22M528 Sealed Application
22M528 Sealed Application
22M528 Sealed Application
UNDER SEAL
I, Barrett J. Rife, a Special Agent of the Federal Bureau of Investigation, request a search warrant and state
under penalty of perjury that I have reason to believe that on the following property or premises:
See Attachment A
located in the Northern District of California, there is now concealed:
See Attachment A, Part III
The basis for the search under Fed. R. Crim. P. 41(c) is evidence and instrumentalities.
The search is related to a violation of:
Code Section Offense Description
Title 18, United States Code, Section 2332a(a)(2)(A),(D) Threatening, attempting, or conspiring to use a weapon
of mass destruction without lawful authority against any
person or property within the United States, using the
mail or a facility of interstate commerce in furtherance
of the offense and which threat, attempt, or conspiracy
would have affected interstate commerce.
The application is based on these facts:
See Attached Affidavit,
Continued on the attached sheet.
City and State: Chicago, Illinois M. DAVID WEISMAN, U.S. Magistrate Judge
Printed name and title
UNITED STATES DISTRICT COURT )
)
NORTHERN DISTRICT OF ILLINOIS )
AFFIDAVIT
I have been in this position since 2018. I am currently assigned to the Chicago Field
Office, West Resident Agency, Squad CT-2. As a part of my duties as a FBI Special
criminal violations including, but not limited to Title 18, United States Code, Sections
841, 842, 875, 922, 924, 2332a, and Title 26 United States Code, Section 5861. I have
been involved with various electronic surveillance methods, the debriefing of subjects,
informants, and witnesses, as well as others who have knowledge of weapons of mass
search, pursuant to Title 18, United States Code, Sections 2703(a), 2703(b)(1)(A) and
2703(c)(1)(A), for information associated with certain accounts that are stored at the
(collectively, the “Subject Accounts”) 1, which are further described in the following
and on information I have received from other law enforcement personnel and from
persons with knowledge regarding relevant facts. Because this affidavit is being
submitted for the limited purpose of securing a search warrant, I have not included
each and every fact known to me concerning this investigation. I have set forth facts
that I believe are sufficient to establish probable cause to believe that evidence and
I. BACKGROUND INFORMATION
A. Google
Google’s website (google.com), I have learned the following information about Google
and Gmail:
1On or about July 7, 2022, the FBI sent a preservation letter to Google for the aforementioned
Gmail accounts, pursuant to 18 U.S.C. § 2703(f), requesting that Google preserve data
associated with the Subject Accounts.
2
a. Google offers a collection of Internet-based services, including
email and online data storage, which is owned and controlled by Google. The services
are available at no cost to Internet users, though there are certain options, such as
additional online data storage, that users may elect to pay money to receive.
providing Google with basic information, including name, gender, zip code, and other
and entities who maintain Google online subscriber accounts. These records often
stored in the subscriber’s “mail box” on Google’s servers until the subscriber deletes
the email or the subscriber’s mailbox exceeds the storage limits preset by Google. If
the message is not deleted by the subscriber, the account is below the maximum
storage limit, and the subscriber accesses the account periodically, that message can
transferred via the Internet to Google’s servers, and then transmitted to its end
destination. Google online account users have the option of saving a copy of the email
3
sent. Unless the sender of the email specifically deletes the email from the Google
not limited to emails, documents, and image files, on servers maintained and/or
owned by Google.
known as “History” that allows a user to track various historical account activity,
which have been used to login to the Google online account, and physical location
information regarding from where the Google online account was accessed. Based on
publicly available information, I believe Google collects web history unless the user
opts out.
g. Google keeps records that can reveal accounts accessed from the
same electronic device, such as the same computer or mobile phone, including
accounts that are linked by “cookies,” which are small pieces of text sent to the user’s
following information:
through Google Contacts. Google Contacts stores contacts the user affirmatively adds
to the address book, as well as contacts the user has interacted with in Google
4
products. Google Contacts can store up to 25,000 contacts. Users can send messages
to more than one contact at a time by manually creating a group within Google
Contacts or communicate with an email distribution list called a Google Group. Users
have the option to sync their Android mobile phone or device address book with their
account so it is stored in Google Contacts. Contacts can be accessed from the same
mobile application. Users can create events or RSVP to events created by others in
Google Calendar. Google Calendar can be set to generate reminder emails or alarms
about events or tasks, repeat events at specified intervals, track RSVPs, and auto-
schedule appointments to complete periodic goals (like running three times a week).
