Case Document 1-1 Filed 07/17/19 Page 1 of 16 Page D# 45 i AD 106 (Rev. 041' 10) Application for a Search Warrant UNITED STATES DISTRICT COURT [3 are JUL more i ll Eastern District of Virginia l DEMRIC RIQHrao?r-ng URLOIJRT an In the Matter of the Search of (Brie?y describe the program to be searched or idenryj; the person by name and address) Information Associated with Google Accounts of OkelloChatrie55@gmail.com and Google Account ID: 365520319283 Case No. 3:19am 20"] APPLICATION son A SEARCH WARRANT I, a federal law enforcement of?cer or an attorney for the. government, request a search warrant and state under penalty of perjury that I have reason to believe that on the followmg person or property (fdem?r?) the person or describe the proper? to be searched and give its location): See Attachment A. This court has authority to issue this Warrant under Title 18. United States Code, Sections (A) and located in the . Northern District of California there is now concealed ?denhj?r the person or describe the property to be seized): See Attachment B. The basis for the search under Fed. R, Grim. P. 41(c) is (check one or more): Efevidence of a crime; [if contraband, fruits of crime, or other items illegally possessed; [if properly designed for use, intended for use, or used in committing a crime; CI a person to be arrested or a person who is unlaw?dly restrained. The search is related to a violation of: Code Section Offense Description Armed Bank Robbery 1B U.S.C. 2113 The application is based on these facts: See Af?davit Continued on the attached sheet. [3 Delayed notice of days (give exact ending date if more than 30 is requested under 18 U.S.C. 3103s, the basis of which is set forth on the attach et. Reviewed by AUSAISAUSA: /Kw??mrs signature IKenneth Fl. Simon, Jr. - Joshua Hylton, FBI. TFO A I I - Printed Home and trim Swom to before me and signed in my presence. [St A David J. Novak United States to Judge Judge '3 signature Date: #Jul'j' City and state: Richmond. Virginia Honorable David J. Novak. U.S. Magistrate Judge Printed name and fitfe Case Document 1-1 Filed 07/17/19 Page 2 of 16 Page D# 46 IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA Richmond Division IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH GOOGLE ACCOUNTS OF OKELLO CHATRJE, with user accounts: 3,193 2 0 7 OkellochatriaSSt?Igmailmom and Goo gle Account ID: 365 5208 I 92 83 (TARGET ACCOUNT) THAT IS STORED AT PREMISES CONTROLLED BY GOOGLE, INC. AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, I oshua P. Iiylton, being ?rst duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this af?davit in support of an application for a search warrant for information associated with four Google user Okellochatrie55@gmail.com and Google Account ID: 365520819283 (TARGET ACCOUNT) which is stored at premises owned, maintained, controlled, or operated by Google, Inc. (?Google?), is an internet based social networking company headquartered in Menlo Park, California. The information to be searched is described in the following paragraphs and in Attachment A. This affidavit is made in support of an application for a search warrant under 18 U.S.C. 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Google to disclose to the government records and other information in its possession, pertaining to the subscriber or customer associated with the user ID. 2. Your Af?ant is a law enforcement of?cer within the meaning of Title 18, United States Code, Section 2510(7), that is, an of?cer of the United States who is empowered by law to Case Document 1-1 Filed 07/17/19 Page 3 of 16 Page D# 47 conduct investigations of, and to make arrests for, offenses enumerated in Title 18, United States Code, Section 2516. 3. Your Af?ant has over seven years of law enforcement experience stemming from employment as a police officer with the Chester?eld County Police Department. Currently, I am a duly appointed Task Force Officer with the Federal Bureau of Investigation (FBI) and have been so since December 2016. I am assigned to the Richmond Central Virginia Violent Crimes Task Force and my duties include investigating bank robberies, armored ear robberies, extraterritorial offenses, kidnappings, armed carj ackings, and theft of government property. I have investigated numerous criminal violations and have obtained arrest and search warrants. I have personally participated in the investigation set forth below. The crimes I investigate are violent, usually involving two or more individuals, and I am familiar with the methods violent offenders use to conduct their illegal activities, to include their communication methods. 4. The facts in this affidavit come from my personal observations, my training and experience, and information obtained from other agents and witnesses. This af?davit is intended to show merely that there is suf?cient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. 5. Based upon my training and experience and the facts as set forth in this af?davit, I submit there is probable cause to believe that violations of 18 U.S.C ?2113 have been committed by OKELLO CHATRIE. I submit there is also probable cause to search the information described in Attachment A for evidence of these crimes, as described in Attachment B. Case Document 1-1 Filed 07/17/19 Page 4 of 16 Page D# 48 PROBABLE CAUSE 6. The United States through the is conducting a criminal investigation of OKELLO CHATRIE in relation to an armed bank robbery, in violation of Title 18 U.S.C. 21-13. 