UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY ORtGrNAL FfLFD IN THE MATIER OF THE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER AUTHORIZING THE INSTALLATION AND USE OF PEN REGISTER AND TRAP AND TRACE DEVICES FOR THE CELLULAR TELEPHONE FACILITY ASSIGNED TELEPHONE NUMBER 908448-3855 JUL 1 j ORDER Hon. Patty Shwartz :. · PATIYSHWARTZ U.S. MAG. JUDGE Mag. No. 12-3092 (UNDER SEAL) THIS MATIER having come before the Court upon an application under Title 18, United States Code. Sections 2703(d) and 3122, by Paul J. Fishman, United States Attorney for the District of New Jersey (by Osmar J. Benvenuto. Assistant United States Attorney) seeking an order (a) authorizing the installation and use of pen register and trap and trace devices under Title 18, United States Code, Section 3122 et seg.; (b) requiring the disclosure of records and other infonnation under Title 18, United States Code, Section 2703, and the All Writs Act, 28 United States Code, Section 1651; and (c) authorizing the Federal Bureau of Investigation to deploy mobile pen register and trap and trace equipment to detennine the general location of the cellular telephone facility assigned telephone number 908-448-3855, which is issued by SprintNextel ("Sprint'') including any other telephones or telephone numbers accessed by equipment using the same unique hardware (e.g .• IMEI/ESN/MEID/MAC) or unique subscriber identity (e.g.• MDN/MSID/MINIIMSIIUFMI) (as those terms are defined bclow 1), and any other 1 Cell phone service providers use a variety of numbers to identitY phone handsets used on their respective systems, including, for hardware, the International Mobile Equipment Identity (.. IMEJ'"), Electronic Serial Number ("ESN"). Mobile Equipment Identity (.. MElD") and Media Access Control (.. MAC") Address; or, tbr subscriber identity, Mobile Directory Number Williams(4)000498 telephones assigned to the same telephone number ("the Target Facility.. ); and the applicant having certified that the information likely to be obtained by the installation and use of pen register and trap and trace devices is relevant to an ongoing criminal investigation concerning the Specitied Fedeml Offenses identitied in the application by subjects identitied in that application and others known and unknown; and IT APPEARING that information likely to be obtained from the pen register and trap and tmce devices, including caller identification, is relevant to the ongoing criminal investigation; and that and there are reasonable grounds to believe that real-time location information concerning the Target Facility (including all cell site location and registration information but not including GPS, E-911, or other precise location information) and information about subscriber identity, including the name, address, local and long distance telephone connection records, length of service (including start date) and types of service utilized, telephone or instrument number or other subscriber number or identity, and means and source of payment for such service (including any credit card or bnnk account number), for all subscribers to all telephone numbers, published and non-published, derived from the pen register and tmp and trace devices, are relevant and ("MDN"}, Mobile Station Identity ("MSID"), Mobile Identification Number (..MIN") or Universal Fleet Member Identifier ("UFMI", for Nextel's ••Direct Connect"). IMEI and IMSI are terms associated with specific technologies, including GSM, iDEN and UMTS: while ESN, MElD and MSID/MIN are terms associated with COMA and older technologies. In every case, the equipment manufacturer or the communications provider assigns a unique value to each device/customer. Applicability to traceable hardware or subscriber changes has become a long-standing cornerstone to intercept orders, necessary to de teat "SIM-swapping'' and other techniques increasingly used to thwart law enforcement investigations. - 2 - Williams(4)000499 material to the ongoing criminal investigation; IT IS on this_ day of July, 2012, ORDERED, under Title 18, United States Code, Section 3123, that agents of the Federal Bureau of Investigation are authorized to install and use pen register and trap and trace devices without knowledge of, or notification to, the subscriber, to record and decode dialing, routing, addressing, and signaling information transmitted from the Target Facility, including telephone numbers dialed and pulsed, the date and time of dialings and pulsings, and the length of time the telephone receiver in question is off the hook; and to capture the incoming electronic and other impulses that identify the originating number and other dialing, routing, addressing, and signaling intbrmation reasonably likely to identifY the source of wire communications to the Target Facility, including caller identification, whenever such electronic and other impulses are sent from or to any location within the jurisdiction ~fthe United States, for the telephones~!'