Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 1 of 21 AO 93 (Rev. 11/13) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia In the Matter of the Search of (Briefly describe the property to be searched or identify the person by name and address) INFORMATION ASSOCIATED WITH THE TWITTER ACCOUNTS ) ) ) ) ) ) Case No. 17-MJ-567 SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement officer An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Northern District of California (identify the person or describe the property to be searched and give its location): See Attachment A I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (identify the person or describe the property to be seized): See Attachment B YOU ARE COMMANDED to execute this warrant on or before August 21, 2017 (not to exceed 14 days) ~ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell (United States Magistrate Judge) 0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) 0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of Date and time issued: City and state: Washington, D.C. Hon. Beryl A. HoweJL,,-Chief U.S. District Judge · Printed name and title Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 2 of 21 ATTACHMENT A Property to Be Searched This warrant applies to information associated with the Twitter profile with usemarnes: that is stored at premises owned, maintained, controlled, or operated by Twitter, a company headquartered in San Francisco, California. Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 3 of 21 ATTACHMENT B Particular Things to be Seized I. Information to be disclosed by Twitter To the extent that the information described in Attachment A is within the possession, custody, or control of Twitter, including any messages, records, files, logs, or information that have been deleted but are still available to Twitter, or have been preserved pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following information to the government for each account listed in Attachment A: a. All identity and contact information, including full name, e-mail address, physical address (including city, state, and zip code), date of birth, gender, hometown, occupation, and other personal identifiers; b. All past and current usernames, account passwords, and names associated with the account; c. The dates and times at which the account and profile were created, and the Internet Protocol ("IP") address at the time of sign-up; d. All IP logs and other documents showing the IP address, date, and time of each login to the account; e. All data and information associated with the profile page, including photographs, "bios," and profile backgrounds and themes; f. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account, and all photographs or images included in those Tweets and Direct Messages; Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 4 of 21 g. All information from the "Connect" tab for the account, including all lists of Twitter users who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets that include the usemame associated with the account (i.e., "mentions" or "replies"); h. All photographs and images in the user gallery for the account; 1. All location data associated with the account, including all information collected by the "Tweet With Location" service; J. All information about the account's use of Twitter's link service, including all longer website links that were shortened by the service, all resulting shortened links, and all information about the number of times that a link posted by the account was clicked; k. All data and information that has been deleted by the user; I. A list of all of the people that the user follows on Twitter and all people who are following the user (i.e., the user's "following" list and "followers" list); m. A list of all users that the account has "unfollowed" or blocked; n. All "lists" created by the account; o. All information on the "Who to Follow" list for the account; p. All privacy and account settings; q. All records of Twitter searches performed by the account, including all past searches saved by the account; r. All information about connections between the account and third-party websites and applications; 2 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 5 of 21 s. All records pertaining to communications between Twitter and any person regarding the user or the user's Twitter account, including contacts with support services, and all records of actions taken, including suspensions of the account. 3 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 6 of 21 II. Information to be seized by the government All information described above in Section I that constitutes fruits, evidence, and instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in connection with computers) involving since March 1, 2016 including, for each user ID identified on Attachment A, information pertaining to the following matters: a. Any correspondence regarding hacked emails or other data from the Democratic National Committee (DNC) and the email belonging to John Podesta ("the email hack"); b. Any communications between the Target Accounts and individuals associated with the email hack; c. Any communications indicating any advance knowledge or direction, planning, or control of the email hack; d. Evidence indicating how and when the Twitter account was accessed or used, to determine the chronological and geographic context of account access, use, and events relating to the crime under investigation and to the Twitter account owner; e. Evidence indicating the Twitt~r account owner's state of mind as it relates to the crime under investigation; f. The identity of the person(s) who created or used the user ID, including records that help reveal the whereabouts of such person(s). g. The identity of the person(s) who communicated with the accounts about matters related to 18 U.S.C. § 1030, including records that help reveal their whereabouts. 