7. On May 20, 2019, at approximately 4:52 prn. eastern standard time, the Call Federal Credit Union located at - Call Federal Drive, Midlothian, VA 23112 was robbed of $195,000 by an armed gimman. At the time, nix victims?a mix of customers and employees? were inside the Credit Union. The Credit Union is National Credit Union Administration (N CUA) insured, NCUA Number: 15209. 8. The unknown subject entered the Credit Union, approached victim?teller, .W., and presented a note demanding $100,000 and threatening the tdctim?teller?s life: ?I've been watching you for sometime now. I got your family as hostage and I know where you live, If you or your coworker alert the cops or anyone your family and you are going to be hurt. I got my boys on the lookout out side. The ?rst cop car they sealant going to start hurting everyone in sight, hand over all the cash, I need at least 100k and nobody will get hurt and your family will be set free. Think smartly everyone safety is depending and you and your coworkers action so I hope they don't try nothing stupid.? 9. A?cr reading this note, J.W. told the subject that she did not have access to that amount of money. The subj set then produced a silver and black ?rearm, directing the victim?teller and the then?unaware customers and employees at gunpoint to move to the center of the lobby and get on the ?oor. These six victims were then made to walk behind the teller counter to the area where the bank?s safe was located. Case Document 1-1 Filed 07/17/19 Page 5 of 16 Page D# 49 10'. Once near the safe, the subject forced everyone to their knees at gunpoint and demanded that the bank manager open the safe. After the safe was opened, the subject provided the manager with a black and red bookbag in which to place the currency. After acquiring $195,000.00 in United States currency belonging to Call Federal Credit Union, the subject ?ed the area on foot. 1 1. After the armed robber left the bank, law enforcement responded. Upon reviewing video surveillance captured inside and outside the bank, law enforcement discovered the following: (1) prior to the robbery, the subject came from behind the southwest corner of an adjacent building, namely Journey Christian Church, at approximately 4:48 pm; (2) the subject approached the front entrance of the Credit Union holding a cell phone to the side of his face with his right hand, as if speaking with another party; (3) upon reaching the front entrance of the Credit Union, the subject stood outside for several minutes before entering the bank at approximately 4:52 pm. ,1 (3) the subject robbed the Credit Union using a silver and black ?rearm, departing at approximately 4:56 pm; and (4) when exiting, the subject ran towards the southwest corner of Journey Christian Church at approximately 4:57 pm. 12. On May 20, 2019, law enforcement interviewed the six victims of the armed robbery as well as a witness from Journey Christian Church. The victim-teller described the subject as an approximately 27-33uyear-old black male with a height of 6?00?, weight of 170 lbs, and thin! slender build. She went on to describe him as having short, braided hair, a scruffy beard, and a Jamaican accent. Five of the six witnesses recall a strong Jamaican accent. When asked about his clothing, the victiins stated that the subj cat was wearing a gray bucket-style hat, re?ective sunglasses, a gray long-sleeved shirt, a yellow and orange reflective work vest, blue jeans, black Case Document 1-1 Filed 07/17/19 Page 6 of 16 Page D# 50 tennis shoes, and a black and red backpack. The ?rearm brandished during the robbery was silver and black. 13. In addition to speaking with the victim-witnesses, your Af?ant also interviewed Journey Christian Church?s - -. recalled his encounter with a suspicious individual on May 20, 2019, at approximately 4:30 to 4:40 pm. - adviSed that while exiting through a back door of Journey Church that is located on the southwestern corner of the building, he encountered a dark blue Buick sedan parked in the ?re lane approximately four (4) feet from his vehicle. - further described the Buick as a ?newer car, somewhere between 2010-2015 model, with no speci?c identi?ers to note (decals, rims, spoiler, etc)? - recalled seeing one occupant in the dark blue Buick sedan?a black male wearing re?ective sunglasses, reclined in the driver?s seat. 14. On June 14, 2019, Your Af?ant applied for and obtained a search warrant from a magistrate judge with the Chester?eld County-Circuit Court. The search warrant authorized the search of records possessed by Google, hid, speci?cally information concerning any Google Account within a certain geographical area (delineated by latitude and longitude) of the Credit Union and surrounding area between 4:20 pm. and 5:20 p.111. The geographical area focused upon the Credit Union and Journey Christian Church. 15. Based upon Google?s return of anonymized information, your Af?ant discovered a Google Account that: was near the southwestern corner of Journey Christian Church prior to the robbery at approximately 4:30 to 4:40 p.m.?the time period - recalled encountering a suspicious individual wearing re?ective glasses in a blue Buick sedan; (2) was near the southwestern corner of Journey Christian Church prior to the robbery at approximately 4:48 pm; (3) was inside the Credit Union during the time of the robbery; and (4) immediately left the area 5 Case Document 1-1 Filed 07/17/19 Page 7 of 16 Page D# 51 following the robbery, leaving from the southwestern corner of Journey Christian Church. This same Google Account traveled'directly from the area of the bank to- Mason Dale Drive, North Chesterfield, VA 23 23 4. 