..:! telephone numbers from which calls are placed to the Target Facility, the date au~ time ol dialings and pulsings, and the length of time the telephone receiver in question is off the hook, for incoming and outgoing calls for a period of 60 days; and it is further ORDERED, under Title 18, United States Code, Section 3123(b)(2), that Sprint, a provider of electronic communication service, furnish agents ofthe Federal Bureau of Investigation all information, facilities, and technical assistance necessary to accomplish the installation and use of pen register and trap and trace devices unobtrusively and with minimum interference to the service currently accorded persons whose dialings or pulsings are the subject of the pen register and trap and trace devices; including the make and model of the handset that is associated with or assigned to the Target Facility; and it is further - 3 - Williams(4)000500 ORDERED that, in accordance with Title 18, United States Code, Section 3 121 (c),the Federal Bureau of Investigation wi II usc the technology reasonably available to it that restricts the recording or decoding of electronic or other impulses to dialing, routing, addressing, and signaling infonnation utilized in the processing and transmitting of wire or electronic communications so as not to include the contents of any wire or electronic communication; and it is further ORDERED, under Title 18, United States Code. Section 2703(d), that Sprint furnish expeditiously real-time location information concerning the Target Facility (including all in formation) for a period of 60 days from the date of this Order; and it is fua1her ORDERED, under Title 18, United States Code, Section 2703(d), that AT&T, TMobile U.S.A., Inc., Verizon Wireless, Metro PCS, Sprint-Nextel and any and all other providers of electronic communication service shall, not later than five business days from the receipt of a request from the Federal Bureau of Investigation furnish all information about subscriber identity, including the name, address, local and long distance telephone connection records, length of service (including start date) and types of service utilized, telephone or instrument number or other subscriber number or identity, and means and source of payment for such service (including any credit card or bank account number), for all subscribers to all telephone numbers, published and non-published, derived from the pen register and trap and trace devices tor a period of 60 days from the date of this Order; and it is further ORDERED, under Title 18, United States Code, Section 3123, that agents of the Federal Bureau of Investigation arc authorized to deploy mobile pen register equipment to - 4 - Williams(4)000501 I monitor the dialing, routing, addressing, and signaling information of the Target Facility in order to dctennine its general location for a period of 14 consecutive days beginning no later 10 days from the date of this Order, but in no event to use the mobile equipment, absent other authority. ~~~ecpJI"Qrrtflt rc \V'-~V\'-t pc'"~t\.\l. f'\ClCL G'(~'("t,.. ~·'0-Q..~ \rxL.V"(re<..lDcn tq locate the Target Facility/oll.Ce-'it lee~eAI to believe tkar they bave identi.fied-a-single ~ --N to \u(cjet-" ~ll~ \}) \ ("\ c. . . er~Vct.tt ORDERED that Sprint be compensated by the Federal Bureau of Investigation for ·~ reasonable expenses incurred in providing information, facilities, and technical assistance for the pen register and trap and trace devices; and it is further ORDERED, under Title 18, United States Code, Section 3123(d), that the Service Providers and their agents, employees, and representatives shall not disclose to any person the existence of this Order, the application upon which it is based, the pen register and trap and trace devices, the disclosure of records, or the investigation unless otherwise ordered by the Court; and it is further ORDERED that, with the exception of copies of this Order necessary for its implementation, this Order, the application upon which it is based, and all other papers related to this application are sealed until otherwise ordered by the Court. HON. PATrY S ARTZ UNITED STATES MAGISTRATE J DGE - 5 - Williams(4)000502 UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY IN THE MAITER OF THE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER SEALED APPLICATION AUTHORIZING THE INSTALLATION AND USE OF PEN REGISTER AND : Hon. Patty Shwartz TRAP AND TRACE DEVICES FOR THE CELLULAR TELEPHONE FACILITY Mag. No. 12-3092 ASSIGNED TELEPHONE NUMBER 908-448-3855 The United States of America (Paul J. Fishman, United States Attorney for the District of New Jersey, by Osmar J. Benvenuto, Assistant United States Attorney), hereby applies to the Court for an order (a) authorizing the installation and use of a pen register and trap and trace device under Title 18, United States Code, Section 3122 et seg.; (b) requiring the disclosure of records and other information under Title 18, United States Code, Section 2703, and the All Writs Act, 28 United States Code § 1651; and (c) authorizing the Federal Bureau of Investigation to deploy mobile pen register and trap and trace equipment to determine the general location of the cellular telephone facility assigned telephone number 908-448-3855, which is issued by Sprint-Nextel ("Sprint"), including any other telephones or telephone numbers accessed by equipment using the same unique hardware (e.g., JMEIIESNIMEIDIMAC) or unique subscriber identity (e.g., MDNIMSIDIMJNIIMSIIUFMI) (as those terms are defined below1), and any other 1 Cell phone service providers use a variety of numbers to identify phone handsets used on their respective systems, including, for hardware, the International Mobile Equipment Identity ("IMEI"), Electronic Serial Number ("ESN"), Mobile Equipment Identity ("MElD") and Media Access Control ("MAC") Address; or, for subscriber identity, Mobile Directory Number ("MDN"), Mobile Station Identity ("MSID"), Mobile Identification Number ("MIN") or Universal Fleet Member Identifier ("UFMI", for Nextel's "Direct Connect"). IMEI and IMSI are terms associated with specific technologies, including GSM, iDEN and UMTS; while ESN, MElD and MSID/MIN are terms associated with COMA and older technologies. In every case, Williams(4)000503 telephones assigned to the same telephone number ("the Target Facility"). This application is bas~d upon the following flcts: I. I am an "attorney for the Government" as defined in Rule I (b)( 1) of the Federal Rules of Criminal Procedure, and therefore I may apply for an order (a) authorizing the installation and use of a pen register and trap and trace device under Title 18, United States Code, Section 3122, and (b) requiring the disclosure of records and other infonnation under Title 18, United States Code, Section 2703. 2. I certify that: a. Special Agents of the FBI are engaged in an investigation in New Jersey involving seven anned bank robberies: on September 26, 201I at the Financial Resources Federal Credit Union in Franklin Township, New Jersey; on November 21, 2011 at Somerset Savings Bank in Somerville, New Jersey; on February 27, 2012 at Provident Bank in Piscataway, New Jersey; on April 17, 2012 at Provident Bank in Clifton, New Jersey; on May 22, 2012 at Provide~t Bank in. Piscataway, New Jersey; on June 20, 2012, at approximately 11:18 a.m., Fulton Bank, located at 700 Middlesex Avenue, Metuchen, New Jersey; on July 12, 2012, at Unity Bank, located at 1230 Bound Brook Road, Middlesex, New Jersey. In violation of 18 U.S.C. § 2113(a), the perpetrators did take or attempt to take from the persons and presence of the employees of those banks, money belonging to and in the care, custody, control, management the equipment manufacturer or the communications provider assigns a unique value to each device/customer. Applicability to traceable hardware or subscriber changes has become a long-standing cornerstone to intercept orders, necessary to defeat "SIM-swapping" and other techniques increasingly used to thwart law enforcement investigations. - 2 - Williams(4)000504 and possession of the bank, a financial institution whose deposits were then insured by the Federal Deposit Insunmce Corporation; b. information likely to be obtained from the pen register and trap and trace devices, including caller identification, is relevant to the ongoing criminal investigation; i. On September 26, 2011, at approximately 9:46a.m., Financial Resources Federal Credit Union, which is located at 780 Easton Avenue, Franklin Township, New Jersey, was robbed by a male armed with a handgun and wearing a bandana. a hooded sweat shirt, and white gloves. Shortly before the robbery commenced, a female, who is hPiiPvPtf in cnncert ----· -- tn ·- h.RvP ··- · - hP.P.n ----· wnrJdno ·· ------g---------- with ·· ---- the ---- -robber_ ----- -, entered ---- - - --· the ---- bank. - -- .. -1 aooarentlv as- .oart of -.