A single Google Account can set up multiple calendars. An entire calendar can be
shared with other Google Accounts by the user or made public so anyone can access
it. Users have the option to sync their mobile phone or device calendar so it is stored
in Google Calendar. Calendar can be accessed from the same browser window as
including Duo, Messages, Hangouts, Meet, and Chat. These services enable real-time
text, voice, and/or video communications through browsers and mobile applications,
and also allow users to send and receive text messages, videos, photos, locations,
5
links, and contacts.
automatically created for each Google Account. Users can store an unlimited number
(Google’s web form service), and Google Slides, (Google’s presentation program).
Users can also upload files to Google Drive, including photos, videos, PDFs, and text
documents, until they hit the storage limit. Users can set up their personal computer
or mobile phone to automatically back up files to their Google Drive Account. Each
user gets 15 gigabytes of space for free on servers controlled by Google and may
purchase more through a subscription plan called Google One. In addition, Google
Drive allows users to share their stored files and documents with up to 100 people
and grant those with access the ability to edit or comment. Google maintains a record
Documents shared with a user are saved in their Google Drive in a folder called
that lets users take notes and share them with other Google users to view, edit, or
comment. Google Keep notes are stored indefinitely unless the user deletes them.
Android device users can also use Google Drive to backup certain data from their
device. Android backups on Google Drive may include mobile application data, device
6
settings, file downloads, and SMS messages.
service called Google Photos. Users can share or receive photos and videos with
others. Google Photos can be trained to recognize individuals, places, and objects in
photos and videos and automatically tag them for easy retrieval via a search bar.
Users have the option to sync their mobile phone or device photos to Google Photos.
g. Maps: Google offers a map service called Google Maps which can
be searched for addresses or points of interest. Google Maps can provide users with
options (driving, biking, walking, etc.) and real-time traffic updates. Users can share
their real-time location with others through Google Maps by using the Location
Sharing feature. And users can find and plan an itinerary using Google Trips. A
Google Account is not required to use Google Maps, but if users log into their Google
Account while using Google Maps, they can save locations to their account, keep a
history of their Google Maps searches, and create personalized maps using Google
My Maps.
location at which Google Account services are accessed from any mobile device, as
well as the periodic location of Android devices while they are in use. This location
data can derive from a range of sources, including GPS data, Wi-Fi access points, cell-
site locations, geolocation of IP addresses, sensor data, user searches, and Bluetooth
7
beacons within range of the device. According to Google, this location data may be
associated with the Google Account signed-in or registered to the device when
Location Services are activated on the device and the user has enabled certain global
settings for their Google Account, such as Location History or Web & App Activity
tracking. The data retained may be both precision location data, like latitude and
longitude coordinates derived from GPS, and inferential location data, such as the
searches about places to eat in New York and directions from one New York location
margin of error. Inferential data is stored with an account’s Web & App Activity.
Corporation, provides Google Accounts an online payment service called Google Pay
(previously Google Wallet), which stores credit cards, bank accounts, and gift cards
for users and allows them to send or receive payments for both online and brick-and
service called Google Chrome which facilitates access to the Internet. Chrome retains
a record of a user’s browsing history and allows users to save favorite sites as
bookmarks for easy access. If a user is logged into their Google Account on Chrome
and has the appropriate settings enabled, their browsing history, bookmarks, and
8
other browser settings may be saved to their Google Account in a record called My
Activity.
books, movies, and music, and mobile applications from the Google Play Store. Google
Play records can include records of whether a particular application has been or is
through which a Google Account can be assigned a telephone number that can be
used to make, record, and forward phone calls and send, receive, store, and forward
SMS and MMS messages from a web browser, mobile phone, or landline. Google
that offers Google Accounts the ability to upload videos and share them with others.