4 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 7 of 21 AO 106 (Rev. 04/10) Application fora Search Warrant UNITED STATES DISTRICT COURT FILED for the District of Columbia In the Matter of the Search of (Briefly describe the property to be searched or identify the person by name and address) INFORMATION ASSOCIATED WITH THE TWIITER ACCOUNTS ) ) ) ) ) ) AUG -7 2017 Clerk, U.S. District and Bankruptcy Courts Case No. 17-MJ-567 APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location): See Attachment A. located in the - - Northern California - - - - - District of - - - - - - - - - - - , there is now concealed (identify the person or describe the property to be seized): See Attachment B. This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more): ~ evidence of a crime; ~ contraband, fruits of crime, or other items illegally possessed; (y{ property designed for use, intended for use, or used in committing a crime; 0 a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section 18 U.S.C. § 1030 Offense Description Fraud and Related Activities in Connection with Computers The application is based on these facts: See attached Affidavit. 'J Continued on the attached sheet. 0 Delayed notice of_.__ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. Reviewed by AUSA/SAUSA: IAaron Zelinsky (ASC) ~ p p U r o n t ' , ,ignatu,e ] Mickey Robinson, Special Agent, FBI Printed name and title Sworn to before me and signed in my presence. Date: 08/07/2017 Judge's signature City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge Printed name and title Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 8 of 21 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH THE FILED AUG -7 2017 Clerk, U.S. District and Case No. 17-MJ-569 B8nkruptcy Courts Filed Under Seal AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, Mickey Robinson, being first duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application for a search warrant for information associated with the Twitter Accounts 1") and (hereafter "Target Account (hereafter "Target Account 2") and that is stored at premises owned, maintained, controlled, or operated by Twitter, a social-networking company headquartered in San Francisco, CA. The information to be disclosed by Twitter and searched by the Government is described in the following paragraphs and in Attachments A and B. This affidavit is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and 2703(c)(1 )(A). 2. I am a Special Agent with Federal Bureau oflnvestigation ("FBI") assigned to FBI Headquarters working directly with the Special Counsel's Office. I have been a Special Agent with the FBI since 2012. Since then, I have conducted national security investigations of foreign intelligence services, espionage, and counter proliferation matters. I have training and experience related to foreign intelligence services national security investigations, as well as federal financial crimes. I have conducted and participated in various investigations involving multiple threat countries as well as national security threats and applicable criminal violations. Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 9 of 21 3. The facts in this affidavit come from my personal observations, my training and experience, and information obtained from other agents and witnesses. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. 4. Based on my training and experience and the facts as set forth in this affidavit, there is probable cause to believe that certain individuals with whom Target Account 1 was in communication have committed violations of 18 U.S.C.§ 1030 (fraud and related activities in connection with computers), and that communications related to these violations will be found on the Target Accounts. There is therefore probable cause to search the information described in Attachment A for evidence of these crimes and contraband or fruits of these crimes, as described in Attachment B. JURISDICTION 5. This Court has jurisdiction to issue the requested warrant because it is "a court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C. § 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below in paragraphs 6, 20, and 28. PROBABLE CAUSE A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and Wikileaks to Disseminate Hacked Information. 6. According to the public and unclassified intelligence report conducted by the United States Intelligence Community, the Russian military intelligence (General Staff Main 2 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 10 of 21 Intelligence Directorate or "GRU") probably began cyber operations aimed at the U.S. election by March 2016. The GRU operations resulted in the compromise of the personal e-mail accounts of Democratic National Committee (DNC) and other Democratic Party officials and political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC. The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003. 7. The public and unclassified intelligence report assessed that the GRU used a Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLeaks to release U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory statements and false claims about his likely Russian identity throughout the election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists. B. Roger Stone's Interactions with Guccifer 2.0 and Wikileaks. 8. Roger Stone is a self-employed political strategist/consultant and has been actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no official relationship with the Campaign thereafter, Stone maintained his support for Trump and continued to make media appearances in support of Trump's presidential campaign. 9. As discussed further below, Stone made a number of public references to Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via Twitter with Guccifer 2.0. 