at seattle. (brief~y 'f...25 where drugs are to be purchased or sold, methods for evading law...

AO 106 (Rev. 04/10) Application for a Search Warrant

FILED __ ENTERED --LODGED RECEIVEDUNITED STATES DISTRICT COURT

OCT 2 6 2015 AT SEATTLE.

CLERK U.S. DISTRICT COURT WESTERN OISTfl~TIRfM~~\l'l~~Search of

BY

for the

Western District of Washington

(Brief~y describe the property to be searched or ident!fY the person by name and address)

A wireless telephone and a GPS device, as further described in Attachment A

) ) ) ) ) )

Case No. {'It.~/;)~ 'f ~ (.

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identijv the person or describe the property to be searched and give its location):

A wireless telephone and a GPS device, as further described in Attachment A

located in the Western District of -··-- ____ 1,1\/~~hin~~_c:>_n______ . , there is now concealed (identifY the

person or describe the property to be seized):

See Attachment 8 for a list of items to be seized.

The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):

~evidence of a crime;

~contraband, fruits of crime, or other items illegally possessed;

d property designed for use, intended for use, or used in committing a crime;

0 a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section 21 U.S.C. § 841(a)(1) and (b) (1)(C); 21 U.S.C. § 952(a), 960(a)(1) and 960(b)(3)

Offense Description Possession of Controlled Substances with Intent to Distribute; Importation of a Controlled Substance.

The application is based on these facts:

See Affidavit of Special Agent Yi-Lin Lee

~ Continued on the attached sheet.

0 Delayed notice of days (give exact ending date if more than 30 days:

under 18 U.S.C. § 3103a, the basis of which is set forth on t ~~

Applicant's signature

) is requested

----H§.l _ _?_p~cial ~gent Yi-Lin Lee

Printed name and title

Sworn to before me and signed in my presence.

Date: ~ -Zwl2DlC-.fudge 's signature

City and state: Se~_ttle, ~~shington __ Uni!~~.states Magistrate Judge Mary Alice The~~~L .. __ _ Printed name and title

1

2 STATE OF WASHINGTON

3

4 COUNTY OF KING

)

)

)

AFFIDAVIT

SS

5 I, Yi-Lin Lee, having been duly sworn, state as follows:

6 INTRODUCTION AND AGENT BACKGROUND

7 1. I make this affidavit in support of an application under Rule 41 of the

8 Federal Rules of Criminal Procedure for a search warrant authorizing the examination of

9 digital devices1 or electronic storage media,2 hereinafter the "SUBJECT DEVICES,"

10 which are currently in law enforcement possession, and the extraction from those devices

11 or electronic storage media of electronically stored information. The SUBJECT

12 DEVICES are a wireless telephone and GPS device seized from the Defendant Wen-Xian

13 Zhang when the United States Coast Guard intercepted him transporting approximately

14 23 kilograms of methylenedioxymethamphetamine ("MDMA" or "Ecastasy") from

15 Canada into the United States on board a small speed boat in August 2015. Based on this

16 conduct, the Defendant has been charged by indictment with Possession of Controlled

17 Substances with Intent to Distribute, (21 U.S.C. § 84l(a)(l) and (b)(l)(C)) and

18 Importation of a Controlled Substance (21 U.S.C. § 952(a), 960(a)(l) and 960(b )(3)).

19 There is probable cause to believe that the SUBJECT DEVICES contain evidence related

20

21 1 "Digital device" includes any device capable of processing and/or storing data in electronic form, including, but not limited to: central processing units, laptop, desktop, notebook or tablet

22 computers, computer servers, peripheral input/output devices such as keyboards, printers,

23 scanners, plotters, monitors, and drives intended for removable media, related communications devices such as modems, routers and switches, and electronic/digital security devices, wireless

24 communication devices such as mobile or cellular telephones and telephone paging devices, personal data assistants ("PDAs"), iPods/iPads, Blackberries, digital cameras, digital gaming

25 devices, global positioning satellite devices (GPS), or portable media players.

26 2 Electronic Storage media is any physical object upon which electronically stored information

27 can be recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-RO Ms,

28 and other magnetic or optical media.

AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE USAO# 2015R0997 - I

UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220

SEATTLE, WASHINGTON 98101 (206) 553-7970

1 to the charges specifically that the telephone and GPS device contain information about

2 the Defendant's knowledge of the drugs, the purpose of his trip, where he acquired the

3 drugs, who he was working with, where he was supposed to deliver the drugs, any efforts

4 to avoid contact with law enforcement, and other information relevant to the Defendant's

5 charges. The SUBJECT DEVICES are described in Attachment A, and the information

6 sought is described in Attachment B.

7 2. I am a Special Agent ("SA") with the Department of Homeland Security,

8 United States Immigration and Customs Enforcement ("ICE"), Homeland Security

9 Investigations ("HSI"), Seattle field office. I have received formal training at the Federal

10 Law Enforcement Training Center in Brunswick, Georgia and have been employed as a

11 SA with ICE since 2009. I am currently assigned to the Transnational Criminal

12 Organizations Group, which investigates transnational gang related crimes. I have been

13 employed in this capacity since December of 2014. Prior to this assignment, I was

14 assigned to the Counter-proliferation Investigations ("CPI") Group for approximately

15 five years, which investigates the illegal export of weapons and other items from the

16 United States. I am charged with the investigation of various violations of laws enforced

17 by HSI, to include enforcing federal criminal statutes involving violations of Title 18 and

18 Title 21.

19 3. The facts set forth in this Affidavit are based on my own personal

20 knowledge; knowledge obtained from other individuals during my participation in this

21 investigation,- including other law enforcement officers; review of documents and records

22 related to this investigation; communications with others who have personal knowledge

23 of the events and circumstances described herein; and information gained through my

24 training and experience.

25 4. Because this Affidavit is submitted for the limited purpose of establishing

26 probable cause in support of the application for a search warrant, it does not set forth

27 each and every fact that I or others have learned during the course of this investigation. I

28 have set forth only the facts that I believe are necessary to establish probable cause to AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE UNITED STATES ATTORNEY USAO# 2015R0997 - 2 700STEWARTSTREET,SUJTE5220


1 believe that evidence and instrumentalities of violations of the importation,

2 transportation, and distribution of controlled substances will be found on the SUBJECT

3 DEVICES.

4

5

6

7

8

9

10

IDENTIFICATION OF THE SUBJECT DEVICE TO BE EXAMINED

5. The SUBJECT DEVICES include:

6.

a. A Motorola XTl 023 cellular telephone with the serial number 359301050376184 ("CELLULAR PHONE"), and

b. A Garmin Map 78, global positioning systems device, serial number 1 WQ079961 ("GPS DEVICE").

The SUBJECT DEVICES are currently located at HSI Blaine

11 Washington's Seized Property Vault.

12 7. The warrant would authorize the forensic examination of the SUBJECT

13 DEVICES for the purpose of identifying electronically stored data particularly described

14 in Attachment B.

15

16 8.

THE INVESTIGATION

On August 27, 2015 at approximately 2:30 pm, the United States Coast

17 Guard (USCG) Cutter Swordfish was conducting patrol operations near the Canadian

18 border northwest of Waldron Island, Washington, when it spotted a small fiberglass boat,

19 approximately 22 feet long, coming from the direction of the Canadian border at a high

20 rate of speed (estimated at 30 knots). The USCG subsequently reviewed radar records

21 from Canadian law enforcement showing a boat heading from Canadian waters across the

22 United States border on the same heading and at approximately the same speed. Upon

23 visually identifying the small fiberglass boat, the USCG Cutter Swordfish launched a

24 smaller patrol vessel to intercept the fiberglass boat, consistent with USCG protocol for

25 inspecting boats crossing from Canadian to United States waters.

26 9. Petty Officer 2nd class (P02) Christian Foss and P02 Collin Royer, who

27 were on the small USCG vessel, stopped the fiberglass boat, at which time they began to

28 conduct a Coast Guard boarding, first asking pre-boarding questions and announcing

AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE USAO# 20 l 5R0997 - 3


SEATTLE, WASHJNGTON98101 (206) 553-7970

1 their intention to board the vessel, before doing so. A language barrier prevented

2 conversation between the officers and the vessel's occupant. P02 Foss identified the

3 operator of the vessel as Wen-Xian ZHANG, based on ZHANG's Chinese passport. No

4 other persons were present on the boat.