Users can create a YouTube channel where they can upload videos, leave comments,
and create playlists available to the public. Users can subscribe to the YouTube
channels of others, search for videos, save favorite videos, like videos, share videos
with others, and save videos to watch later. More than one user can share control of
a YouTube channel. YouTube may keep track of a user’s searches, likes, comments,
and change history to posted videos. YouTube also may keep limited records of the
IP addresses used to access particular videos posted on the service. Users can also
9
6. Further, Google typically retains certain transactional information
about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of
log-in (i.e., session) times and durations, the types of service used, the status of the
account (including whether the account is inactive or closed), the methods used to
connect to the account (such as logging into the account via Google’s website), and
other log files that reflect usage of the account. In addition, Google often has records
of the IP address used to register the account and the IP addresses associated with
particular logins to the account. Because every device that connects to the Internet
must use an IP address, IP address information can help to identify the computers or
hardware model, operating system version, unique device identifiers, and mobile
network information including phone number. Google states it also may collect and
process information about a user’s location, based on IP address, GPS, and other
sensors that, for example, may provide Google with information on nearby devices,
8. Therefore, the computers of Google are likely to contain all the material
concerning subscribers and their use of Google, such as account access information,
10
objective of the search warrant with a minimum of interference with the business
activities of Google, to protect the rights of the subjects of the investigation and to
digital copy of the entire contents of the information subject to seizure specified in
federal agent. The contents will then be analyzed to identify records and information
July 4, 2022, the City of Highland Park, Illinois, hosted an Independence Day parade
in the downtown Highland Park area. Citizens observing the parade were gathered
along the route lining Central Avenue. The parade began at approximately 10:00
a.m.
later identified as Robert E. CRIMO III (“CRIMO”), located on the roof of Company
A, a cosmetics shop, located on the 600 block of Central Avenue, Highland Park,
Illinois, opened fire using a semi-automatic rifle on the crowd gathered to watch the
11
dozens more. CRIMO was observed fleeing the area on foot, was captured on a
surveillance video dropping a rifle out of his bag, and a Smith & Wesson rifle model
M&P 15 purchased by CRIMO was recovered in the vicinity of the attack. CRIMO’s
prints were recovered on the rifle, and his DNA was found on the rifle as well as three
rifle magazines. Law enforcement reviewed the public facing website of Company A
and observed that Company A sells products from a company that manufactures its
CRIMO was arrested by local law enforcement near North Chicago, Illinois, after his
vehicle was spotted in the area. CRIMO was taken to the Highland Park Police
Department, where he was informed of his rights and gave a voluntary statement to
law enforcement in which, among other things, he admitted to responsibility for the
shooting.
CRIMO fled on foot to his mother’s house 2 where he got in a vehicle. According to
security video obtained from his father’s residence, CRIMO arrived at his father’s
2Based on the recorded statement, CRIMO’s parents are separated and live separately from
each other.
12
to CRIMO’s recorded interview he then traveled to the Madison, Wisconsin, area.
data was provided to law enforcement which showed the device associated with
CRIMO buried the phone in the Madison, Wisconsin, area before returning to Illinois,
father was present at the residence and provided law enforcement with consent to
search the premises. 3 Among other things, the search resulted in the recovery from
CRIMO’s living area of indicia of residence for CRIMO, multiple firearms, and bomb-
making materials.
13
14. According to FBI reports, in CRIMO’s rear apartment, law enforcement
initiator, two plastic jugs with ammunition attached to the outside, a funnel, and two
boxes of Tannerite. 4 Pictured below is the remote initiator (top left), containers of
Tannerite (top right), one of the boxes of Tannerite (middle left), and jugs with
4CRIMO’s DNA was recovered on the cap of one of the jugs as well as a Tannerite container,
and his prints were found on a Tannerite packaging slip, shipping container, and pamphlet.
14
15. Further, based on FBI reports, on July 4, 2022, in an upstairs bedroom
of the single-family home to which CRIMO had access and stored personal effects,
father consented to an additional search by the FBI that resulted in the further
recovery from the same bedroom of batteries, electrical wiring, a capacitor, circuit
Bomb Technicians, I know that the above components are explosive precursors that
15
can be assembled into an Improvised Explosive Device (“IED”) for use as a weapon of
mass destruction.
nitrate) and fuel (finely powdered aluminum powder). As long as the fuel is not mixed
with the oxidizers there is no hazard; however, if mixed and subject to severe force—
such as an impact from a bullet fired from a rifle—the substance becomes a high
explosive designed to produce a visual and audible display often used in targets for
firearms practice.
