Page 32 - TPA Journal November December 2024

accounts to determine the path of travel. which device IDs were relevant and requested
This additional location history shall not additional de-anonymized information for all
exceed 60 minutes plus or minus the first three devices. The Inspectors determined that all
and last timestamp associated with the three devices were relevant to their Step 2 inquiry
account in the initial dataset. (The pur- because devices 1091610859 and 1577088768
pose of path of travel/contextual location registered multiple times within the geofence, and
points is to eliminate outlier points the third device—1353630479—could have been
where, from the surrounding data, it a potential witness. The Step 2 request was placed
becomes clear the reported point(s) are in May 2019, and the expanded information was
not indicative of the device actually received on May 30. However, no new devices
being within the scope of the warrant.) were added through the information gained at
4. For those accounts identified as rele- Step 2.
vant to the ongoing investigation through Again, without seeking any new warrants, Matney
an analysis of provided records, and upon and Mathews sent off their Step 3 request for all
demand, the “Provider” shall provide the three devices on June 7, 2019. They received the
subscriber’s information for those rele- de-anonymized information from Google on June
vant accounts to include, subscriber’s 10, 2019. The following files were returned:
name, email addresses, services sub- • 2165781.Key.cvs
scribed to, last 6 months of IP history, • bleek2004.AccountInfo.txt
SMS account number, and registration IP. • jamarrsmith33.AcountInfo.txt
In summary, as to Step 1, the warrant authorized • permanentwavesrecords.AccountInfo.txt
an hour-long search from 5:00 p.m. to 6:00 p.m.
on February 5, 2018, within a geofence covering Through these files, Mathews was able to deter-
approximately 98,192 square meters around the mine that “jamarrsmith33.AcountInfo.txt” was
Lake Cormorant Post Office. As to Step 2, the Jamarr Smith’s email account and
warrant authorized law enforcement to obtain “bleek2004.AcountInfo.txt” was Gilbert
additional Location History for a registered device McThunel’s email account. The third email
identified as relevant within “60 minutes plus or account associated with “permanentwaves-
minus the first and last timestamp associated with records.AccountInfo.txt” was deemed irrelevant
the account in the initial dataset.” However, prior to the investigation.
to reaching Step 2, law enforcement was required Now, no longer devoid of leads, Mathews and
to conduct “further legal process.” Matney took “[a] bunch of investigative steps”
Google returned the Step 1 data in April 2019. related to Smith and McThunel, including sending
Notably, Google’s search was much broader than additional non-geofence warrants to Google
that specifically sought by the warrant, producing regarding Smith and McThunel’s Google
data from a circular area that was approximately accounts, accessing their CLEAR database pro-
378,278 square meters, not 98,192 square meters. files, investigating cell tower data related to Smith
The search of Google’s 592 million accounts and McThunel, and sending non-geofence war-
returned three anonymous device IDs within the rants to phone companies for Smith and
requested parameters: McThunel’s account information. These addition-
Inspector Matney testified that after receiving this al steps revealed multiple phone calls between
data, he reviewed the devices to ensure that they Smith and McThunel during the time of the rob-
fell within the geofence coordinates. bery, and allowed for further geolocation of
However, prior to submitting Step 2, neither Appellants using historical cell phone record
Matney nor Mathews applied for another warrant. analysis.
Instead, Matney and Mathews decided themselves Additionally, through a search of Smith’s phone

Nov.-Dec. 2024 www.texaspoliceassociation.com • (512) 458-3140 31