5 10. While on the vessel, P02 Foss did not find any registration numbers on the

6 hull of the vessel. The vessel also had one crab pot on board but no crabbing license or

7 bait for the trap. Subsequent records checks revealed that the vessel, which was

8 registered in the name of a third party in British Columbia, Canada, had not cleared

9 United States Customs. When attempting to inspect the bilge area of the forward

10 compartment, P02 Foss noticed vacuum sealed bags which appeared to contain

11 controlled substances.

12 11. After finding what appeared to be a large quantity of a controlled substance,

13 Boatswain's Mate Chief (BMC) Casey McDonald piloted the boat back to USCG Station

14 Bellingham, Washington, for a more detailed inspection. P02 Foss participated in the

15 inspection of the boat, which revealed that it contained 22 packages of a brown powdery

16 substance. One package was randomly selected and tested by Homeland Security

17 Investigations Special Agent Ian Wallace. The substance tested positive for MDMA.

18 The packages had a combined weight of 23.06 kilograms (50.73 pounds). Based on my

19 training and experience, this is an amount consistent with distribution, and not personal

20 use.

21 12. The SUBJECT DEVICES were found in ZHANG's possession at the time

22 of his arrest. Based on my training and experience, I know that drug traffickers often use

23 cellular devices like the CELLULAR PHONE to call or text other drug traffickers about

24 drug transactions. Such devices often contain messages or pictures that reveal when and

25 where drugs are to be purchased or sold, methods for evading law enforcement, drug

26 prices and quantities, and other information. Drug traffickers also use such devices to

27 call each other and store contact information, such as names and telephone numbers.

28 AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE USAO# 20 l 5R0997 - 4



1 13. Based on my training and experience, I know that drug traffickers often use

2 global positioning systems devices like the GPS DEVICE to find drug pick-up locations,

3 drug delivery locations, and the route from one to the other. Such devices often store

4 information about these locations and routes.

5 14. The SUBJECT DEVICES are currently in the lawful possession of the

6 Homeland Security Investigations (HSI). They came into HSI's possession when they

7 were seized incident to arrest.

8 15. The SUBJECT DEVICES are currently in storage at HSI Blain

9 Washington's Seized Property Vault. In my training and experience, I know that the

10 SUBJECT DEVICES have been stored in a manner in which their contents are, to the

11 extent material to this investigation, in substantially the same state as they were when the

12 SUBJECT DEVICES first came into HSI's possession.

13 TECHNICAL TERMS

14 16. Based on my training and experience, I use the following technical terms to

15 convey the following meanings:

16 a. Wireless telephone: A wireless telephone (or mobile telephone, or

17 cellular telephone) is a handheld wireless device used for voice and data communication through radio signals. These telephones send signals through networks of

18 transmitter/receivers, enabling communication with other wireless telephones or

19 traditional "land line" telephones. A wireless telephone usually contains a "call log," which records the telephone number, date, and time of calls made to and from the phone.

20 In addition to enabling voice communications, wireless telephones offer a broad range of

21 capabilities. These capabilities include: storing names and phone numbers in electronic "address books;" sending, receiving, and storing text messages and e-mail; taking,

22 sending, receiving, and storing still photographs and moving video; storing and playing

23 back audio files; storing dates, appointments, and other information on personal calendars; and accessing and downloading information from the Internet. Wireless

24 telephones may also include global positioning system ("GPS") technology for

25 determining the location of the device.

26 b. GPS: A GPS navigation device uses the Global Positioning System

27 to display its current location. It often contains records of the locations where it has been. Some GPS navigation devices can give a user driving or walking directions to another

28 location. These devices can contain records of the addresses or locations involved in AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE UNITED STATES ATTORNEY USAO# 20 l 5R0997 - 5 700 STEWART STREET, SUITE 5220

SEATTLE, WASHINGTON 9810 I (206) 553-7970

1 such navigation. The Global Positioning System (generally abbreviated "GPS") consists

2 of 24 NA VS TAR satellites orbiting the Earth. Each satellite contains an extremely accurate clock. Each satellite repeatedly transmits by radio a mathematical representation

3 of the current time, combined with a special sequence of numbers. These signals are sent

4 by radio, using specifications that are publicly available. A GPS antenna on Earth can receive those signals. When a GPS antenna receives signals from at least four satellites, a

5 computer connected to that antenna can mathematically calculate the antenna's latitude,

6 longitude, and sometimes altitude with a high level of precision.

