?k Fatal Prefab: your nlwiwko. km}; Mau- It?h?q by?? +0 in .. LG- umnn MW of Ed I trim r?f 19 Case Document 3-1 Filed 02/08/19 Page 20 of 37 Pageid#: 23 't 1 20 Case Document 3-1 Filed 02/08/19 Page 21 of 37 Pageid#: 24 '10? TD fan-?NJ u? FffS+ VOU ROME +0 OLf-a?m ON :Intr+b 9? rdu?u'f? 05"? 9 Scruffy; Shore 0.. au?5L.yJ_ "You Wmv? +0 buy 0h? puff-L I. hijf?? ?uke we I In?ll: VIEW TUS is, 3:9 :3 +0 rcM'l?t ?Hkt . 5? pica 4/ a 7 ?3 1? +0ka 9? 9??le :lqneh WK an! !A?trf- t-f- Info ammcr 0L4. 0M Frl?hqqr Cltom Cr?: LR Rub r. t? #i I-Ai'b Eh;- FLSEL if!? kri?l?t? 00? Re. m?emb{a 'qu. ?H?ia?r And/kl 4? Fuji: Mia-(l. CM 0* Fak?t 01C Fuse Ian) {?0?jo +0 Pm? ?1"ch W97 ., Hwy H59 FUSE. ?fth an} up 1'0 Primer 5:05?; Ho we? M. ?1?15312? Fame ?m rate F'vjf L: mg ?i?f ., Pipe ?rap ML WW Amnlra?mn-Jc. +0 aged Fr? Shrunk kt 9F ??4?ch I #270. yaw Me. ran-3.x, 1?0 +Lf0lv/ 54?? tbOI/f- 3'75m5?! bd?rc ix blow; L70. 56.6 GH-U Fm Mia?) 21 Case Document 3-1 Filed 02/08/19 Page 22 of 37 Pageid#: 25 [0130? Trig?r ?r Hum ert- +0 {Monk-- an? .913?- an! glut- II InsIlc fir; - . SD Mimi-S 1.1.0. in Pp; Ind. 140%: PVC Gun?- nm Jaw-5:6 swim-Y ,3ka .L 1 69 Low-3 1 3nd bi]. herb-5 Spas-liqf wire C?rk in Fife. Pui- baring insiJII. Pipe ML [nun Clark +0 H12 lam? in Ah? FF Bo'? bomb MOM ILI- be.? RH IL: wire: I - a: COM. aka Sulas+adu+? 0? Mammy szII-Jn For bail harry-.3 device. 22 Case Document 3-1 Filed 02/08/19 Page 23 of 37 Pageid#: 26 ide'vkw 04- FM . Oh? 35m Fm?. CM I wret" efhp? - u: To? VICW Tdf? We?! of tale 1 0-- 1'1; wr-?P ?r were ?u I - (a TOP 11m. 5? 35 +134: Cwu 'm 10H, Ra?: PHICL 9.. ?v't in buffer-1 or Co? Th duo? for! M3 in? H-c. Cm. F1151 So your Feat if in fowdar? use. ah In pick 0? HOMLMUJQ mill.? 1'0 ?9th hold} an," chl, Lou! 23 Case Document 3-1 Filed 02/08/19 Page 24 of 37 Pageid#: 27 Pi; - Bow-4L3 1! FIR (hf - 6v? gr Sim-l FIFE "?11 7- P?r'ialmlm The) ?In: 'uwi?y' Mule 0F Fran or and. - 4' Tank?- 614an ml Uri? a side. we? of your haHo?! ?4 p. 6 men. bur ?mck pi! g-ny? . . furl; ni?llc COJIJ Snuf- Mtg? 1'0 with! ?froll. . :?lmtk Iran 9 nof Ski-Cruel. on'u ml: 5:04?; mam: an?y- Screw o- '3va CH4 5'1 Pi? PIPQ 31% km?; wry +i3k?r .dc unof- ?3 Wi?" ?the? {o 3F 81%? Powdtr rF+?r I4. Ira: powJer In PL if {09? Slot-HT 0an NW uf? 1% 54kt and" (chill-W . ham-He - rem Take (pp ML pu+ 3+ aw in ?we; 33?: ?a in N. .l am! sch-re! '1'an .- '11 I 24 Case Document 3-1 Filed 02/08/19 Page 25 of 37 Pageid#: 28 1k' bar-?lo: lake CM. fray-d i I . A (it: {Lawn inf-Lt n?u'Jch up ?the? THE Cerf-cm Fug! banal: i395. Iggy, CM of Fed Find. M1 1?1? 10:99. Err-ml: I unlu- hnn'jfe Turn UPS [lg 039-?" Furc, 60+? Van, In} use am? '0'?qu 'aund ck. ?inch In} Shel. or 3? nirp?t Far mam?! Lamb; +1-1ch win 813?: m; mi?- wits-w pin: 10 . . 5' tau-(L Print. keg? 12:53.: 25 Case Document 3-1 Filed 02/08/19 Page 26 of 37 Pageid#: 29 (-5.01 Cmr?qrqijt our? Ogsie Fin-d- View}; 51"! Ki? fig-i fay-5 P?n 3?4- eh?y Ml'JPl?h I. \1 . jg Inch In HM: Chl?i?r'il?e I F956. . ?34 m, bin. Eng Bug-tr- (nail. Fth?- ?15: ?1 EA ox Vic! [and do C-l" ?rst half w'Hu grusk Prehgurt 98+ Hacker? ins Try ?r Hat 1 54-3: iype WHLuuf a. L. Hue banter U1. up? (101 banal- L. anger ~2in? wt Fm mam-?3 ESTEE Rock? Black om? +3.61 Tktv- ?1 Wuod?n Bowl 5-!in 1'0 rack? agiu has '0th The 5+1d< 3m}; (at 113nm . ML Lg! FALL Gimp?: Ce- J?I'zc Cam be ?kt 0" Fwd} CHA- of 0\ .. 26 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 27 of 37 Pageid#: 30 33. In 2003, DRAKE was investigated by the St. Mary’s, Ohio, Police Department (SMPD). DRAKE and his estranged wife lived in Port Huron, Michigan, at the time. A review of the SMPD investigative file regarding DRAKE revealed that he was suspected of sending multiple pieces of correspondence to the Auglaize County (Ohio) Prosecutor. These items included a falsified polygraph report; a fabricated statement from his estranged wife that included a forged signature of the estranged wife, a forged Notary signature, and a forged Notary stamp; and a fabricated letter from the Port Huron Police Department (PHPD). The falsified polygraph report was created using the letterhead of the Michigan State Police (MSP), and included the majority of the actual polygraph report that was completed by MSP. Portions of the report were fabricated, including the statements that DRAKE made during his post-polygraph interview. The fabricated letter