16. Upon your Af?ant?s request for speci?c subscriber information for this Google Account, as provided for in the June 14, 2019, search warrant, Google provided the following subscriber information: Name: Jamaican Media; Email: 0keilochatrie55@Gmail.com; and Google Account ID: 365520819283. 17. A utilities inquiry of- Mason Dale Drive, North Chester?eld, VA 23234 shows that OKELLO CHATRIE is listed as a subscriber. Based on the similarity between OKELLO name and the email associated with the Google Account referenced above, Your Af?ant utilized various databases to glean additional information about OKELLO CHATRIE. 18. These searches revealed that CHATRIE is a 24?year?old black male of Jamaican birth, 6?0? tall, and weighing 180 lbs. In addition, a 2018 photograph shows him with braided hair and an unkempt beard. 19. in light of the physical similarities between CHATRIE and the subject involved in the Credit Union robbery, your Af?ant conducted a vehicle inquiry on CHATRJE, which indicated that CHATRIE owns a blue 2010 Buick Lacrosse. A license plate reader report indicated OKELLO dark blue Buick sedan has been observed a. Mason Dale Drive, North Chester?eld, VA 23234 (an adjacent address of - Mason Dale Drive, North Chester?eld, VA 2323 4). The photographs associated with the report revealed, however, that the vehicle was parked at. Mason Dale Drive, North Chester?eld, VA 23234. 20. A law enforcement inquiry of OKELLO CHATRIB revealed that on April 1, 2013, CHATRIE hrandished a 10 mm Glock, model G20 pistol at his father and threatened to kill him. 6 Case Document 1-1 Filed 07/17/19 Page 8 of 16 Page D# 52 In response to the domestic disturbance, Chester?eld County law enforcement of?cials took CHATRIE and his ?rearm into custody. charges were later nolle pressed. His pistol was never returned to him. 21. As a result, your Af?ant conducted a ?rearm gun log search for CHATRIE. The gun log search indicated that CHATRIE purchased a silver and black 9mm G2C Taurus semiautomatic pistol on April 29, 2019, at Bob Moates Sports Shop, Inc, - Hull Street Rd, Midlothian, VA 23112. 22. To further the investigation, your Af?ant conducted an inquiry with the Virginia Employment Commission. This search revealed that CHATRIE was employed with Home Depot during the first quarter of 2019. On July 12, 2019, your Af?ant visited a local Home Depot and learned that CHATRJE was no longer employed with Home Depot. 23. Home Depot then shared the following personal information for CHATRIE: Home Address: - Mason Dale Drive; Primary Contact: (304) 475-8298; and Email: Okellochatrie55@gmail.com. The primary contact email provided by Home Depot matches the email address associated with the TARGET ACCOUNT. 24. An inquiry of primary contact number, (804) 425?8298, showed that the service provider is Sprint. Furthermore, OKELLO CHATRIE is listed as the subscriber. Cell phones are arguably the predominant way people communicate in modern society. With the advent of smartphone technology and all of the ?mctions such devices offer, for many people the mobile phone has become as essential to have on their person as any item of clothing. With regard to criminal activity, it is well known that coconspirators frequently utilize cellular telephones to communicate with each other via voice calls, text messages, and emails, and the internet, permitting them to plan, coordinate, and execute their crimes. 7 Case Document 1-1 Filed 07/17/19 Page 9 of 16 Page D# 53 25. As such, your Af?ant has coordinated surveillance of - Mason Dale Drive, North Chester?eld, VA 23234. HoWever, neither CHATRIE nor his dark blue Buick Lacrosse have been observed there. I 26. Based on the totality of facts and circumstances referenced herein, your Af?ant believes it is probable that is responsible for the armed robbery of the Call Federal Credit Union. Furthermore, there is probable cause to believe that CHAT RIB is currently utilizing the TARGET ACCOUNT. Based on the foregoing, there is probable cause to believe that the location information of the TARGET ACCOUNT from May 1, 2019 through July 15, 2019, will produce evidence of the crime committed by CHATRIE, including the whereabouts of his dark blue Buick sedan, locations utilized and frequented by CHATRIE, items used in the commission of the robbery (the speci?c clothing and firearm used in the armed robbery), fruits of the crime, the TARGET primary user(s), and any possible co-conspirators. 27. Additionally, based on the foregoing, the information likely to be obtained ?om the requested cell site location records for the SUBJECT TELEPHONE during the time period of May 1, 2019 through July 15, 2019, is relevant and material to an ongoing criminal investigation involving CHATRIE, and his involvement with the armed bank robbery, in violation of Title 13 United States Code Section 2113, on May 20, 2019. 