-.-- ~ an effort to surveil it prior to the robbery. Followins the robbery, the robber was seen outside the bank entering the passenger side of a vehicle. The loss sustained was approximately $20,339.00. ii. On November 21, 2011, at approximately 9:49a.m., Somerset Savings Bank, which is located at 64 West End Avenue, Somerville, New Jersey, was robbed by a male armed with a handgun and wearing a bandana, a hooded sweat shirt, and white gloves. Shortly before the robbery commenced, a female, who is believed to have been working in concert with the robber, entered the bank, apparently as part of an effort to surveil it prior to the robbery. The loss sustained was approximately $14,691.00. iii. On February 27, 2012, at approximately 9:30a.m., Provident Bank, located at 100 Shelton Road, Piscataway, New Jersey, was robbed by a male armed with a handgun and wearing a bandana, a hooded sweat shirt, and white gloves. Shortly before the robbery commenced, a male, who is believed to have been working in concert with the - 3 - Williams(4)000505 robber, entered the bank, apparently as part of an effort to surveil it prior to the robbery. The loss sustained was approximately $43,963.00. iv. On April 17, 201 2, at approximately 11:00 a.m., Provident Bank, located at 562 Lexington Avenue, Clifton, New Jersey, was robbed by a male armed with a handgun and wearing a bandana, a hooded sweat shirt, and white gloves. Following the robbery, the robber was seen outside the bank entering the passenger side of a vehicle. The loss sustained was approximately $10,093.00. v. On May 22,2012, at approximately 9:46a.m., Provident Bank, located at 100 Shelton Road, Piscataway, New Jersey, was robbed by a male armed with a handgun and wearing a bandana, a hooded sweat shirt, and white gloves. The loss sustained was approximately $13,398.00. vi. On June 20, 2012, at approximately 11:18 a.m., Fulton Bank, located at 700 Middlesex Avenue, Metuchen, New Jersey, was robbed by a male armed with a handgun and wearing a bandana, a hooded sweat shirt, and white gloves. Shortly before the robbery commenced, a female, who is believed to have been working in concert with the robber, entered the vestibule ofthe bank, apparently as part of an effort to surveil it prior to the robbery. The loss sustained was approximately $7,000. vii. On July 12, 2012, at approximately 11:50 a.m., Unity Bank, located at 1230 Bound Brook Road, Middlesex, New Jersey, was robbed by a male armed with a handgun and wearing a bandana, a hooded sweat shirt, and white gloves (the ••July 12 Robbery). Prior to the robbery, a female, who is believed to have been working in concert with - 4 - Williams(4)000506 the robber, entered the bank, apparently as part of an effort to surveil it prior to the robbery. The loss sustained wa::; approximately $9,000. viii. There is more than one individual involved in the aforementioned bank robberies. There is a high probability that these individuals utilized, during the time period covered by this Application, cellular telephones in the furtherance of their criminal activity, and/or to report to other persons the fruits of their criminal activity. ix. Shortly before the July 12 Robbery, an unanned off-duty police officer (the ••officer") parked across from the Unity Bank observed a male anned with a· handgun a.11d wea.ring a face coveringi a hooded sweat shirt, and gloves (the "Suspect..). Shortly thereafter, the Officer observed the Suspect exit the Unity Bank branch while walking quickly. The Suspect got into the rear of a Ford Taurus, which was being driven by a female, bearing New Jersey license plate number X91 BVR (the ••Ford"). After entering the rear of the Ford, the Suspect crouched down so that he would not be visible to observers. x. The Officer then followed the Ford, which, after a period of time, attempted to elude the Officer. After the unsuccessful attempt to elude the Officer, the Ford stopped, the Suspect exited the rear of the car, and he pointed his gun at the Officer. At that point, the Officer left the scene. xt. Thereafter, law enforcement determined that the Ford was registered to an individual named - 5 - Williams(4)000507 xii. Real-time location information (including all cell site location and registration information but not including GPS, E-911, or other precise location information) is necessary to locate the user of the Target Facility, which will assist in identifying both Williams's location and the location of the Ford. xiii. On July 12, 2012, the Honorable Mark Falk, United States Magistrate Judge, issued an Order, attached hereto as Exhibit A, authorizing the FBI to obtain, among other things, real-time location and registration information concerning the Target Facility (including all cell site location information but not including GPS, E-911, or other precise location information). 