from the PHPD was created using actual PHPD letterhead, and was addressed to the Auglaize County Prosecuting Attorney. The typed letter was written to appear as though an anonymous member of the PHPD wanted to provide the Auglaize County prosecutor with additional information that was being withheld by PHPD investigators. The letter writer stated that DRAKE’s estranged wife had previous problems with child neglect and lost her daughter for a period of time because of child neglect. The writer stated that the letter was put through a Xerox machine, so no efforts should be made to positively identify the writer. Your affiant believes this statement was made to suggest that no fingerprints would be located on the letter. Per the investigative file, the PHPD detective assisting SMPD with the investigation of DRAKE confirmed that the letter was created by someone outside the PHPD, and did not include accurate statements regarding DRAKE’s estranged wife. 34. On August 28, 2003, PHPD officers executed a search warrant at DRAKE’s residence in Fort Gratiot, Michigan. During the search, items were discovered that suggested 27 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 28 of 37 Pageid#: 31 DRAKE was responsible for creating the falsified polygraph report and the fabricated statement from his estranged wife. A printed copy of the Local & State section of the Times Herald newspaper of Port Huron, Michigan, dated November 16, 2002, was also located in DRAKE’s residence. On the left side of the page, an article appeared to document that DRAKE’s estranged wife, SUSAN JO DRAKE, pleaded guilty to first degree child abuse and first degree child endangerment. PHPD investigators reviewed the actual Local & State section of the Times Herald for November 16, 2002, and discovered that the article regarding DRAKE’s estranged wife was not there. Investigators believed DRAKE removed the actual article on the left side of the page and replaced it with the fabricated article about SUSAN JO DRAKE. 35. PHPD and SMPD investigators concluded that DRAKE utilized a computer to fabricate documents using the actual letterhead of law enforcement and government agencies, created false statements with forged Notary signatures and stamps, and completely altered a newspaper page by replacing an actual article with a fabricated article about his estranged wife. Investigators believed DRAKE participated in these activities as a way to exonerate himself in the investigation. Based on the aforementioned investigative conclusions, it is your affiant’s belief that DRAKE could have used similar techniques and methods to produce the threatening letters described in the preceding paragraphs. It is your affiant’s belief that the Antifa symbols, as well as the content of the letters, may have been used to disguise the writer’s true identity and add legitimacy to the threats. 36. On February 3, 2018, an email was sent from email address csaduck@yahoo.com to JORDAN RYAN (RYAN), a high school student in Virginia. RYAN confirmed that the email was sent to him by DRAKE. DRAKE and RYAN worked together as volunteers at the Sky Meadows State Park in Virginia. While working together on February 3, 2018, RYAN and 28 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 29 of 37 Pageid#: 32 DRAKE discussed the Civil War reenactment hobby and how participation in it was declining. DRAKE mentioned to RYAN that he had some “funny” articles on his cellular telephone regarding the 2017 Cedar Creek Battle reenactment. DRAKE claimed the articles were found on the internet. The articles were captured as photographs on DRAKE’s cellular telephone, and he sent the email to RYAN with the photographs attached to the body of the email. The photographs appeared to be taken of three different newspaper clippings. The first newspaper clipping included an actual letter to the editor of the Winchester Star newspaper that was printed in the Winchester Star on October 26, 2017. The letter to the editor described the events surrounding the Cedar Creek Battle reenactment in October 2017. The other two articles included in the email appeared to be completely fabricated by erasing actual newspaper articles and replacing them with fake articles. These articles described events at the 2017 Cedar Creek Battlefield reenactment that never occurred. The