28. In my training and experience, I know that when people act in concert with one another to commit a crime they frequently utilize cellular telephones to conunum'cate with each other through voice calls, text messages, and emails. These cellular telephones allow them to plan, coordinate, execute, and ?ee the scene of crimes. Furthermore, I know people often take pictures utilizing their cellular telephones that may implicate them in a crime, possessing a firearm, posing with large quantities stolen items, or large amounts of cash. 8 Case Document 1-1 Filed 07/17/19 Page 10 of 16 Page D# 54 BACKGROUND RELATING TO GOOGLE AND RELEVANT TECHNOLOGY 29. A cellular telephone or mobile telephone is a handheld wireless device used primarily for voice through radio signals. Cellular telephones send signals through networks of transmitterfreceivers called ?cells,? enabling communication with other cellular telephones or traditional ?landline? telephones. Cellular telephones rely on cellular towers, the location of which may provide information on the location of the subject telephone. Cellular telephones may also include global positioning system technology for determining the location of the device. 30. Google is an Internet company which, among other things, provides electronic communication services to subscribers. Goo gle allows subscribers to obtain email accounts at the domain name gmailcom. Subscribers obtain an account by registering with Google. During the registration process, Google asks subscribers to provide basic personal information. Therefore, the computers of Google are likely to contain stored electronic communications (including retrieved and unretrieved email for Google subscribers) and information concerning subscribers and their use of Google services, such as account access information, email transaction information, and account application information. ?In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. 31. In my training and experience, email providers generally ask their subscribers to provide certain personal identifying information when registering for an email account. Such information can include the subscriber?s ?ill name, physical address, telephone numbers and other identifiers, alternative email addresses, and, for paying subscribers, means and source of payment (including any credit or bank account number). In my training and experience, such information 9. Case Document 1-1 Filed 07/17/19 Page 11 of 16 Page D# 55 may constitute evidence of the crimes under investigation because the information can be used to identify the account?s user or users. Based on my training and my experience, I know that even if subscribers insert false information to conceal their identity, I know that this information often provide clues to their identity, location or illicit activities. 32. In my training and experience, email providers typically retain certain transactional information about the creation and use of each account on their systems. This information can include the date on which the account was created, the length of service, records of login session) times and durations, the types of service utilized, the status of the account (including whether the account is inactive or closed), the methods used to connect to the account (such as logging into the account via the provider?s website), and other log ?les that re?ect usage of the account. In addition, email providers often have records of the Internet Protocol address address?) used to register the account and the IP addresses associated with particular logins to the account. Because every device that connects to the Internet must use an IP address, IP address information can help to identify which computers or other devices were used to access the email account. 33. As explained herein, information stored in connection with an email account may provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal conduct under investigation, thus enabling the United States to establish and prove each element or alternatively, to exclude the innocent from further suspicions In my training and experience, the information stored in connection 'with an email account can indicate who has used or controlled the account. Further, information maintained by the email provider can show how, where, and when the account was accessed or used. Based on my training and experience, Ihave learned that Google also maintains records that may reveal other Google accounts accessed from the same 10 Case Document 1-1 Filed 07/17/19 Page 12 of 16 Page D# 56 electronic device, such as the same computer or mobile device, including accounts that are linked by Hypertext Transfer Protocol (HTTP) cookies, which are small pieces of data sent from a website and stored in a user's Internet browser. 34. Google has developed an operating system for mobile devices, including cellular phones, known as Android. Nearly every cellular phone using the Android operating system has an associated Goo gle account and users are prompted to add a Google account when they first turn on a new Android device. 35. Based on my training and experience, I have learned that Google collects and retains location data from Android-enabled mobile devices when a Google account user has enabled Google location services. The company uses this information for location?based advertising and location?based search results. This information is derived from GPS data, cell sitefcell tower information, and Wi?Fi access points. 