used as an explosive main charge to be initiated with the shock from a blasting cap
Oregon. In the consent search of CRIMO’s residence, the Tannerite was found in its
original shipping packaging. The FedEx packaging labels indicate that there were
two shipments, one on May 3, 2022, and one on June 1, 2022. Both shipments were
sent to CRIMO at CRIMO’s residence. The shipping labels also indicate that the
16
20. On or about July 5, 2022, CRIMO signed a Consent to Search Form and
gave written and verbal consent to search his cellular telephone (“Phone 1”). During
the search of Phone 1, law enforcement found two screenshots of invoices from
4, 2022, following his arrest, CRIMO was informed of his rights and gave a voluntary
17
statement to law enforcement. During the course of that statement—which took
place over two interviews on July 4 and July 5, 2022—CRIMO confessed to the
purchasing the Tannerite and other IED components consistent with the items
recovered from his residence. He described making explosive devices in the preceding
ammonium and aluminum on the internet. CRIMO was asked if he used devices
other than his cellular telephone to access the internet and he answered in the
negative. CRIMO’s cellular telephone was later recovered by FBI. 6 CRIMO also
23. CRIMO described the devices he created, and which were recovered from
his room, as consisting of milk jugs, bullets, duct tape, and Tannerite. In describing
the composition of the IED, CRIMO said that he could have used BBs (ball bearings),
5 This Affidavit contains summaries of certain material covered during the recorded interview
of CRIMO. This Affidavit does not include references to all of the topics covered during the
course of the interview. For some of the material covered in this Affidavit from the interview,
I have interpreted portions of the conversation, which are at times shown below in brackets
based upon (a) the contents and context of the conversations, (b) my experience and training
as a law enforcement officer, (c) the experience and training of other law enforcement officers
involved in this investigation, and (e) the other information gathered during the course of the
investigation.
6 During the interview, CRIMO described having buried his cellular telephone to avoid
detection by law enforcement. CRIMO described the location the telephone was buried,
specified the manufacturer was Samsung, gave his telephone number as 224-477-8741, and
gave the passcode for the device. The telephone was recovered by law enforcement near the
location specified by CRIMO, was a Samsung device with telephone number 224-477-8741,
and the phone had the same passcode as given by CRIMO.
18
but he already had bullets so he “might as well just tape the bullets together.” Based
Technicians, I know that ball bearings are common components used in an explosive
24. According to the recording, CRIMO further stated in the interview that
he kept the jugs with bullets affixed to them locked in a backpack because he did not
want anyone else in the home to encounter them and hurt themselves. When asked
to describe the jugs, CRIMO said, “They are supposed to be a binary explosive.” When
asked what he was going to use an explosive for, CRIMO responded, “You know,
whatever happens, happens . . . if I were to use it, it would be by chance because, you
know, they are heavy, you can only carry so many things.”
25. CRIMO walked from his residence to the parade on the morning of July
4, 2022. Based on my training and experience, I believe CRIMO was saying that the
explosive devices were too heavy to carry to the parade, but he considered using them
if the opportunity arose. CRIMO also said that he made electrical circuits in the past,
“Of course I had the idea in my mind that it could be used for nefarious reasons.”
26. Later in the interviews, CRIMO was asked about his intent for the IED
components. CRIMO responded, “It could have been used for an incident, it could
have been used but it wasn’t.” CRIMO continued, “It could have been planted if it
19
worked, in theory it could have been planted . . . somewhere where it could cause
harm.” CRIMO also stated, “If it worked, I might have planted it early, or I might
have just sat down, left the bag there, and walked away.” CRIMO referred to that
statement as a “theory.” CRIMO further elaborated that he had to fit all the
Tannerite in the two jugs and that the IED would weigh about 20 pounds, the weight
of which would be too much because he was also carrying his rifle.
explained, “For this one [attack], no, I had just, you know, possibly if the situations
were to line up correctly, maybe.” CRIMO continued, “If everything lined up correctly
then I would use it, but it didn’t.” The interviewer asked CRIMO if CRIMO was
referring to things lining up for the attack that just occurred on the parade and
CRIMO responded in the affirmative. CRIMO described not using the devices
because the plastic milk jugs could have cracked had he thrown them off the roof.
CRIMO said that had he used the devices, they would “explode” and affect “a handful”
of people. He further stated that one pound of ammonium nitrate is equal to a stick
of TNT.