10. On June 14, 2016, news reports indicated that the computer systems of the DNC had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 3 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 11 of 21 hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 21, 2016 release of hacked documents. 11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from the DNC. 12. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, "Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision. He went to Wikileaks with the DNC files and the rest is history. Now the world would see for themselves how the Democrats had rigged the game." 13. On August 8, 2016, Stone addressed the Southwest Broward Republican Organization. During his speech, he was asked about a statement by Wikileaks founder Julian Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the October surprise, what would be your forecast on that given what Julian Assange has intimated he's going to do?" Stone responded: "Well, it could be a number of things. I actually have communicated with Assange. I believe the next tranche of his documents pertain to the Clinton Foundation but there's no telling what the October surprise may be." A few days later, Stone clarified that while he was not personally in touch with Assange, he had a close friend who served as an intermediary. 4 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 12 of 21 14. [Target On August 12, 2016, Guccifer 2.0 publicly tweeted: Account 1] thanks that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone numbers and email addresses from the files of the Democratic Congressional Campaign Committee (DCCC). 15. On August 13, 2016, Stone posted a tweet using Target Account 1 calling Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's Twitter account was reinstated. 16. On August 14, 2016, Stone sent a private message on Twitter using Target Account 1 to Guccifer 2.0, stating he was "delighted" to see the user's Twitter handle reinstated after having been suspended. 1 17. On August 15, 2016, Guccifer 2.0 replied to Stone on Target Account 1, stating: "wow. thank u for writing back, and thank u for an article about me!!! did you find anything interesting in the docs I posted." 18. On August 16, 2016, Stone sent a private message using Target Account 1 asking Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016 presidential elections. 19. On August 17, 2016, Guccifer 2.0 publicly tweeted, [Target Account 1] paying you back." Guccifer also sent a private message to Target Account 1 stating "i 'm pleased to say u r great man. please tell me if I can help u anyhow. it would be a great pleasure to me." 1 These messages were release by Stone on March I 0, 2017, as described further below in paragraph 28. 5 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 13 of 21 20. On August 18, 2016, Paul Manafort, Stone's longtime friend and associate, resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S. policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John Podesta), the Podesta Group. At the same time, press reports indicated that investigators were examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and that investigators were also examining the Podesta Group. 21. On August 21, 2016, using Target Account 1, Stone directed a tweet at John Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day, Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange], the public [could] expect to see much more from the exiled whistleblower in the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes." 22. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio that he expected Wikileaks to "drop a payload of new documents on a weekly basis fairly soon. And that of course will answer the question of exactly what was erased on that email server." 23. On Saturday, October 1, 2016, using Target Account 1, Stone Tweeted, "Wednesday@HillaryClinton is done. #Wikileaks." 24. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez tweeted regarding an announcement Julian Assange had scheduled for the next day from the 6 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 14 of 21 balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part of Wikileaks' 1O,..year anniversary celebration - Stone told Infowars that his intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone · used Target Account 1 to tweet: "Payload coming. #Lockthemup." 25. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post published an article containing a recorded conversation from a 2005 Access Hollywood shoot in which Mr. Trump had made a series oflewd remarks. 26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading "RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link to approximately 2,050 emails that had been hacked from John Podesta's personal email account. 27. Wikileaks continued to release John Podesta's hacked emails throughout October 10-14, 2016. On October 12, 2016, John Podesta- referring back to Stone's August 21, 2016 CSPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] and the Trump campaign had advanced warning about what Assange was going to do. I think there's at least a reasonable belief that [Assange] may have passed this information on to [Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with Assange, we have a mutual friend who's traveled to London several times, and everything I know is through that channel of communications. I'm not implying I have any influence with him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were deleted. I hear that through my emissary." 7 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 15 of 21 28. On March 10, 2017, Stone spoke with The Washington Times and acknowledged he had been in contact with Guccifer 2.0 using Target Account 1. Stone publicly stated that he had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's private message system to do so. Stone provided a copy of the private messages to The Washington Times. 