7 1 7. Based on my training, experience, and research, and from consulting the

8 product technical specifications available online at http://

9 http://www.gsmarena.com/motorola_moto_e-6376.php I know that the CELLULAR

10 PHONE has capabilities that allow it to serve as a wireless telephone, digital camera,

11 portable media player, and GPS navigation device. In my training and experience,

12 examining data stored on devices of this type can uncover, among other things, evidence

13 that reveals or suggests who possessed or used the device, knowledge of criminal

14 conduct, the nature of criminal conduct, and the identity of people involved in such

15 conduct.

16 COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS

17 18. Based on my knowledge, training, and experience, I know that digital

18 devices and electronic storage media can store information for long periods of time.

19 Similarly, things that have been viewed via the Internet are typically stored for some

20 period of time on the device used to access the Internet. This information can sometimes

21 be recovered with forensic tools.

22 19. Forensic evidence. As further described in Attachment B, this application

23 seeks permission to locate not only electronically stored information that might serve as

24 direct evidence of the crimes described on the warrant, but also forensic evidence that

25 establishes how the SUBJECT DEVICES were used, the purpose of their use, who used

26 them, and when. There is probable cause to believe that this forensic electronic evidence

27 might be on the SUBJECT DEVICES because:

28 AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE USAO# 20 l 5R0997 - 6


SEATTLE, WASHINGTON98101 (206) 553-7970

1 a. Data on the storage medium can provide evidence of a file that was

2 once on the storage medium but has since been deleted or edited, or of a deleted portion of a file (such as a paragraph that has been deleted from a word processing file).

3

4 b. As explained herein, information stored within a digital device and

other electronic storage media may provide crucial evidence of the "who, what, why, 5 when, where, and how" of the criminal conduct under investigation, thus enabling the

6 United States to establish and prove each element or alternatively, to exclude the innocent from further suspicion. In my training and experience, information stored within a

7 computer or storage media (e.g., registry information, communications, images and

8 movies, transactional information, records of session times and durations, internet history, and anti-virus, spyware, and malware detection programs) can indicate who has

9 used or controlled the computer or storage media. This "user attribution" evidence is

10 analogous to the search for "indicia of occupancy" while executing a search warrant at a residence. The existence or absence of anti-virus, spyware, and malware detection

11 programs may indicate whether the computer was remotely accessed, thus inculpating or

12 exculpating the computer owner and/or others with direct physical access to the computer. Further, computer and storage media activity can indic,ate how and when the

13 computer or storage media was accessed or used. For example, as described herein,

14 computers typically contain information that log: computer user account session times and durations, computer activity associated with user accounts, electronic storage media

15 that connected with the computer, and the IP addresses through which the computer

16 accessed networks and the internet. Such information allows investigators to understand the chronological context of computer or electronic storage m~dia access, use, and events

17 relating to the crime under investigation. Additionally, some information stored within a

18 computer or electronic storage media may provide crucial evidence relating to the physical location of other evidence and the suspect. For example, images stored on a

19 computer may both show a particular location and have geolocation information

20 incorporated into its file data. Such file data typically also contains information indicating when the file or image was created. The existence of such image files, along

21 with external device connection logs, may also indicate the presence of additional

22 electronic storage media (e.g., a digital camera or cellular phone with an incorporated camera). The geographic and timeline information described herein may either inculpate

23 or exculpate the computer user. Last, information stored within a computer may provide

24 relevant insight into the computer user's state of mind as it relates to the offense under investigation. For example, information within the computer may indicate the owner's

25 motive and intent to commit a crime (e.g., internet searches indicating criminal planning),

26 or consciousness of guilt (e.g., running a "wiping" program to destroy evidence on the computer or password protecting/encrypting such evidence in an effort to conceal it from

27 law enforcement).