28. Based on the recorded interview, CRIMO stated he did not think long
about using the explosives for this incident and at one point asked if the question was
for a “thought crime[s].” He also stated he probably would not have followed through
because the materials were unstable. Conversely, at another point in the interview,
20
CRIMO affirmed he wanted the IED to work and so he purchased commercially
components a couple of months ago and kept it locked up so family members would
not get hurt and because it looked nefarious. He continued, “I was either going to rip
it up and throw it away or use it but, it, the situation didn’t arise for it to be used.”
provided law enforcement with conflicting information related to his plans for any
IED and the components. Through my training and experience, I know that subjects
31. During the search of Phone 1, law enforcement found a number of Gmail
my consultation with other law enforcement officers with expertise in forensic phone
extractions, when a user types in their Google username and password to log into
their Gmail account via their phone, Gmail creates a token that is then cached on the
phone that associates those specific login credentials with that specific device. Thus,
the user does not have to reenter their login credentials every time they access the
21
account. Those cached tokens can be identified during a forensic extraction on the
phone, which, in other words, indicates that a given Google account was logged into
using the phone and the username and password saved in the form of a credential
token. In this case, the forensic extraction of Phone 1 led to the identification of the
As noted above, Google Drive is an application that allows users to store, access, and
share data as well as back up and access files from mobile devices. On the Google
holding firearms in various poses. As the device was not logged into the Google Drive,
the internet browser Google Chrome. As mentioned above, CRIMO informed law
enforcement that he viewed internet videos about Tannerite IEDs, made purchases
via the internet, and conducted his online activity on his mobile telephone.
7Data recovered from the phone indicates the Tannerite was purchased using Subject
Account 1.
22
34. Further, law enforcement observed the Google Maps application on
Phone 1. During the search of Phone 1, law enforcement recovered turn-by-turn voice
prompts for driving directions on the day of the shooting, July 4, 2022. Based on my
training and experience, I know that Google may retain additional information
related to the Maps application that is not stored on the phone. Additionally, during
the recorded interview, CRIMO said that in the years preceding the attack, CRIMO
traveled throughout the United States to meet and stay with associates he met
through an online forum. This travel to out of state acquaintances has been
met with or received assistance from, in the months and years leading up to the
attack.
experience:
acts of violence with weapons of mass destruction take photographs and videos of
plans or actions. Indeed, based on a witness interview, law enforcement believes that
23
reconnaissance in advance of the July 4, 2022, attack. Additionally, CRIMO stated
during the recorded interview that he had been planning to commit the attack for
years. As previously noted, Google provides Cloud-based storage for photos and
videos and, based on a search of Phone 1, it is clear that CRIMO utilized Google’s
manifesto, supplies, notes, schematics for the design of destructive devices, and
include information about the motivation beyond the plans to commit violence,
including malice toward a particular person or group of people. They may also include
information about other planned attacks which either were not, or not yet, completed.
As previously noted, Google’s cloud services (which CRIMO utilized), such as Google
Drive and Google Keep allow users to save notes and documents to Google’s servers.
Accordingly, I believe the Subject Accounts are likely to contain such information.
acts of violence with weapons of mass destruction perform research online to learn
about how best to conduct the attack, including how to assemble and operate
explosive devices. Indeed, during his recorded interview, CRIMO told law
24
viewed YouTube videos on Tannerite IEDs. As previously noted, unless a user opts
out, Google will record users’ historical browsing history, including search history,
and may also record a users’ YouTube watch history. Accordingly, I believe the
acts of violence with weapons of mass destruction may communicate with others,
including via email, about their plans and preparations and to seek assistance or
I believe it is likely that to the extent CRIMO communicated with others about his
planned attack via email, those communications are likely contained in the Subject
Accounts.
acts of violence with weapons of mass destruction may communicate with others, may
also conduct travel in furtherance of the attack, such as to meet with coconspirators,
gather supplies, and conduct reconnaissance. Indeed, as previously noted, during his
recorded interview, CRIMO told law enforcement that in the years preceding the
attack, he travelled the country and stayed with various individuals he had met on
an online forum. As previously noted, Google collects and retains data about the
location at which Google Account services are accessed from any mobile device.
Google Maps—which CRIMO utilized at least on the day of the attack—also collects
25
and retains certain location data about Google users. Accordingly, I believe the
innocent third parties, Google employees and/or law enforcement personnel trained
in the operation of computers will create an exact duplicate of the computer accounts
37. Google employees will provide the exact duplicate in electronic form of
the information described in Section II of the Attachment A and all information stored
in those accounts and files to the agent who serves this search warrant; and
38. Following the protocol set out in the Addendum to Attachment A, law
enforcement personnel will thereafter review all information and records received
18, United States Code, Section 2332a(a)(2)(A),(D) are located within one or more
request that the Court issue a search warrant directed to Google allowing agents to
seize the electronic evidence and other information stored on the Google servers
Attachment A.
