)COU.RTDISTRICTOF - ACLU

ENiEREDFILED - RECEIVED

-LOGGED --

aV

AUG 292014IN THE UNITED STATES DISTRICT COURT FOR THE

CLERlJ.~~~~rr!~~1\)COU.RT DISTRI CT OF MARYLANDDISTRICTOF . rTVDEPu"

IN THE MATTER OF THE SEARCH OFTHE CELLULAR TELEPHONE ASSIGNEDCALL NUMBER (312)-312-1264, WITHINTERNATIONAL MOBILE SUBSCRIBERIDENTITY 013333009183120

Case No. \ ~ .- \...." '- '='-> C

FIJi!" IIAiI' P I1'HiI

AFFIDAVIT IN SUPPORT OFAN APPLICATION FOR A SEARCH WARRANT

I, Jesse Argueta, being first duly sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND

1. I make this affidavit in support of an application for a search warrant under

Federal Rule of Criminal Procedure 41 and 18 U.S.c. SS 2703(c)(I)(A) for information about the

location of the cellular telephone assigned call number 301-312-1264, with International

Mobile Subscriber Identity Number 013333009183120 (the "Target Cell Phone"), whose

service provider is AT&T Mobility, a wireless telephone service provider headquartered at 208

South Akard Street, Dallas, TX 75202 with a National Subpoena/Search Warrant Compliance

Center at 11760 US Highway 1, North Palm Beach, FL 33408. 11760 US Highway 1, North

Palm Beach, FL 33408. The Target Cell Phone is described herein and in Attachment A, and the

location information to be seized is described herein and in Attachment B.

2. I am a Special Agent with the Air Force Office of Special Investigations (AFOSI)

ih Field Investigations Squadron, Joint Base Andrews, Maryland, and having been duly sworn,

affirm that the statements contained herein are true and correct to the best of my knowledge and

belief. The information herein was obtained from my personal observations and from statements

made to me. I graduated from Argosy University, Rosslyn, Virginia in 2012 with a Master's

1

Case 8:14-mj-01760-WGC Document 3 Filed 08/29/14 of 13

Degree in Forensic Psychology and have been a Special Agent with AFOSI since August 2013. I

am a graduate of the Federal Law Enforcement Training Center's Criminal Investigator Training

Program as well as the Basic Special Investigations Course with the United States Air Force

Special Investigations Academy and have received basic, advanced, and on the job training in the

investigation of cases involving economic crimes. As a federal agent, I am authorized to

investigate violations of the laws of the United States and to execute warrants issued under the

authority of the United States. As part of my primary duties, I investigate violations of federal

law, including 18 U.S.C. S 287, False, Fictitious or Fraudulent claims, 18 U.S.C. S 641, Theft of

Public Money. I have been trained to conduct such investigations through work experience and

specialized training.

3. The facts III this affidavit come from my personal knowledge, observation,

information received from records, documents, and other physical evidence obtained during this

investigation, as well as other information conveyed to me by other law enforcement officials.

This affidavit is intended to show merely that there is sufficient probable cause for the requested

warrant and does not set forth all of my knowledge about this matter.

4. Based on the facts set forth in this affidavit, there is probable cause to believe that

evidence, fruits, and instrumentalities of violations of 18 U.S.C. S 287, False, Fictitious or

Fraudulent claims and 18 U.S.C. S 641, Theft of Public Money have been committed by Pierre

Shakime ARISTIDE, 9821 Solar Course, Laurel, MD, 20723, a Major in the United States Air

Force Reserves. There is also probable cause to believe that the location information described

in Attachment B will constitute evidence of these criminal violations 18 U.S.C. S287 and S 641.

2


IDENTIFICATION OF THE DEVICE TO BE EXAMINED

5. The property to be searched is One (l) black Apple iPhone, Model iPhone 5

cellular telephone, Model number A1428, International Mobile Subscriber Identity Number:

013333009183120, FCC ID: BCG-E2599A, IC: 579C-E2599A. The device is currently located

at AFOSI offices, th Field Investigations Squadron, 1413 Arkansas Road, Joint Base Andrews,

Maryland 20762.