3. I have been informed that this investigation may require the use of mobile pen register and trap and trace equipment ("the Mobile Equipment") capable of receiving, sending, and capturing the dialing, routing, addressing and signaling information that celh.d~:- *"lephuu~::. such as the Target Facility use to establish connections with Sprint's network, and of determining the general direction from which those signals are being broadcast. Generally, the Mobile Equipment may operate by mimicking one of Sprint's cell towers to get the Target Facility to connect to it, or it may simply screen signaling information going to or from Sprint's cell phone towers in the Mobile Equipment's immediate vicinity for dialing, routing, or addressing information emanating from or destined to the Target Facility. Once the Mobile Equipment detects the Target Facility's dialing, routing, addressing or signaling information (by virtue of the Target Facility's unique identifiers described above}, the Mobile Equipment may display one or more of the paths from which the Target Facility's signals are received and the strength of those signals. Because radio signals are emitted in all directions and can bounce off, among other - 6 - Williams(4)000508 things, structures, the Mobile Equipment cannot definitively identify the direction from which the Target Facility is emitting its dialing, routing, addressing or signuling information. The Mobile Equipment can only identify the path (or paths) from which the Target Facility's signals are being received. The operator of the Mobile Equipment, in tum, may determine the location from which the Target Facility is most likely emitting signals. Because the dialing, routing, addressing, and signaling information contains no content, that information can be obtained using a pen register and trap and trace device. 4. In this instance, the information likely to be obtained from the Mobile J:;'nninmPnt ·i~ ·-·-·---rPIPv$1nf tn Rfnrementinnen inve!;thmtion it will to-..,-·r···-··· -- thf" --- ---·--··------------· ----c------ because ------- ----- enable - --·· --- investif!ators ------ ~- - -- -- attempt to determine the general location of the Target Facility and of the individual or individuals using the Target Facility. 18 U.S.C. § 3122(b)(2). 5. Agents of the Federal Bureau oflnvestigation have advised that they will deploy and use the Mobile Equipment only from locations where they are lawfully present. They further advise that they will, absent additional lawful authority (such as a search warrant issued pursuant to Fed. R. Crim. P. 41 ), stop using the Mobile Equipment when it leads them to believe that they have identified a single residence or private space within which the Target Facility may be located. The present application therefore requests authorization for agents ofthe Federal Bureau of Investigation to deploy mobile pen register and trap and trace equipment to attempt to determine the general location of the Target Facility for a period of 14 consecutive days beginning no later than I 0 days from the Court's execution of the proposed Order filed herewith, but not, absent other authority, when they believe they have identified a single residence or private space in which the Target Facility may be located. - 7 - Williams(4)000509 6. Because of the way the Mobile Equipment sometimes operates, its use has the potential to intermittently disrupt cellular service to a sm;1ll fraction of SpriHt's ';irekss customers within its immediate vicinity. Any potential service disruption will be brief and minimized by reasonably limiting the scope and duration of the use of the Mobile Equipment. 7. In order to achieve the investigative objective (i.e., determining the general location of the Target Facility) in a manner that is the least intrusive, data incidentally acquired from phones other than the Target Facility shall not be recorded and/or retained beyond its use to identify or locate the Target Facility. 