fabricated events included multiple deaths and injuries from pipe bomb explosions and sniper fire. Investigators have been unable to locate these fabricated articles on the Internet. Your affiant has reviewed the list of media members who were present at the 2017 Cedar Creek Battle reenactment, and the Associated Press (AP) writer and photographer identified on these fabricated articles were not included on the media list. 37. Witness interviews and online research by investigators revealed that DRAKE utilizes the user name “csaduck” for online accounts with Reddit.com and eBay.com. A review of the online posts of “csaduck” on Reddit.com, and the eBay.com account of “csaduck,” revealed that DRAKE is a model rocket enthusiast. The threatening letter received by the Winchester Star newspaper on June 29, 2018, included a reference to rocket launch wire on the 29 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 30 of 37 Pageid#: 33 pipe bomb found at Cedar Creek in 2017. The drawings created by DRAKE while he was in jail in Ohio in 2004 also included a rocket launch igniter. 38. A review of the online posts of “csaduck” on Reddit.com also revealed an interest in black powder weapons and the creation of black powder loads for weapons used at Civil War reenactments. In these posts, “csaduck” described his method of using a software program to create labels for these black powder loads that are accurate for the Civil War period. This post, believed to be made in 2018, suggests that DRAKE remains interested in participating in other Civil War battle reenactments. His lack of participation in the Cedar Creek Battlefield reenactment, however, suggests that he may have a negative attitude toward the event, possibly due to the incident with MOWBRAY in 2014. Witnesses familiar with the Cedar Creek reenactment have stated that although DRAKE worked as a volunteer at the 2016 and 2017 reenactments, he has not participated as a battle reenactor since 2014. 39. Additional online posts by “csaduck” on Reddit.com, revealed that DRAKE is interested in becoming involved with World War II reenactments. In approximately October 2018, DRAKE posted the statement, “Looking to get into WW2 since Civil War is dying out.” 40. Additional online reviews of Reddit.com posts by “csaduck” revealed that in approximately December 2017, DRAKE posted the statement, “If anyone looks online for the Gettysburg Remembrance Parade on YouTube, the participants in the Parade look as old as the original Civil War Veterans!” Based on this statement, your affiant believes DRAKE has viewed video footage of the 2017 parade and was aware of the substantial rain that fell during the event. The rain at the event was mentioned in the threatening letter received by the CCBF on October 10, 2018, and the letter received by the office of the Gettysburg mayor on November 2, 2018. 30 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 31 of 37 Pageid#: 34 41. In November 2018, Sprint provided records indicating it was the service provider for cellular telephone number 540-247-5799 from the date the account was activated, October 9, 2015, until the date the account was cancelled, October 22, 2018. In January 2019, AT&T Wireless provided records indicating it became the service provider for cellular telephone number 540-247-5799 on October 22, 2018. Based on witness interviews, DRAKE left a note on the outside door of the CCBF visitor’s center in July or August 2018. The note was addressed to “Pat,” and requested information regarding the status of the visitor’s center hours. DRAKE included telephone number 540-247-5799 on the note as his contact information. KEHOE also provided your affiant with the same telephone number for DRAKE, indicating it was the contact telephone number CCBF had on file for him. Call data records previously provided by Sprint indicated telephone number 540-247-5799 was in frequent contact with a telephone number utilized by DARRELL GRIFFITHS, noted previously to be a close friend of DRAKE. Call data records provided by AT&T Wireless indicated similar telephonic contacts after October 22, 2018, suggesting DRAKE continued to use the same telephone number when he changed cellular service providers. Based on this information, it is your affiant’s belief that DRAKE has utilized cellular telephone number 540-247-5799 from October 9, 2015, through December 18, 2018. 