36. Location data can assist investigators in understanding the chronological and geographic context of the email account access and use relating to the crime under investigation. This geographic and timeline information may tend to either inculpate or exculpate the account owner. Additionally, information stored at the user?s account may ?ltther indicate the geographic location of the account user at a particular time location information integrated into an image or video sent via email). 37. Therefore, the servers of Google are likely to contain all the material described above, including stored electronic communications and information concerning subscribers and their use of Google, such as account access information, transaction information, and other account information. 11 Case Document 1-1 Filed 07/17/19 Page 13 of 16 Page D# 57 INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 38. I anticipate executing this warrant under the Electronic Communications Privacy Act, in particular 18 U.S.C. 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant to require Google to disclose to the government copies of the records and other information (including the content of communications) particularly described in Section I of Attachment B. Upon receipt of the information described in Section I of Attachment B, government-authorized persons will review that information to locate the items described in Section II of Attachment E. 39. Based on the foregoing, I request that the Court issue the proposed search warrant. This Court has jurisdiction to issue the requested warrant because it is ?a court of competent jurisdiction? as de?ned by 18 1.1.8.0 2711. 18 U.S.C. 2703(a), 85 Speci?cally, the Court is ?a district court of the United States . . . that has jurisdiction over the offense being investigated.? 18 U.S.C. Pursuant to 18 U.S.C. 2T03(g), the presence of a law enforcement of?cer is not required for the service or execution of this warrant. bmitted, oshuaLBJ?i/ylton TaSk Force Of?cer Federal Bureau of Investigation Subscribed and sworn to before me on this if] day of July, 2019 Bind J. Nova United States Manta Judge 12 Case Document 1-1 Filed 07/17/19 Page 14 of 16 Page D# 58 ATTACHMENT A Preperty to Be Searched This warrant applies to information associated with the TARGET ACCOUNT: OKELLO CHATRIE with user accounts: Okellochatrie55@Gmail.com (TARGET and Google Account ID: 365520819283. From May 1, 2019 to uly 15,2019, including the associated location data, which is stored at premises owned, maintained, controlled, or operated by Google, Inc. 1600 Amphitheater Parkway, Mountain View, California 94043. 13 Case Document 1-1 Filed 07/17/19 Page 15 of 16 Page D# 59 ATTACHMENT I. Information to be Disclosed by Go ogle To the extent that the information described in Attachment A is within the possession, custody, or control of Googie Inc. (?Google?), including location information or records, files, logs, or information that have been deleted but are still available to Google containing location information, or have been preserved pursuant to a request made under 18 U.S.C. 27036), Google is required to disclose the following information to the government for each user ID listed in Attachment A, from May 1, 2019 to July 15, 2019, including but not limited to: All contact and personal identifying information, including: full name, user identi?cation number, birth date, gender, contact email addresses, Google passwords, Goo gle security questions and answers, physical address (including city, state, and zip code), telephone numbers, screen names, websites, and other personal identi?ers; All activity logs for the account and all other documents showing the user?s posts and other Google activities; All Location data including GPS, Cellular, WiFi, or other in the custody or control of Goo gle. All ?check ins? and other location information; All 1? legs, including all records of the IP addresses that logged into the accountl, 1 ?Logged-in? means to access the account using authentication credentials (cg, passwords, PINS, etc), not merely view the account from a different Facebook User ID account or publicly via the internet. 14 Case Document 1-1 . Filed 07/17/19 Page 16 of 16 Page D# 60 The length of service (including start date) and the means and source of any payments associated with the service (including any credit card or bank account number); II. Information to be seized by the government All information described above in Section I that constitutes fruits, evidence and instrumentalities of violations 18 U.S.C 2113, involving OKELLO CHATRIE from May 1, 2019 to July 15, 2019, including, for the User ID identi?ed on Attachment A, information pertaining to the following matters: (C) (8) Any postings or comments, photographs, or correspondence relating to the robbery of any commercial business or to aid and abet in or conspiracy to do so; Av postings, comments, photographs, or correspondence relating the purchase or use of a ?rearm for the purpose of committing a robbery of a commercial business; Evidence indicating how and when the Google account was accessed or used, to determine the chronological and geographic context of account access, use, and events relating to the crime under investigation and to the Google account owner; Evidence indicating the Google account owner?s state of mind as it relates to the crime under investigation; The identity of the person(s) who created, used, or communicated with the user ID regarding the matters described above in Paragraphs 11(a) and 11(b) above, including records that help reveal their whereabouts. 15