Case

AO 106 (Rev. 01/09) 5:18-cm-00032-ELW

Application for a Search Warrant Document 1 Filed 03/28/18 Page 1 of 16 PageID #: 1
US DISTRICT COURT
UNITED STATES DISTRICT COUR1fBSTBRNDISTARKANSAS
FILED
for the
Western District of Arkansas
MAR 2 8 2018
DOUGLAS P. YOUNG, Clerk
In the Matter of the Search of ) By
(Briefly describe the property to be searched )
or identify the person by name and address)
Information Associated with APPLE email address:
) CaseNo. 5 .'
)
jonathan.wieneke@me.com controlled by )
APPLE INC )

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that there is now concealed on the following person or property
located in the Western District of Arkansas (identify the person or describe property to
be searched and give its location): See "Attachment A"
This court has authority to issue this warrant under 18 U.S.C. §§ 2703(c)(1 )(A) and 2711
(3)(A) and Federal Rule of Criminal Procedure 41

The person or property to be searched, described above, is believed to conceal (identify the person or describe the
property to be seized): See "Attachment B"

The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
rif property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of 18 U.S.C. § 1832

------
, and the application is based on these
facts: Theft of Trade Secret lnformation---See "Attachment C"

rif Continued on the attached sheet.

0 Delayed notice of days (give exact ending date if more than 30 days: _ _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on t l l ~ e ~

Applicant's signature

Gerald Francis Faulkner, SA HSI

Printed name and title

Sworn to before me and signed in my presence.

Date:
Judge's signature

City and state: Fayetteville, Arkansas Erin L. Wiedemann, US Magistrate Judge

Printed name and title
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 2 of 16 PageID #: 2

ATTACHMENT A

PROPERTY TO BE SEARCHED

This search warrant applies to all content and information contained in Apple email account:

jonathan.wieneke@me.com (SUBJECT EMAIL ADDRESS) that is stored at premises

controlled by Apple, Inc., a company that accepts service of legal process at located at 1 Infinite

Loop, MIS 36-SU, Cupertino, CA 95104 from June of 2017 until present.
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 3 of 16 PageID #: 3

ATTACHMENT B

I. Information to be disclosed by Apple, Inc. (the "Provider")

Any e-mails, records, files, logs, or information that is active or has been deleted from

Provider account jonathan.wieneke@me.com but is still available to the Provider; or that has

been preserved in that Provider account pursuant to a request made under 18 U.S.C. §2703(f).

The Provider must disclose to the government the following content or information:

a. All e-mails, including stored or preserved copies of e-mails sent to and from the

account, draft e-mails, the source and destination addresses associated with each

e-mail, the date and time at which each e-mail was sent or received, and the size

and length of each e-mail, any and all attachments, any and all emails that were

'forwarded" by the user/account holder;

b. All documents containing information that: identifies the account, or account

holder, to include full name, physical address, telephone numbers, and other

identifiers; reveals session times and duration; establishes the date on which the

account was created, and the IP address used to register the account; establishes

log-in IP addresses associated with session times and dates, account status,

alternative e-mail addresses provided during registration, methods of connecting,

log files, and means and source of payment (including any credit or bank account

number);

c. The types of service utilized;

d. All records or other information stored at any time by an individual using the

account, including address books, contact and buddy lists, calendar data, pictures,

and files;
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 4 of 16 PageID #: 4

e. All records pertaining to communications between the Provider and any person

regarding the account, including contacts with support services and records of

actions taken.

II. Informatjon to be seized by the government

The government is authorized to seize only information described in Section I that

constitutes fruits, contraband, evidence and instrumentalities of violations of Title 18, United

States Code, Sections; 1832-Theft of Trade Secrets, including information pertaining to the

following matters:

a. Email communications between jonathan.wieneke@me.com_and other e-mail

users, known or unknown, where possible trade secret information is traded,

viewed, sent to, received from, and/or discussed.

b. The identity and whereabouts of those persons who created, used, or

communicated with the Apple account identified in Attachment A.