42. As described previously, the two most recent threat letters were postmarked on October 31, 2018, and December 4, 2018, respectively. Both letters were postmarked at the USPS’s Harrisburg, Pennsylvania, processing center. Based on the postmark locations and discussions with United States Postal Inspectors, your affiant is aware that the letters were likely mailed from locations along the Interstate 81 corridor in West Virginia, Maryland, or Pennsylvania, and likely within one or two days of the respective postmark dates. The ability to determine whether DRAKE’s cellular telephone was located in the geographic area covered by 31 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 32 of 37 Pageid#: 35 the USPS’s Harrisburg, Pennsylvania, processing center, during the approximate times the letters were mailed, could be very beneficial to the investigation. 43. In my training and experience, I have learned that AT&T Wireless is a company that provides cellular telephone access to the general public. I also know that providers of cellular telephone service have technical capabilities that allow them to collect and generate information about the locations of the cellular telephones to which they provide service, including cell-site data, also known as “tower/face information” or “cell tower/sector records.” Cell-site data identifies the “cell towers” (i.e., antenna towers covering specific geographic areas) that received a radio signal from the cellular telephone and, in some cases, the “sector” (i.e., faces of the towers) to which the telephone connected. These towers are often a half-mile or more apart, even in urban areas, and can be 10 or more miles apart in rural areas. Furthermore, the tower closest to a wireless device does not necessarily serve every call made to or from that device. Accordingly, cell-site data provides an approximate location of the cellular telephone but is typically less precise than other types of location information, such as E-911 Phase II data or Global Positioning Device (“GPS”) data. 44. Based on my training and experience, I know that AT&T Wireless can collect cell-site data about the SUBJECT PHONE. I also know that wireless providers such as AT&T Wireless typically collect and retain cell-site data pertaining to cellular phones to which they provide service in their normal course of business in order to use this information for various business-related purposes. 45. Based on my training and experience, I know that wireless providers such as AT&T Wireless typically collect and retain information about their subscribers in their normal course of business. This information can include basic personal information about the 32 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 33 of 37 Pageid#: 36 subscriber, such as name and address, and the method(s) of payment (such as credit card account number) provided by the subscriber to pay for wireless telephone service. I also know that wireless providers such as AT&T Wireless typically collect and retain information about their subscribers’ use of the wireless service, such as records about calls or other communications sent or received by a particular phone and other transactional records, in their normal course of business. In my training and experience, this information may constitute evidence of the crimes under investigation because the information can be used to identify the SUBJECT PHONE’s user or users and may assist in the identification of co-conspirators and/or victims. AUTHORIZATION REQUEST 46. Based on the foregoing, I request that the Court issue the proposed search warrant, pursuant to 18 U.S.C. § 2703(c) and Federal Rule of Criminal Procedure 41. 47. I further request that the Court direct AT&T Wireless to disclose to the government any information described in Section I of Attachment B that is within its possession, custody, or control. Because the warrant will be served on AT&T Wireless, who will then compile the requested records at a time convenient to it, reasonable cause exists to permit the execution of the requested warrant at any time in the day or night. 