6. The applied-for warrant would authorize the forensic examination of the device

for the purpose of identifying electronically stored data particularly described in Attachment B.

PROBABLE CAUSE

7. On May 28, 2013, Defense Logistics Agency Office of the Inspector General

(DLA-OIG) notified AFOSI of an anonymous letter alleging ARISTIDE misrepresented

information on official travel vouchers in order to receive lodging, per diem, and travel

entitlements fraudulently while activated on military orders to DLA from August 5, 2013

through December 20,2013.

8. ARISTIDE submitted official travel vouchers between August 5, 2013 and

December 20,2013, in which he listed 7 Nostrand Place, Hempstead, NY, ARISTIDE's home of

record.

9. Maryland Motor Vehicle Administration (MVA) documents revealed ARISTIDE

submitted his New York Driver's license into the MVA for destruction and received a Maryland

driver's license A-623-684-765-777 on May 30, 2013. Additionally, on May 30, 2013,

ARISTIDE changed his residential address with the MVA to reflect a home address of 9821

Solar Course, Laurel, MD.

3


10. A reVIew of Maryland property and tax assessment records indicated that

ARISTIDE purchased the property located at 9821 Solar Course, Laurel, MD 20723 on

December 9, 2011. Moreover, a document review of the Deed of Residence to the

aforementioned residential property showed ARISTIDE signed and initialed assertions to

acknowledge ownership of the property and certification that it would be his primary residence.

This document contains an Affidavit of Grantee as a First-time Maryland Home Buyer. The

affidavit, dated December 9, 2011, shows ARISTIDE's signature as acknowledgement under

oath and penalties of perjury that he is the "Grantee" of the property and that he is a first-time

Maryland home buyer (defined as an individual who has never owned in the state residential real

property that has been the individual's principle place of residence) "who will occupy the

property as Grantee's principle residence."

11. ARISTIDE's voter registration profile from the Maryland State Board of

Elections showed he became an active registrant on September 28, 2012. According to the

Maryland voter registration application form, in order to register as a voter in Maryland, the

applicant must be a Maryland resident.

12. The investigation also revealed that prior to working at DLA, ARISTIDE was

employed by the Office of Personnel Management (OPM). While employed by OPM, he applied

and was granted authority to telework from an alternate worksite. The address listed and

designated as his alternate worksite on the signed telework application dated February 3, 2012,

was 9821 Solar Course, Laurel, MD.

13. A Financial Crimes Enforcement Network (FinCEN) report disclosed that on May

20, 2013, ARISTIDE incorporated "A and S Solutions, Inc." with the Maryland State

Department of Assessments and Taxation. The Articles of Incorporation for the aforementioned

\.?c..

4


business designated ARISTIDE as the incorporator and the director and listed 9821 Solar

Course, North Laurel, MD 20723, as the location of his business.

14. During the course of this investigation, AFOSI jointly worked with a travel

voucher auditor for the United States Air Force Reserves. The audit revealed that according to

the Joint Federal Travel Regulations (JFTR), ARISTIDE would not be entitled to lodging, per

diem, and travel expenses if a resident of Maryland. By claiming he lived at 7 Nostrand Place,

Hempstead, NY, ARISTIDE received approximately $22,614 in entitlements during his time at

DLA between August 5,2013 and December 20,2013.

15. ARISTIDE was interviewed by AFOSI on July 17,2014. During the interview he

confirmed that he purchased a home in Maryland, registered as a Maryland resident in order to

vote, and used his Maryland residence as an authorized telework site while employed by OPM.

ARISTIDE could not explain why he retained 7 Nostrand Place, Hempstead, NY while on orders

to DLA.

16. ARISTIDE also stated during the interview that his cellular telephone ("target cell

phone") had thirty-two 32 gigabytes of memory.

17. Your affiant knows that iPhone cellular telephones are known to have built-in

Global Positioning System (GPS) receivers that store Exchangeable Image File Format ("Exif')

data when a photographic image is taken. Exif is a standard that specifies the formats for images,

sound, and ancillary tags used by digital cameras to include smartphones. The storing of GPS

information within the Exif is commonly referred to as "geotagging." Geotagging is done by

assigning a latitude and longitude to a photographic image. Many smartphones like the iPhone

automatically "geotag" their photos by default. Thirty-two (32) gigabytes of memory could store

thousands of images containing latitudinal and longitudinal information.

