FindLaw Ys. SEALED 08-Og2-M-01 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANT. 1, Marlo Arredondo, being first duly sworn, hereby depose and state as follows: A. Introduction and Agent Background I make this affidavit in support of an application for a search warrant for certain accounts, controlled by the free web-based electronic mail service provider known as (1) Yahoo!, Inc. (Yahoo!), located at 701 First Avenue, Building D, Sunnyvale, California 94089; (2) America Online, Inc. (AOL), 2200 AOL Way, Dulles, VA 20166; and (3) MSN Hotmail Micrososft Corp. (MSN Hotmail}, 1065 La Avenida, Building 4, Mountain View, California 94043, The accounts ¢o be searched at Yahoo! are: jimmyflathead|at]yahoo[dot|com; and SRE 2 ctcsjcom The account to be searched at AOL is: Unite 3} For tha Di kingbadger7[at]aol{dot}eom un Count trict of Columbia ‘The account to be searched at MSN Hotmail is: 3 SG #11081 (c0¢00m ‘These accounts are further described in the following paragraphs and in Attachment A. As set forth herein, there is probable cause to believe that on the computer systems of Yahoo!, AOL, and MSN Hotmail, there exists evidence, fruits, and instrumentalities of violations of Title 18, United States Code, Sections 2332 and 2332a. 1am a Special Agent of the Federal Bureau of Investigation (FBD and have been so employed for approximately two years. As a Special Agent of the FBI, I investigate a crime involving the dissemination of a Weapon of Mass Destruction (anthrax) in violation of Title 18, United States Code, Sections 2332(a) and 1114. The definitions provided herein are based on my knowledge and experience as an FBI Agent, and consultations with other criminal investigators, ‘The FBI and the U.S. Postal Inspection Service {hereinafter Task Force) investigation of the anthrax attacks of 2001 has led to the identification of Dr. Bruce Edwards Ivins, an anthrax researcher at the U.S. Army Medicai Research Institute for Infectious Diseases (USAMRIID), Fort Detrick, Maryland, as a person necessitating further investigation for several reasons: (1) At the time of the attacks, he was the custodian of a large flask of highly purified anthrax spores that possess certain genetic mutations identical to the anthrax used in the attacks; (2) Ivins has been. unable to give investigators an adequate explanation for his late night work hours for which he was the only person in the laboratory around the time of both anthrax maifings; (3) Ivins is,FindLaw Ys. believed to have submitted false samples of anthrax from his lab to the FBI for forensic analysis in order to mislead investigators; (4) at the time of the attacks, Ivins was under pressure at work to assist a private company that had lost its FDA approval to produce an anthrax vaccine the Amny needed for U.S. troops, and which Ivins believed was essential for the anthrax program at USAMRIID; and (5) Ivins sent an e-mail to a Jew days before the anthrax attacks warnin| it "Bin Laden terrorists for sure have anthrax and sarin gas" and have "just decreed death to all Jews and all Americans," language similar to the anthrax letters waming "WE HAVE THIS ANTHRAX ... DEATH TO AMERICA ... DEATH TO ISRAEL.” ‘The Task Force submits that a search of the Subject e-mail accounts may reveal documentary evidence that will assist the investigation by linking Dr. Bruce Edwards Ivins to the anthrax mailings and identify conspirators involved in the attacks. The search is for computer files, e-mail accounts, or documentary evidence as more fully described in Attachment A to the search warrants, affixed to this affidavit. In my training and experience, Ihave leamed that Yahoa!, AOL, and MSN Hotmail sre companies that provide fife web-based Intemet electronic mail (e-mail) access to the general public, and that stored electronic communications, including opened and unopened e-mail for subscribers to these services may be located on the computers of Yahoo!, AOL, and MSN Hotmail. Further, 1 am aware that computers located at Yahoo!, AOL, and MSN Hotmail contain information and other stored electronic communications befonging to unrelated third parties, Accordingly, this affidavit and application for search warrants seeks authorization solely to search the computer accounts and/or files and following the procedures described herein and in Attachment A B, Search Procedure In order to facilitate seizure by law enforcement of the records and information described in Attachment A, this affidavit and application for search warrant seek authorization to permit employees of Yahoo!, AOL, and MSN Hotmail to assist agents in the execution of this warrant. In executing this warrant, the following procedures will be implemented: a, The search warrant will be presented to Yahoo!, AOL, and MSN Hotmail personnel who will be directed to isolate those accounts and files described in Attachment A; b. In order to minimize any disruption of computer service to innocent third parties, Yahoo!, AOL, and MSN Hotmail employees and/or law enforcement personnel trained in the operation of computers will create an exact duplicate of the computer accounts and files described in Attachment A, including an exact duplicate of all information stored in the computer accounts and files described in Attachment A; c. Yahoo!, AOL, and MSN Hotmail emptoyees will provide the exact duplicate in electronic form or paper copy of the accounts and files described in Attachment A and all information stored in those accounts and files to the agent who serves this search warrant; andFindLaw Ys. . Law_enforcement personnel will thereafter review all information and records received from Hotmail employees to determine the information to be seized by law enforcement personnel pursant to Attachment A. C. Background Regarding Computers, the Internet, and E-Mi The term “computer” as used herein is defined in 18 U.S.C. § 1030(€X(1), and includes an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device. Ihave had both training and experience in the investigation of computer-related crimes. Based on my training, experience and knowledge, I know the following: a, The Intemet is a worldwide network of computer systems operated by governmental entities, corporations, and universities. In order to access the Internet, an individual computer user must subscribe to an access provider, which operates a host computer system with direct access to the Internet. The world wide web (“www”) is a functionality of the Internet which allows users of the Internet to share information; b. With a computer connected to the Internet, an individual computer user can make electronic contact with millions of computers around the World, ‘This connection cart be made by any number of means, including modem, local area network, wireless and numerous other methods; and ©. E-mail is a popular form of transmitting messages and/or files in an electronic environment between computer users. When an individual computer user sends e-mail, itis initiated at the user's computer, transmitted to the subscriber’s mail server, then transmitted to its final destination. A server is a computer that is attached to a dedicated network and serves many users, An e-mail server may allow users to post and read messages and to communicate via electronic means. D. Yahoo!, AOL, and MSNHotmail Based on my training and experience, I have leamed the following about Yaltoo!, AOL, and MSN Hotmail: Yahoo!, AOL, and MSN Hotmail provide e-mail services which are available free of charge to Internet users. Subscribers obtain an account by registering on the Internet with Yahoo!, AOL, or MSN Hotmail. Yahoo!, AOL, and MSN Hotmail requests subscribers to provide basic information such as name, gender, ZIP code, and other personaV/biographical