28 AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE USAO# 2015R0997 - 7


SEATTLE, WASHINGTON98101 (206) 553-7970

1 c. A person with appropriate familiarity with how an electronic device

2 works may, after examining this forensic evidence in its proper context, be able to draw conclusions about how electronic devices were used, the purpose of their use, who used

3 them, and when.

4 d. The process of identifying the exact electronically stored

5 information on a storage medium that are necessary to draw an accurate conclusion is a

6 dynamic process. Electronic evidence is not always data that can be merely reviewed by a review team and passed along to investigators. Whether data stored on a computer is

7 evidence may depend on other information stored on the computer and the application of

8 knowledge about how a computer behaves. Therefore, contextual information necessary to understand other evidence also falls within the scope of the warrant.

9 e. Further, in finding evidence of how a device was used, the purpose

1 O of its use, who used it, and when, sometimes it is necessary to establish that a particular 11 thing is not present on a storage medium.

12 20. Manner of execution. Because this warrant seeks only permission to

13 examine a device already in law enforcement's possession, the execution of this warrant

14 does not involve the physical intrusion onto a premises. Consequently, I submit there is

15 reasonable cause for the Court to authorize execution of the warrant at any time in the

16 day or night.

17 DIGITAL DEVICES AS INSTRUMENTALITIES OF THE CRIMES

18 21. In my training and experience, Drug Trafficking Organizations (DTO) use

19 cellular telephones to communicate between members of the organization and coordinate

20 the smuggling of controlled substances. In addition, DTO members take pictures

21 utilizing cellular phones of locations, persons, vehicles and contraband pertaining to their

22 illegal activities. Members of the organization may use the GPS function of the cellular

23 phone or GPS device to navigate to their rendezvous location. The cellular phone or GPS

24 device may track and store their starting point, route of travel, and destination of current

25 as well as past criminal activities.

26

27

SEARCH TECHNIQUES

22. Based on the foregoing, and consistent with Rule 4l(e)(2)(B) of the Federal

28 Rules of Criminal Procedure, the warrant I am applying for will permit imaging or AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE UNITED STATES ATTORNEY USAO# 20 l 5R0997 - 8 700 STEWART STREET, SUITE 5220

SEATTLE, WASHINGTON98!01 (206) 553-7970

1 otherwise copying all data contained on the SUBJECT DEVICES, and will specifically

2 authorize a review of the media or information consistent with the warrant.

3 23. In accordance with the information in this affidavit, law enforcement

4 personnel will execute the search of the SUBJECT DEVICES pursuant to this warrant as

5 follows:

6 a. Securing the Data

7 i. In order to examine the ESI in a forensically sound manner,

8 law enforcement personnel with appropriate expertise will attempt to produce a complete forensic image, if possible and appropriate, of the SUBJECT DEVICES.3

9

1 o ii. Law enforcement will only create an image of data physically present on or within the SUBJECT DEVICES. Creating an image of the SUBJECT

11 DEVICES will not result in access to any data physically located elsewhere. However, if 12 the SUBJECT DEVICES were previously connected to devices at other locations, they

may contain data from those other locations. 13

14 b. Searching the Forensic Images

15 i. Searching the forensic images for the items described in

16 Attachment B may require a range of data analysis techniques. In some cases, it is possible for agents and analysts to conduct carefully targeted searches that can locate

1 7 evidence without requiring a time-consuming manual search through unrelated materials

18 that may be commingled with criminal evidence. In other cases, however, such techniques may not yield the evidence described in the warrant, and law enforcement

19 may need to conduct more extensive searches to locate evidence that falls within the

20 scope of the warrant. The search techniques that will be used will be only those methodologies, techniques and protocols as may reasonably be expected to find, identify,

21

22 3 The purpose of using specially trained computer forensic examiners to conduct the imaging of

23 digital devices or other electronic storage media is to ensure the integrity of the evidence and to 24 follow proper, forensically sound, scientific procedures. When the investigative agent is a

trained computer forensic examiner, it is not always necessary to separate these duties. 25 Computer forensic examiners often work closely with investigative personnel to assist

26 investigators in their search for digital evidence. Computer forensic examiners are needed because they generally have technological expertise that investigative agents do not possess.