III. Means of Production

Apple, Inc. shall disclose responsive data, if any, by sending to Homeland Security

Investigations, C/O: Special Agent Gerald Faulkner at 3419 North Plainview Avenue,

Fayetteville, Arkansas 72703 via U.S. Postal Service or another courier service

(gerald.f.faulkner@ice.dhs.gov).
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 5 of 16 PageID #: 5

ATTACHMENT C

UNITED STATES DISTRICT COURT

FOR THE WESTERN DISTRICT OF ARKANSAS

STATE OF ARKANSAS

ss. A F F I D A V I T

COUNTY OF WASHINGTON

Affidavit in Support of Application for Search Warrant

I, Gerald F. Faulkner, being duly sworn, depose and state as follows:

1. I am a Special Agent with the Department of Homeland Security, Homeland

Security Investigations (HSI), currently assigned to the Assistant Special Agent in Charge Office

in Fayetteville, Arkansas. I have been so employed with HSI since April 2009. As part of my

daily duties as an HSI agent, I investigate criminal violations relating to theft of trade secreted

information and economic espionage. I have received training in the area of protection of trade

secrets, and have had the opportunity to observe and review numerous examples of venues

individuals utilize in attempts to defraud or financially gain from converting proprietary data into

personal advantages. I have also reviewed numerous search warrants and arrest warrants, a

number of which involved theft of trade secrets investigations. This affidavit is being submitted

based on information from my own investigative efforts as well as information obtained from

others who have investigated this matter and/or have personal knowledge of the facts herein.

2. This affidavit is made in support of applications for a search warrant for

information associated with a certain account that is stored at a premise owned, maintained,

controlled, or operated by Apple, Inc., an electronic mail/Internet service provider headquartered

at One Apple Park Way in Cupertino, California 95014. This affidavit is made in support of an
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 6 of 16 PageID #: 6

application for a search warrant under Title 18, United States Code (U.S.C.) §§ 1832, relating to

Theft of Trade Secrets; to require Apple, Inc. to disclose to the government records and other

information in its possession pertaining to the subscriber or customer associated with the

electronic mail account (e-mail), jonathan.wieneke@me.com (SUBJECT EMAIL ADDRESS).

3. This affidavit is made in support of an application for a search warrant under 18

U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A) to require Apple, Inc. to disclose to the

government the requested records and other information in its possession. As such, your Affiant

is requesting authority to search the e-mail account where the items specified in Attachment A

may be found, and to seize all items listed in Attachment B as instrumentalities, fruits, and

evidence of crime.

4. Since this affidavit is being submitted for the limited purpose of securing a search

warrant, I have not included each and every fact known to me concerning this investigation. I

have set forth only the facts I believe necessary to establish probable cause to believe that

evidence, fruits, and instrumentalities of the violations of Title 18, U.S.C. §§ 1832, Theft of Trade

Secrets, are presently located within the e-mail account jonathan.wieneke@me.com. Where

statements of others are set forth in this Affidavit, they are set forth in substance and in part.

5. This investigation, described more fully below, has revealed that the individual

usmg the e-mail account jonathan.wieneke@me.com did knowingly exfiltrate proprietary,

protected and trade secret information from his work email account to his personal email address

related to his former employer, Walmart Cooperate Headquarters located in Bentonville,

Arkansas and there is probable cause to believe there is evidence, fruits, and instrumentalities of

the violations of 18 U.S.C. Section 1832 located in the e-mail account.

 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 7 of 16 PageID #: 7

Statutory Authority

6. This investigation concerns alleged violation of Title 18, United States Code,

Section 1832-Theft of Trade Secrets

a. Under 18 U.S.C. Section 1832, it is a federal crime for whoever with intent to convert a

trade secret, that is related to or included in a product that is produced for or placed in interstate

or foreign commerce, to the economic benefit of anyone other than the owner thereof, and

intending or knowing that the offense will injure any owner of that trade secret knowingly

(a) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud,

artifice, or deception obtains such information

(2) without authorization copies, duplicates, sketches, draws, photographs, downloads,

uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates,

or conveys such information

b. A trade secret means any and all forms and types of financial, business, economic

information, which the owner takes reasonable measures to keep such information a secret, and

the information devices independent economic value, actual or potential, from not being generally

known to others who can derive economic value from such. See 18 USC Section 1839(3).