5


18. Additionally, in my training and experience, I have learned that AT&T Mobility

is a company that provides cellular telephone access to the general public. I also know that

providers of cellular telephone service have technical capabilities that allow them to collect and

generate at least two kinds of current and historical information about the locations of the

cellular telephones to which they provide service: (1) E-911 Phase II data, also known as GPS

data or latitude-longitude data, and (2) cell-site data, also known as "tower/face information" or

cell tower/sector records. E-911 Phase II data provides relatively precise location information

about the cellular telephone itself, either via GPS tracking technology built into the phone or by

triangulating on the device's signal using data from several of the provider's cell towers. Cell-

site data identifies the "cell towers" (i.e. antenna towers covering specific geographical areas)

that received a radio signal from the cellular telephone and, in some cases, the "sector" (i.e. faces

of the towers) to which the telephone connected. These towers are often a half-mile or more

apart, even in urban areas and can be 10 or more miles apart in rural areas. Furthermore, the

tower closest to a wireless device does not necessarily serve every call made to or from the

device. Accordingly, cell-site data is typically less precise that E-911 Phase II data.

19. Based on my experience, I know that AT&T Mobility can collect historical cell-

site data about the Target Cell Phone which list cellular tower sites used to make or receive calls

by ARISTIDE during August 5, 2013 through December 20,2013.

TECHNICAL TERMS

20. Based on my training and experience, I use the following technical terms to

convey the following meanings:

a. Wireless telephone: A wireless telephone (or mobile telephone, or

cellular telephone) is a handheld wireless device used for voice and data communication

6


through radio signals. These telephones send signals through networks of

transmitter/receivers, enabling communication with other wireless telephones or

traditional "land line" telephones. A wireless telephone usually contains a "call log,"

which records the telephone number, date, and time of calls made to and from the phone.

In addition to enabling voice communications, wireless telephones offer a broad range of

capabilities. These capabilities include: storing names and phone numbers in electronic

"address books;" sending, receiving, and storing text messages and e-mail; taking,

sending, receiving, and storing still photographs and moving video; storing and playing

back audio files; storing dates, appointments, and other information on personal

calendars; and accessing and downloading information from the Internet. Wireless

telephones may also include global positioning system ("GPS") technology for

determining the location of the device.

b. Digital camera: A digital camera is a camera that records pictures

as digital picture files, rather than by using photographic film. Digital cameras use a

variety of fixed and removable storage media to store their recorded images. Images can

usually be retrieved by connecting the camera to a computer or by connecting the

removable storage medium to a separate reader. Removable storage media include

various types of flash memory cards or miniature hard drives. Most digital cameras also

include a screen for viewing the stored images. This storage media can contain any

digital data, including data unrelated to photographs or videos.

c. GPS: A GPS navigation device uses the Global Positioning System to

display its current location. It often contains records the locations where it has been.

Some GPS navigation devices can give a user driving or walking directions to another

7


location. These devices can contain records of the addresses or locations involved in

such navigation. The Global Positioning System (generally abbreviated "GPS") consists

of 24 NA VST AR satellites orbiting the Earth. Each satellite contains an extremely

accurate clock. Each satellite repeatedly transmits by radio a mathematical representation

of the current time, combined with a special sequence of numbers. These signals are sent

by radio, using specifications that are publicly available. A GPS antenna on Earth can

receive those signals. When a GPS antenna receives signals from at least four satellites, a

computer connected to that antenna can mathematically calculate the antenna's latitude,

longitude, and sometimes altitude with a high level of precision.

21. Based on my training experience, and research, I know that the device has

capabilities that allow it to serve as a wireless telephone, digital camera, GPS navigation device

and PDA. In my training and experience, examination data stored on devices of this type can

uncover, among other things, evidence that reveals the location where the device was present and

was used.

