One of the search warrants described in my Civil Beat story yesterday was addressed to Google and requested “information associated with” a Gmail account.

It turns out that a request of this kind has a much wider reach than most people expect. Emails sent and received are just the starting point.

Although the warrant in question is sealed, I took a look at what appears to be a similar request, a search warrant application filed on February 13, 2017, sought records associated with the account for gingerbreadjr3351@gmail.com, used by Lance Bermudez, known as “Hammah,” one of the Miske defendants who pleaded guilty in September.

The case file containing the warrant application, affidavit, and related documents, case number 17-MJ-00161, was unsealed by Watson’s court order dated September 23, 2022.

It was supported by a 48-page affidavit signed by FBI Special Agent Austin Jackson, and an attachment detailing the types of information the search warrant sought from Google.

The scope of information sought by this search warrant, described in “Attachment B,” is surprisingly broad, and is a reminder of how much information internet service providers collect and maintain on every user.

Information sought by the Bermudez warrant began with all emails stored in the account, whether sent to or from the account, including draft emails, “the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email.”

That was just the beginning.

It then asked for all information about the identification of the account, including the name, physical address, telephone numbers used in creating the account, along with the date the account was created, length of service, types of services utilized, the IP address used to register the account, the log-in IP addresses associated with individual sessions and dates, any alternate email addresses provided, log files, and sources, including credit or bank account numbers, used to make payments.

The list goes on. Next came all information stored by the person using the account, including address books, contact lists, pictures and files stored on Google Drive and Google Photo, as well as information on additional accounts linked by “cookies,” those small files left by websites visited that can track the site, and the viewer, over time.

And there was one final but very important type of information, “location history,” described as “all location data whether derived from Global Positioning System (GPS) data, cell site/cell tower triangulation precision measurement information such as timing advance or per call measurement data, and Wi-Fi location….”

Knowing how, when, and where the email account was accessed could then be used “to determine the geographic and chronological context of account access, use, and events relating to the crime under investigation and to the email account owner….” as well as “indicating the email account owner’s state of mind as it relates to the crimes under investigation,” according to Agent Jackson’s submission.

Further, information maintained by the email
provider can show how and when the account was accessed or used.
For example, as described below, email providers typically log
the Internet Protocol (IP) addresses from which users access the
email account, along with the time and date of that access. By
determining the physical location associated with the logged IP
addresses, investigators can understand the chronological and
geographic context of the email account access and use relating
to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the
account owner. Additionally, information stored at the user’s
account may further indicate the geographic location of the
account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored
electronic data may provide relevant insight into the email
account owner’s state of mind as it relates to the offense under
investigation. For example, information in the email account
may indicate the owner’s motive and intent to commit a crime
(e.g., communications relating to the crime) or consciousness
of guilt (e.g., deleting communications in an effort to conceal
them from law enforcement).