____________________________
/s/ Barrett J. Rife (MDW with permission)
Barrett J. Rife
Special Agent
Federal Bureau of Investigation
27
ATTACHMENT A
I. SEARCH PROCEDURE
third parties, company employees and/or law enforcement personnel trained in the
operation of computers will create an exact duplicate of the computer accounts and
the accounts and files described in Section II below and all information stored in those
accounts and files to the agent who serves the search warrant.
4. Following the protocol set out in the Addendum to this Attachment, law
enforcement personnel will thereafter review information and records received from
To the extent that the information described below in Section III is within the
present, including e-mails, attachments thereto, drafts, contact lists, address books,
calendars, and search history, stored and presently contained in, or maintained
with the Subject Accounts, including Chat, Duo, Hangouts, Meet, and Messages
(including SMS, MMS, and RCS), in any format and however initially transmitted,
including, but not limited to: stored, deleted, and draft messages, including
attachments and links; the source and destination addresses associated with each
communication; user settings; and all associated logs, including access logs and
change history.
in Google Drive (including Docs, Sheets, Forms, and Slides) and Google Keep,
2
d. All Internet search and browsing history, and application usage
history, including Web & App Activity, Voice & Audio History, Google Assistant, and
Google Home, including: search queries and clicks, including transcribed or recorded
voice queries and Google Assistant responses; browsing history, including application
call detail records; SMS and MMS messages, including draft and deleted messages;
voicemails, including deleted voicemails; user settings; and all associated logs,
including access logs, IP addresses, location data, timestamps, and change history.
accessed URLs and their associated duration, privacy settings, edits, comments,
likes, chats, and other interactions, including associated URLs; search history;
change history, location information, and uploading account or identifier; the logs for
each access by the account, including IP address, location, timestamp, and device
3
h. All existing printouts from original storage of all the electronic
addresses and/or individual accounts described above, including log files, dates,
above, including applications, subscribers’ full names, all screen names associated
with the subscribers and/or accounts, all account names associated with the
Accounts, such as Google Pay and Google Wallet, including: records of purchases,
money transfers, and all other transactions; address books; stored credit; gift and
loyalty cards; associated payment cards, including any credit card or bank account
number, PIN, associated bank, and other numbers; and all associated access and
transaction logs, including IP address, time stamp, location data, and change history.
in Google Photos, including: photos, GIFs, videos, animations, collages, icons, or other
4
data uploaded, created, stored, or shared with the account, including drafts and
deleted records; accounts with access to or which previously accessed each record; any
location, device, or third-party application data associated with each record; and all
associated logs of each record, including the creation and change history, access logs,
and IP addresses.
or printed form, including all e-mail, including attachments thereto, and Google Drive
described above.
q. All Google Location History / Google Timeline data for any devices
associated with the Subject Accounts described above, including the GPS
disclose the above information to the government within 10 days of the signing of this
warrant.
5
III. Information to be Seized by Law Enforcement Personnel
2. Items indicating the state of mind of the user of the Subject Accounts,
e.g., intent, absence of mistake, or evidence indicating preparation or planning,
related to the criminal activity under investigation;
3. Items concerning how and when the Account was accessed or used, to
determine the geographic and chronological context of account access, use, and events
relating to the crime under investigation and to the Account user;
6
10. Items related to the receipt or possession of explosive devices, including
materials, components, and tools used to make explosive devices, including but not
limited to explosive precursors, accelerants, incendiary materials, electronic
components, fused and initiating materials, shrapnel, and containers, and any other
chemicals or compounds which alone or in combination with other materials can be
used to form a destructive device;
12. Items related to the physical location of the users of the Subject
Account;
7
ADDENDUM TO ATTACHMENT A
The account provider shall provide the government only data that fall within
the criteria as described in Attachment A(I), which may either be the entire contents
of an account or only a subset of an account.
The government must make reasonable efforts to use methods and procedures
that will locate only those categories of data, files, documents, or other electronically
stored information that are identified in the warrant, while minimizing exposure or
examination of categories that will not reveal the items to be seized in Attachment
A(III).
8
e. using forensic tools to locate data falling within the list of items to be seized
as set forth in Attachment A(III).