22. Forensic evidence. As further described in Attachment B, this application seeks

permission to locate not only electronically stored information that might serve as direct

evidence of the crimes described on the warrant, but also forensic evidence that establishes how

the devices were used, the purpose of their use, who used them, and when. There is probable

cause to believe that this forensic electronic evidence might be on the device because:

a. Data on the storage medium can provide evidence of a file that was

once on the storage medium but has since been deleted or edited, or of a deleted portion

of a file (such as a paragraph that has been deleted from a word processing file). Virtual

memory paging systems can leave traces of information on the storage medium that show

8


what tasks and processes were recently active. Web browsers, e-mail programs, and chat

programs store configuration information on the storage medium that can reveal

information such as online nicknames and passwords. Operating systems can record

additional information, such as the attachment of peripherals, the attachment of USB

flash storage devices or other external storage media, and the times the computer was in

use. Computer file systems can record information about the dates files were created and

the sequence in which they were created.

b. Forensic evidence on a device can also indicate who has used or

controlled the device. This "user attribution" evidence is analogous to the search for

"indicia of occupancy" while executing a search warrant at a residence.

c. A person with appropriate familiarity with how an electronic

device works may, after examining this forensic evidence in its proper context, be able to

draw conclusions about how electronic devices were used, the purpose of their use, who

used them, and when.

d. The process of identifying the exact electronically stored

information on a storage medium that are necessary to draw an accurate conclusion is a

dynamic process. Electronic evidence is not always data that can be merely reviewed by

a review team and passed along to investigators. Whether data stored on a computer is

evidence may depend on other information stored on the computer and the application of

knowledge about how a computer behaves. Therefore, contextual information necessary

to understand other evidence also falls within the scope of the warrant.

9


e. Further, in finding evidence of how a device was used, the purpose

of its use, who used it, and when, sometimes it is necessary to establish that a particular

thing is not present on a storage medium.

23. Nature of examination. Based on the foregoing, and consistent with Rule 41(e)

the warrant I am applying for would permit the examination of the device consistent with the

warrant. The examination may require authorities to employ techniques, including but not

limited to computer-assisted scans of the entire medium, that might expose many parts of the

device to human inspection in order to determine whether it is evidence described by the warrant.

24. Manner of execution. Because this warrant seeks only permission to examine

devices already in law enforcement's possession, the execution of this warrant does not involve

the physical intrusion onto any premises. Consequently, I submit there is reasonable cause for

the Court to authorize execution of the warrant at any time in the day or night.

CONCLUSION

25. Based on the forgoing, I submit that there is probable cause that ARISTIDE has

committed the following federal offenses: 18 U.S.C. S 287, False, Fictitious or Fraudulent

Claims and 18 U.S.c. S 641, Theft of Public Money. Moreover, I submit that there is probable

cause to believe that evidence of the aforementioned offenses is contained within the Exif data of

photographic images stored on the "Target Cell Phone."

10


21. I declare under the penalty of perjury that the foregoing is true and correct to the

best of my knowledge.

Sworn to and subscribed before me in Greenbelt, Maryland, this 6th day of August, 2014.

\.,::) .-su.,.... e-- C_ - ~William Connelly, U.S. Magistrate Judge'

11


ATTACHMENT A

Property to be Searched

The property to be searched is a black Apple iPhone, Model iPhone 5 cellular telephone,

Model number A1428, International Mobile Subscriber Identity Number: 013333009183120,

FCC ID: BCG-E2599A, IC: 579C-E2599A, currently located at AFOSI offices, ih Field

Investigations Squadron, 1413 Arkansas Road, Joint Base Andrews, Maryland 20762.

This warrant authorizes he forensic examination of the device for the purpose of

identifying the electronically stored information described in Attachment B.


ATTACHMENT B

Particular Things to be Seized

All photographic images, files, formats and applications containing GPS latitudinal and

longitudinal information found within the thirty-two (32) gigabytes of memory of the Target Cell

Phone stored in evidence under the custody of AFOSI 7 FIS Joint Base Andrews, MD: One (1)

black in color, Apple iPhone, Model iPhone 5 cellular telephone, Model number A 1428,

International Mobile Subscriber Identity Number: 013333009183120, FCC ID: BCG-E2599A,

IC: 579C-E2599A.