29. On or about May 12, 2017, United States Magistrate Judge Michael S. Nachmanoff of the Eastern District of Virginia issued an Order pursuant to 18 U.S.C. § 2705(b) requiring Twitter to disclose certain records, including subscriber and user activity information, associated with the Target Accounts described above (Case number 17-GJ-0835). On or about May 23, 2017, Twitter provided the FBI with records that confirmed that the Target Accounts are registered to Stone. 30. As described above, it appears that Stone has used the private messaging function of Target Account 1 to communicate with Guccifer 2.0. I know in my training and experience that individuals with multiple accounts on the same service, such as Stone has on Twitter, often use both accounts for their communications. A review of Target Account 2's publicly available information indicates that it has been in use since November 2015. Stone also appears to comment using Target Account 2 frequently. Stone also often publicly "Retweets" messages using Target Account 2 which originated from Target Account 1. Therefore there is probable cause to believe that messages pertaining to the investigation, including messages to individuals regarding the hack, as well as communications with Guccifer 2.0, will be found on Target Account 1 and Target Account 2. INFORMATION CONCERNING TWITTER 8 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 16 of 21 31. Twitter owns and operates a free-access social-networking website of the same name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own profile pages, which can include a short biography, a photo of themselves, and location information. Twitter also permits users to create and read 140-character messages called "Tweets," and to restrict their "Tweets" to individuals whom they approve. These features are described in more detail below. 32. Upon creating a Twitter account, a Twitter user must create a unique Twitter username and an account password, and the user may also select a different name of 20 characters or fewer to identify his or her Twitter account. The Twitter user may also change this username, password, and name without having to open a new Twitter account. 33. Twitter asks users to provide basic identity and contact information, either during the registration process or thereafter. This information may include the user's full name, e-mail addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, occupation, and other personal identifiers. For each user, Twitter may retain information about the date and time at which the user's profile was created, the date and time at which the account was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every device that connects to the Internet must use an IP address, IP address information can help to identify which computers or other devices were used to access a given Twitter account. 34. A Twitter user can post a personal photograph or image (also known as an "avatar") to his or her profile, and can also change the profile background or theme for his or her account page. In addition, Twitter users can post "bios" of 160 characters or fewer to their profile pages. 9 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 17 of 21 35. Twitter also keeps IP logs for each user. These logs contain information about the · user's logins to Twitter including, for each access, the IP address assigned to the user and the date stamp at the time the user accessed his or her profile. 36. As discussed above, Twitter users can use their Twitter accounts to post "Tweets" of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was posted to Twitter. TwiUer users can also "favorite," "retweet," or reply to the Tweets of other users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each account, Twitter provides the user with a list of other users who have "favorited" or "retweeted" the user's own Tweets, as well as a list of all Tweets that include the user's username (i.e., a list of all "mentions" and "replies" for that username ). 37. Twitter users can include photographs or images in their Tweets. Each Twitter account also is provided a user gallery that includes images that the user has shared on Twitter, including images uploaded by other services. 38. Twitter users can also opt to include location data in their Tweets, which will reveal the users' locations at the time they post each Tweet. This "Tweet With Location" function is off by default, so Twitter users must opt in to the service. In addition, Twitter users may delete their past location data. 39. When Twitter users want to post a Tweet that includes a link to a website, they can use Twitter's link service, which converts the longer website link into a shortened link that begins with http://t.co. This link service measures how many times a link has been clicked. 40. A Twitter user can "follow" other Twitter users, which means subscribing to those users' Tweets and site updates. Each user profile page includes a list of the people who are 10 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 18 of 21 following that user (i.e., the user's "followers" list) and a list of people whom that user follows (i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously followed, and they can also adjust the privacy settings for their profile so that their Tweets are visible only to the people whom they approve, rather than to the public (which is the default setting). A Twitter user can also group other Twitter users into "lists" that display on the right side of the user's home page on Twitter. Twitter also provides users with a list of "Who to Follow," which includes a few recommendations of Twitter accounts that the user may find interesting, based on the types of accounts that the user is already following and who those people follow. 