27 Computer forensic examiners, however, often lack the factual and investigative expertise that an investigative agent may possess on any given case. Therefore, it is often important that

28 computer forensic examiners and investigative personnel work closely together. AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE UNITED STATES ATTORNEY USAO# 2015R0997 - 9 700 STEWART STREET, SUITE 5220


1 segregate and/or duplicate the items authorized to be seized pursuant to Attachment B to

2 this affidavit.

3 CONCLUSION

4 24. I submit that this affidavit supports probable cause for a search warrant

5 authorizing the examination of the SUBJECT DEVICES described in Attachment A to

6 seek the items described in Attachment B.

7

8

9

10

11

12

13

Respectfully submitted,

Yi- n ee Spe i Agent Homeland Security Investigations

14

15 Subscribed and sworn to before me this ·2lR. day of October, 2015.

16

17

18

19

20

21

22

23

24

25

26

27


HON. MARY ALICE THEILER United States Magistrate Judge



1 ATTACHMENT A

2 The property to be searched are

3 a. A Motorola XTl 023 cellular telephone with the serial number

4 359301050376184,and

5 b. A Garmin Map 78, global positioning systems device, serial number

6 1 WQ079961.

7 The SUBJECT DEVICES are currently located at HSI Blaine Washington's

8 Seized Property Vault.

9 This warrant authorizes the forensic examination of the SUBJECT DEVICES for

1 o the purpose of identifying the electronically stored information described in Attachment

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

B.

AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE USAO# 2015R0997 - 11


SEA TILE, W ASHJNGTON 98101 (206) 553-7970

1

2 1.

ATTACHMENTB

All records on the SUBJECT DEVICES described in Attachment A that

3 relate to the crimes of Possession of Controlled Substances with Intent to Distribute, (21

4 U.S.C. § 841(a)(l) and (b)(l)(C)) and Importation of a Controlled Substance (21 U.S.C. §

5 952(a), 960(a)(l) and 960(b)(3)) since January 1, 2015, including:

6 a. any information about suspected drug customers or drug trafficking

7 associates, including but not limited to names, phone numbers, addresses, pictures,

8 videos, or any other identifying information;

9 b. any information about types, amounts, and prices of drugs trafficked

10 as well as dates, places, and amounts of specific transactions;

11 c. any information related to sources of drugs, including but not limited

12 to names, addresses, phone numbers, or any other identifying information;

13 d. any information related to the purpose or nature of Wen-Xian

14 Zhang's activities on or around August 27, 2015, including but not limited to information

15 about where he was supposed to go, who he was supposed to meet, how he was supposed

16 to travel, and what he was supposed to do;

17 e. any information related to Wen-Xian Zhang's or the OPS Device's

18 location from January 1, 2015, to the present;

19 f. any information recording Wen-Xian Zhang's schedule or travel

20 from January 1, 2015, to the present;

21 g. all bank records, checks, credit card bills, account information, and

22 other financial records;

23 h. any information about law enforcement locations or practices and

24 methods for avoiding detection by law enforcement;

25 2. Evidence of user attribution showing who used or owned the SUBJECT

26 DEVICES at the time the things described in this warrant were created, edited, or deleted,

27 such as logs, phonebooks, saved usemames and passwords, documents, and browsing

28 history; AFFIDAVIT OF SPECIAL AGENT YI-LIN LEE USAO# 2015R0997 - 12

UNITED STA TES ATTORNEY 700 STEWART STREET, SUITE 5220

SEATTLE, WASHINGTON 98101 (206)553-7970

1 3. Records of Internet activity, including firewall logs, caches, browser history

2 and cookies, "bookmarked" or "favorite" web pages, search terms that the user entered

3 into any Internet search engine, and records of user-typed web addresses.

4 4. Records of locations where the SUBJECT DEVICE traveled, including

5 GPS data, maps, addresses, network data, and other information.

6 As used above, the terms "records" and "information" include all of the foregoing

7 items of evidence in whatever form and by whatever means they may have been created

8 or stored, including any form of computer or electronic storage (such as flash memory or

9 other media that can store data) and any photographic form.