~---~---------------------~


AO 106 (Rev~60) Applicalli>£ilfliEl3~arch WarrantprCEDED.-LUGGED __

UNITED STATES DISTRICT COURTfor the

District of Maryland

BY

AUG 292014AT GREENBELT

CLERK U S DISTRICT COURTD\SlRICTOF MARY~N~

r~..JDEPUTYIn the Matter of the Search of

(Briefly describe the property to be searchedor identify the person by name and address)

See attachment A

))))))

Case No. \ '-' - \~ '-~ ~c.

APPLICA TION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state underpenalty of perjury that I have reason to believe that on the following person or property (identify the person or describe theproperty to be searched and give its location):

See attachment A

located in the District of Maryland , there is now concealed (identify theperson or describe the property to be seized):a black Apple iPhone, Model iPhone 5 cellular telephone, Model number A1428, International Mobile SubscriberIdentity Number: 013333009183120, FCC 10: BCG-E2599A, IC: 579C-E2599A, currently located at AFOSI offices, 7thField Investigations Squadron, 1413 Arkansas Road, Joint Base Andrews, Maryland 20762

The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more):

Mevidence of a crime;

o contraband, fruits of crime, or other items illegally possessed;

o property designed for use, intended for use, or used in committing a crime;

o a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section18 U.S.C. ~~ 287, 641

Offense DescriptionFalse Claims Act, Theft of Government Property

The application is based on these facts:

See attached affidavit.

I'lf Continued on the attached sheet.

o Delayed notice of __ days (give exact ending date if m n 30 days: ) is requestedunder 18 U.S.C. S 31 03a, the basis of which is set fo on the attac

Special Agent Jesse rgueta, AFOSIPrinted name and title

Sworn to before me and signed in my presence.

Date: 08/06/2014 '-..:::> .->-.\-, e--C • '-Sl \Judge's signature \

City and state: Greenbelt, Maryland William Connelly, United States Magistrate JudgePrinted name and title

Case 8:14-mj-01760-WGC Document 2 Filed 08/29/14 Page 1 of 1

FILED _ ENTERED~ LOGGED _RECEIVED

BV

AUG 292014ATGREENRBECl:TJCOURT IN THE UNITED STATES DISTRICT COURT

CLERK U.S.DIST IDISTRICTOFMARY~ FOR THE DISTRICT OF MARYLAND.n...; DepUTYIN RE ORDER REQUIRING APPLE, )INC. TO ASSIST IN THE )EXECUTION OF A SEARCH )WARRANT ISSUED BY )THIS COURT )

----------)

CASE NO.

INTRODUCTION

The United States of America, through its attorneys, Rod J. Rosenstein, United States

Attorney for the District of Maryland, and Hollis Raphael Weisman, Assistant United States

Attorney for said District, hereby moves this Court under the All Writs Act, 28 U.S.C. 9 1651,

for an order requiring Apple, Inc. ("Apple") to assist in the execution of a federal search warrant

by bypassing the lock screen of one iOS device, specifically, an Apple iPhone.

FACTS

The Air Force Office of Special Investigations (AFOSI) currently has in its possession

one iOS devices that is e the subject of a search warrant issued by this Court. Initial inspection

of the iOS device reveals that it is locked. Because the iOS device is locked, law enforcement

agents are not able to examine the data stored on the iOS device as commanded by the search

warrant.

The iOS devices is a black Apple iPhone, Model iPhone 5 cellular telephone, Model

number A1428, International Mobile Subscriber Identity Number: 013333009183120, FCC ID:

BCG-E2599A, IC: 579C-E2599A, currently located at AFOSI offices, ih Field Investigations

Squadron, 1413 Arkansas Road, Joint Base Andrews, Maryland 20762.

Apple, the creator of the iOS operating system and producer of the iOS devices, may

have the capability retrieving data stored on the iOS devices that is not currently accessible to the

1


DEA because the iOS devices are locked. This Application seeks an order requiring Apple to

use any such capability, so as to assist agents in complying with the search warrant.