41. In addition to posting Tweets, a Twitter user can also send DMs to one of his or her followers. These messages are typically visible only to the sender and the recipient, and both the sender and the recipient have the power to delete the message from the inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs are stored on Twitter' s database. 42. Twitter users can configure the settings for their Twitter accounts in numerous ways. For example, a Twitter user can configure his or her Twitter account to send updates to the user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates will not be sent to the user's phone. 43. Twitter includes a search function that enables its users to search all public Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 25 past searches. 11 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 19 of 21 44. Twitter users can connect their Twitter accounts to third-party websites and applications, which may grant these websites and applications access to the users' public Twitter profiles. 45. If a Twitter user does not want to interact with another user on Twitter, the first user can "block" the second user from following his or her account. 46. In some cases, Twitter users may communicate directly with Twitter about issues relating to their account, such as technical problems or complaints. Social-networking providers like Twitter typically retain records about such communications, including records of contacts between the user and the provider's support services, a:s well as records of any actions taken by the provider or user as a result of the communications. Twitter may also suspend a particular user for breaching Twitter' s terms of service, during which time the Twitter user will be prevented from using Twitter' s services. 47. As explained herein, information stored in connection with a Twitter account may provide crucial evidence of the "who, what, why, when; where, and how" of the criminal conduct under investigation, thus enabling the United States to establish and prove each element or alternatively, to exclude the innocent from further suspicion. In my training and experience, a Twitter user's account information, IP log, stored electronic communications, and other data retained by Twitter, can indicate who has used or controlled the Twitter account. This "user attribution" evidence is analogous to the search for "indicia of occupancy" while executing a search warrant at a residence. For example, profile contact information, communications, "tweets" (status updates) and "tweeted"photos (and the data associated with the foregoing, such as date and time) may be evidence of who used or controlled the Twitter account at a relevant time. Further, Twitter account activity can show how and when the account was accessed or 12 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 20 of 21 used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from which users access their accounts along with the time and date. By determining the physical location associated with the logged IP addresses, investigators can understand the chronological and geographic context of the account access and use relating to the crime under investigation. Such information allows investigators to understand the geographic and chronological context of Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter builds geo-location into some of its services. If enabled by the user, physical location is automatically added to "tweeted" communications. This geographic and timeline information may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account activity may provide relevant insight into the Twitter account owner's state of mind as it relates to the offense under investigation. For example, information on the Twitter account may indicate the owner's motive and intent to commit a crime (e.g., information indicating a criminal plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from law enforcement). 48. Therefore, the computers of Twitter are likely to contain all the material described above, including stored electronic communications and information concerning subscribers and their use of Twitter, such as account access information, transaction information, and other account information. INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 49. I anticipate executing this warrant under the Electronic Communications Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant to require Twitter to disclose to the government copies of the records and other information (including the content of communications) associated with the accounts in Attachment A and 13 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 21 of 21 particularly described in Section I of Attachment B. Upon receipt of the information described in Section I of Attachment B, government-authorized persons will review that information to locate the items described in Section II of Attachment B. CONCLUSION 50. Based on the forgoing, I request that the Court issue the proposed search warrant. 51. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the service or execution of this warrant. REQUEST FOR SEALING 52. I further request that the Court order that all papers in support of this application, including the affidavit and search warrant, be sealed until further order of the Court. These documents discuss an ongoing criminal investigation, the full nature and extent of which is not known to all of the targets of the investigation. Accordingly, there is good cause to seal these documents because their premature disclosure may seriously jeopardize that investigation. Respectfully submitted, Special Agent Federal Bureau of Investigation -z-~ Subscribed and sworn to before me on this _1_ day of August, 2017. Th~i11:t~ Chief United States District Judge 14