8. In accordance with Title 18, United States Code, Section 3121 (c), the Federal Bureau oflnvestigation will use the technology reasonably available to it that restricts the recording or decoding of electronic or other impulses to dialing, routing, addressing, and signaling information utilized in the processing and transmitting of wire or electronic communications so as not to include the contents of any wire or electronic communication. 9. Because this covert investigation is continuing, premature disclosure of its existence could jeopardize its effectiveness. The Federal Bureau of Investigation considers the Mobile Equipment and its configuration to be Law Enforcement Sensitive. See In re the City of New York, 607 F.3d 923, 942 (2d Cir. 2010); Commonwealth of Puerto Rico v. United States, 490 F.3d 50, 62-64 (1 51 Cir. 2007); United States v. Van Hom, 789 F.2d 1492, 1508 {11 1h Cir. 1986). 10. Accordingly, the United States requests that this Court grant an order: a. authorizing the installation and use of pen register and trap and trace devices without knowledge of, or notification to, the subscriber, to record and decode dialing, - 8 - Williams(4)000510 routing, addressing, and signaling information transmitted from the Target Facility, including telephone numbers iialel and pulsed, the date and time of dialings and pulsings, and t11e length of time the telephone receiver in question is off the hook; and to capture the incoming electronic and other impulses that identify the originating number and other dialing, routing, addressing, and signaling infonnation reasonably likely to identifY the source of wire communications to the Target Facility, including caller identification, whenever such electronic and other impulses are sent from or to any location within the jurisdiction of the United States, for the telephones and telephone numbers from which calls are placed to the Target Facility, the date and time of diaHngs a.rtd pu!s!ngs; a..11d the length of time the telephone receiver in question is off the hook, for incoming and outgoing calls for a period of 60 days; b. directing Sprint, a provider of electronic communication service, to furnish agents of the Federal Bureau oflnvestigation with all infonnation, facilities, and technical assistance necessary to accomplish the installation and use of the pen register and trap and trace device unobtrusively and with minimum interference to the service currently accorded persons whose dialings or pulsings are the subject of the pen register and trap and trace device, including the make and model of the equipment that is associated with or assigned to the Target Facility; c. directing AT&T, T-Mobile U.S.A., Inc., Verizon Wireless, Metro PCS, Sprint-Nextel and any and all other providers of electronic communication service (hereinafter the "Service Providers") to furnish expeditiously real-time location infonnation concerning the Target Facility (including all cell site location infonnation but not including GPS, E-911, or other precise location infonnation) and, not later than five business days after receipt of a request from - 9 - Williams(4)000511 the Federal Bureau of Investigation, all information about subscriber identity, including the name, address, local and long distance telephone connection records, length of service (including start date) and types of service utilized, telephone or instrument number or other subscriber number or identity, and means and source of payment for such service (including any credit card or bank account number), for all subscribers to all telephone numbers, published and nonpublished, derived from the pen register and trap and trace device during the 60-day period in which the court or~er is in effect; d. authorizing agents of the Federal Bureau of lnvestigationto deploy the Mobile Equipment to monitor the dialing, routing, addressing, and signaling information of the Target Facility in order to determine its general location for a period of 14 consecutive days beginning no later than I 0 days from the Court's execution of the proposed Order filed with this Application; e. directing the Service Providers and their agents, employees, and representatives not to disclose to any person the existence of this application, the court's order, the pen register and trap and trace device, the disclosure of records, or this investigation unless otherwise ordered by the Court; and f. sealing this application, the court's order, and all papers related to this application unless otherwise ordered by this Court, with the exception of copies of the order necessary for its implementation. - 10 - Williams(4)000512 1 hereby certify under penalty of perjury that the foregoing is true and correct Executed on Ju:y 13,2012. - 11 - Williams(4)000513