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27




1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

Magistrate Judge Mary Alice Theiler

UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WASHINGTON

AT SEATTLE

IN RE ORDER REQUIRING GOOGLE, INC. TO ASSIST IN THE EXECUTION OF A NO. MJ15-00476 SEARCH WARRANT ISSUED BY THIS COURT APPLICATION

INTRODUCTION

The United States of America, by and through Annette L. Hayes, United States Attorney,

and Nicholas Manheim, Special Assistant United States Attorney, hereby moves this Court under 18

19 the All Writs Act, 28 U.S.C. § 1651, for an order requiring Google, Inc. ("Google") to assist in

20 the execution of a federal search warrant by bypassing the lock screens of an Android device,

21 specifically, a Motorola XT1023.

22

23

24

FACTS

U.S. Homeland Security Investigations ("HIS") currently has in its possession the

25 Android device that is the subject of a search warrant issued by this Court. Initial inspection of

26 the Android device reveals that it is locked. Because the Android device is locked, law

27

28 APPLICATION FOR ORDER REQUIRING GOOGLE, INC. TO ASSIST IN EXECUTION OF SEARCH WARRANT/ - 1 USAO # 2015R00997


SEATTLE, WASHINGTON98!01 (206) 553-7970

1 enforcement agents are not able to examine the data stored on the Android device as commanded

2 by the search warrant.

3 The Android device is a Motorola Model #XT1023 with serial number

4

5 359301050376184 operating on an unknown network.

6 Google, the creator of the Android operating system and producer of the Android Device,

7 may have the capability of bypassing the Android Device's lock and thereby retrieving data

8 stored on the Android Device that is not currently accessible to HSI. This Application seeks an

9

10 order requiring Google to use any such capability, so as to assist agents in complying with the

11 search warrant.

12 The United States requests that the Court order that Google, if necessary, must reactivate

13

14

15

the Google account associated with the Android Device for the limited purpose of complying

with the search warrant.

16 Further, the United States requests that Google be directed to: (1) provide a single

1 7 password reset for the Android Device; (2) provide the new password to the law enforcement

18 officer executing the search warrant; and (3) upon unlocking the target Android Device, again

19 reset the Google account password promptly upon notice that the imaging of the phone is

20

21 complete, without providing it to the law enforcement officer or agency so as to prevent future

22 access.

23

24

25

Further, the United States represents that the reset process may not be unobtrusive to the

subject and that the subject may receive notice to one or more accounts of the reset.

26 Accordingly, the United States requests that the Court order that any such notice is not a

27 violation of any seal or nondisclosure requirement.


UNITED ST A TES ATTORNEY 700 STEWART STREET, SUITE 5220

SEATTLE, WASHINGTON 9810 I (206) 553-7970

1 Finally, the United States does not seek authority to use the new password to attempt to

2 access the subject's online accounts other than as synchronized on, and stored in, memory within

3

4 the target Android Device at the time of execution of the warrant, and does not object to the

5 Court prohibiting such use of the password to be provided by Google.

6

7

8

DISCUSSION

The All Writs Act provides that "[t]he Supreme Court and all courts established by Act of

Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and

9

10 agreeable to the usages and principles oflaw." 28 U.S.C. § 165 l(a). As the Supreme Court

11 explained, "[t]he All Writs Act is a residual source of authority to issue writs that are not

12 otherwise covered by statute." Pennsylvania Bureau of Correction v. United States Marshals

13 Service, 474 U.S. 34, 43 (1985). "The power conferred by the Act extends, under appropriate

14 circumstances, to persons who, though not parties to the original action or engaged in

15 16 wrongdoing, are in a position to frustrate the implementation of a court order or the proper

17 administration of justice ... and encompasses even those who have not taken any affirmative

18 action to hinder justice." United States v. New York Tel. Co., 434 U.S. 159, 174 (1977).

19 Specifically, in United States v. New York Tel. Co., the Supreme Court held that the All Writs

20

21 Act permitted district courts to order a telephone company to effectuate a search warrant by

22 installing a pen register. Under the reasoning of New York Tel. Co., this Court has the authority

23 to order Google to use any capabilities it may have to assist in effectuating the search warrant for

24 the Android Device by unlocking the Android Device.