48. I further request that the Court order that all papers in support of this application, including the affidavit and search warrant, be sealed for twelve months from the date the proposed search warrant is issued. These documents discuss an ongoing criminal investigation that is neither public nor known to all of the targets of the investigation. Accordingly, there is good cause to seal these documents because their premature disclosure may seriously jeopardize that investigation, including by giving targets an opportunity to destroy or tamper with evidence, change patterns of behavior, notify confederates, and flee from prosecution. 33 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 34 of 37 Pageid#: 37 Respectfully submitted, s/Steven W. Duke Steven W. Duke Special Agent Federal Bureau of Investigation Received by reliable electronic means and sworn and attested to by telephone on February 8,2019. Subscribed and sworn to before me on_____________________, 2019 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx _________________________________________ ___________________________ _ _____ ____ ____ ___________ UNITED MAGISTRATE NITED ED E D STATES MAGISTRA RATE RA TE JUDGE 34 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 35 of 37 Pageid#: 38 ATTACHMENT A Property to Be Searched This warrant applies to records and information associated with the cellular telephone assigned call number 540-247-5799, with International Mobile Subscriber Identity 310410144949965, (“the Account”), that are stored at premises controlled by AT&T Wireless (“the Provider”), headquartered at 1025 Lenox Park Boulevard NE, Brookhaven, Georgia 30319. Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 36 of 37 Pageid#: 39 ATTACHMENT B Particular Things to be Seized I. Information to be Disclosed by the Provider To the extent that the information described in Attachment A is within the possession, custody, or control of the Provider, including any information that has been deleted but is still available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the Provider is required to disclose to the government the following information pertaining to the Account listed in Attachment A for the time period 10/22/2018 through xxxxxxxx 12/31/2018: 12/11/2018: a. The following information about the customers or subscribers of the Account: i. Names (including subscriber names, user names, and screen names); ii. Addresses (including mailing addresses, residential addresses, business addresses, and e-mail addresses); iii. Local and long distance telephone connection records; iv. Records of session times and durations, and the temporarily assigned network addresses (such as Internet Protocol (“IP”) addresses) associated with those sessions; v. Length of service (including start date) and types of service utilized; vi. Telephone or instrument numbers (including MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”); Mobile Identification Number (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number (“MSISDN”); International Mobile Subscriber Identity Identifiers (“IMSI”), or International Mobile Equipment Identities (“IMEI”); vii. Other subscriber numbers or identities (including the registration Internet Protocol (“IP”) address); and 2 Case 5:19-mj-00009-JCH Document 3-1 Filed 02/08/19 Page 37 of 37 Pageid#: 40 viii. Means and source of payment for such service (including any credit card or bank account number) and billing records. b. All records and other information (not including the contents of communications) relating to wire and electronic communications sent or received by the Account, including: i. The date and time of the communication, the method of the communication, and the source and destination of the communication (such as the source and destination telephone numbers (call detail records), email addresses, and IP addresses); and ii. Information regarding the cell tower and antenna face (also known as “sectors”) through which the communications were sent and received, as well as per-call measurement data. II. Information to be Seized by the Government All information described above in Section I that constitutes evidence, fruits, contraband, and instrumentalities of violations of 18 U.S.C. § 876(c) and/or 18 U.S.C. § 2332a(a) involving GERALD DRAKE during the period 10/22/2018 through 12/31/2018. Law enforcement personnel (who may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate the things particularly described in this Warrant. 3