DISCUSSION

The All Writs Act provides that "(t)he Supreme Court and all courts established by Act of

Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and

agreeable to the usages and principles of law." 28 U.S.C. S 1651(a). As the Supreme Court

explained, "(t)he All Writs Act is a residual source of authority to issue writs that are not

otherwise covered by statute." Pennsylvania Bureau of Correction v. United States Marshals

Service, 474 U.S. 34, 43 (1985). "The power conferred by the Act extends, under appropriate

circumstances, to persons who, though not parties to the original action or engaged in

wrongdoing, are in a position to frustrate the implementation of a court order or the proper

administration of justice ... and encompasses even those who have not taken any affirmative

action to hinder justice." United States v. New York Tel. Co., 434 U.S. 159, 174 (1977).

Specifically, in New York Tel. Co., the Supreme Court held that the All Writs Act permitted

district courts to order a telephone company to effectuate a search warrant by installing a pen

register. Under the reasoning of New York Tel. Co., this Court has the authority to order Apple to

use any capabilities it may have to assist in effectuating the search warrant.

The government is aware, and can represent, that in other cases, courts have ordered

Apple to assist in effectuating search warrants under the authority of the All Writs Act.

Additionally, Apple has complied with such orders.

The requested order would enable agents to comply with this Court's warrant

commanding that the iOS devices be examined for evidence identified by the warrant.

Examining the iOS devices without Apple's assistance, if it is possible at all, would require

2


significant resources and may harm the iOS devices. Moreover, the order is not likely to place

any unreasonable burden on Apple.

Respectfully submitted,

3


IN THE UNITED STATES DISTRICT COURTFOR THE DISTRICT OF MARYLAND

IN RE ORDER REQUIRING APPLE, )INC. TO ASSIST IN THE )EXECUTION OF A SEARCH )WARRANT ISSUED BY )THIS COURT )

----------)

CASE NO. \ '-\. -

ORDER

Before the Court is the Government's motion for an order requmng Apple, Inc.

("Apple") to assist law enforcement agents in the search of two Apple iOS devices. Upon

consideration of the motion, and for the reasons stated therein, it is hereby

ORDERED that Apple assist law enforcement agents in the examination of the following

iOS device: a black Apple iPhone, Model iPhone 5 cellular telephone, Model number A1428,

International Mobile Subscriber Identity Number: 013333009183120, FCC ID: BCG-E2599A,

IC: 579C-E2599A, currently located at AFOSI offices, ih Field Investigations Squadron, 1413

Arkansas Road, Joint Base Andrews, Maryland 20762, (the "iOS Devices"), acting in support

of a search warrant issued separately by this Court;

FURTHER ORDERED that Apple shall provide reasonable technical assistance to enable

law enforcement agents to obtain access to unencrypted data ("Data") on the iOS Devices.

FURTHER ORDERED that, to the extent that data on the iOS Devices is encrypted,

Apple may provide a copy of the encrypted data to law enforcement, but Apple is not required to

attempt to decrypt, or otherwise enable law enforcement's attempts to access any encrypted data;

FURTHER ORDERED that Apple's reasonable technical assistance may include, but is

not limited to, bypassing the iOS Devices users' pass codes so that the agents may search the iOS

Devices, extracting data from the iOS Devices and copying the data onto an external hard drive


or other storage medium that law enforcement agents may search, or otherwise circumventing

the iOS Devices' security systems to allow law enforcement access to Data and to provide law

enforcement with a copy of encrypted data stored on the lOS Devices;

FURTHER ORDERED that although Apple shall make reasonable efforts to

maintain the integrity of data on the iOS Devices, Apple shall not be required to maintain copies

of any user data as a result of the assistance ordered herein; all evidence preservation shall

remain the responsibility of law enforcement agents.

Dated: August 6, 2014

\,..::) ~r_ c.-... c.. ....S)Honorable William Connelly \United States Magistrate Judge


)COU.RTDISTRICTOF - ACLU

Documents

Transcript of )COU.RTDISTRICTOF - ACLU