25

26 The government is aware, and can represent, that in other cases, courts have ordered

27 Google to assist in effectuating a search warrant by unlocking other Android Devices under the

28 authority of the All Writs Act. Additionally, Google has complied with such orders. APPLICATION FOR ORDER REQUIRING GOOGLE, INC. TO UNITED STATES ATTORNEY ASSIST IN EXECUTION OF SEARCH WARRANT/ - 3 700 STEWART STREET, SUITE 5220 USAO # 2015R00997 SEATTLE, WASHINGTON98101

(206) 553-7970

1 The requested order would enable agents to comply with this Court's warrant

2 commanding that the Android Device be examined for evidence identified by the warrant.

3 Examining the Android Device without Google's assistance, if it is possible at all, would require

4

5 significant resources and may harm the Android Device. Moreover, the order is not likely to

6 place any unreasonable burden on Google.

7 DATED this 27th day of October, 2015.

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27


Respectfully submitted,

ANNETTE L. HA YES United States Attorney

Isl Nicholas Manheim Nicholas Manheim Assistant U.S. Attorney


SEA TILE, WASHINGTON 9810] (206) 553-7970

Case 2:15-mj-00476-MAT Document 3 Filed 10/27/15 Page 1 of 2

1

2

3

4

5

6

7

Magistrate Judge Mary Alice Theiler

8

9

10

IN THE UNITED STATES DISTRICT COURT FOR WESTERN DISTRICT OF WASHINGTON

AT SEATTLE

11 IN RE ORDER REQUIRING GOOGLE, INC.

12 TO ASSIST IN THE EXECUTION OF A SEARCH WARRANT ISSUED BY THIS

13 COURT

Case No. MJ15-00476

ORDER

15 Before the Court is the Government's motion for an order requiring Google, Inc.

16 ("Google") to assist law enforcement agents in the search of one Android device. Upon

17 consideration of the motion, and for the reasons stated therein, it is hereby

18

19 ORDERED that Google assist law enforcement agents acting in support of a search

20 warrant issued separately by this Court in the examination of one Android device, specifically a

21 Motorola Model #XT1023 with the serial number 359301050376184 operating on an unknown

22

23

24

network ("Android Device");

FURTHER ORDERED that Google shall, if necessary, reactivate the Google account

25 associated with the Android Device;

26

27

28

FURTHER ORDERED that Google shall: (1) provide a single password reset for the

Android Device; (2) provide the new password to the law enforcement officer executing the

ORDER REQUIRING GOOGLE, INC. TO ASSIST IN EXECUTION OF SEARCH WARRANT/ - l USAO # 2015R00997


SEA TILE, WASHINGTON 9810 I (206) 553-7970

Case 2:15-mj-00476-MAT Document 3 Filed 10/27/15 Page 2 of 2

1 search warrant; and (3) upon unlocking the Android Device, again reset the Google account

2 password promptly upon notice that the imaging of the phones is complete, without providing it

3 to the law enforcement officer or agency so as to prevent future access;

4

5 FURTHER ORDERED that the reset process need not be unobtrusive to the subject, the

6 subject may receive notice to one or more accounts of the reset, and such notice is not a violation

7 of any seal or nondisclosure requirement;

8

9 FURTHER ORDERED that the law enforcement agent executing the search warrant is

10 prohibited from using or attempting to use the new password to attempt to access the subject's

11 online accounts other than as synchronized on and stored in memory within the Android Device

12 at the time of execution of the warrant.

13

14

15

16

17

18

19 Date: (QJ- ~1, 2ets 20

21

22

23

24

25

26

27

28 ORDER REQUIRING GOOGLE, INC. TO ASSIST IN EXECUTION OF SEARCH WARRANT/ - 2 USAO # 2015R00997

Signed,

UNITED STA TES MAGISTRATE JUDGE


SEA TILE, WASHINGTON 9810 I (206) 553-7970

at seattle. (brief~y 'f...25 where drugs are to be purchased or sold, methods for evading law...

Documents