Background Regarding Computers and the Internet

8. Your Affiant has become familiar with the Internet, which is a global network of

computers and other electronic devices that communicate with each other using various means,

including standard telephone lines, high-speed telecommunications links (Me., copper and fiber

optic cable), and wireless transmissions including satellite. Due to the structure of the Internet,

connections between computers on the Internet routinely cross state and international borders,

even when the computers communicating with each other are in the same state.
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 8 of 16 PageID #: 8

9. Individuals and entities use the Internet to gam access to a wide variety of

information; to send information to, and receive information from, other individuals; to conduct

commercial transactions; and to communicate via electronic mail ("e-mail") or Instant Messaging

services (IM). An individual who wants to use the Internet must first obtain an account with a

computer or cellular telephone that is linked to the Internet - for example, through a commercial

service - which is called an "Internet Service Provider" or "ISP". Once the individual has

accessed the Internet, whether from a residence, a university, a place of business or via their

cellular service provider, that individual can use Internet services, including sending and

receiving e-mail and IM.

10. The Internet is a worldwide computer network that connects computers and

facilitates the communication and the transfer of data and information across state and

international boundaries. A user accesses the Internet from a computer network or Internet

Service Provider ("ISP") that connects to the Internet. The ISP assigns each user an Internet

Protocol ("IP") Address. Each IP address is unique. Every computer or device on the Internet is

referenced by a unique IP address the same way every telephone has a unique telephone number.

An IP address is a series of four numbers separated by a period, and each number is a whole

number between O and 255. An example of an IP address is 12.345.678.901. Each time an

individual accesses the Internet, the computer from which that individual initiates access is

assigned an IP address. The ISP logs the date, time and duration of the Internet session for each

IP address and can identify the user of that IP address for such a session from these records,

depending on the ISP's record retention policies.

11. Computers as well create a "Log File" that automatically records electronic events

that occur on the computer. Computer programs can record a wide range of events including

remote access, file transfers, long/logoff times, systems errors, Uniform Resource Locator
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 9 of 16 PageID #: 9

addresses (websites), unique searches performed on the Internet and various forms of electronic

communications.

12. Computer files or remnants of such files can be recovered months or even years

after they have been downloaded onto the hard drive, deleted, or viewed via the Internet.

Electronic files downloaded to a hard drive can be stored for years at little or no cost. Even when

such files have been deleted, they may be recoverable months or years later using readily-

available forensic tools. When a person "deletes" a file on a home computer, the data contained

in the file does not actually disappear; rather, that data remains on the hard drive until it is

overwritten by new data. Therefore, deleted files, or remnants of deleted files, may reside in free

space or slack space - that is, in space on the hard drive that is not allocated to an active file or

that is unused after a file has been allocated to a set block of storage space - for long periods of

time before they are overwritten.

13. Similarly, files that have been viewed via the Internet are automatically

downloaded into a temporary Internet directory or cache. The browser typically maintains a fixed

amount of hard drive space devoted to these files, and the files are only overwritten as they are

replaced with more recently viewed Internet pages. Thus, the ability to retrieve residue of an

electronic file from a hard drive depends less on when the file was downloaded or viewed than on

a particular user's operating system, storage capacity, and computer habits.

14. The use of the Internet and more specifically electronic communications via the

Internet provides individuals the ability to mask their true identities as well as their physical

locations. Additionally, the use of the Internet provides individuals and their associates the

ability to access social networking sites free of charge to further their criminal activity.

Background Regarding Apple Email Accounts

15. Based on my knowledge and experience and information obtained from other law

enforcement personnel with training and experience in this area, the following is known about
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 10 of 16 PageID #: 10

@me.com accounts:

a. MobileMe (formerly known as .Mac and iTools) was a subscription-based

collection of online services and software offered by Apple, Inc. All

services were being gradually transitioned and replaced by iCloud and the

service ceased as of June 30, 2012, with transfers to iCloud available until

July 31, 2012.

b. iTools and .Mac were designed primarily to provide Internet services for

Mac owners. All members of iTools and .Mac received a @mac.com

email address, showing the services tied to the Mac hardware. In 2008,

with the release of the iPhone 3G, the services were renamed MobileMe

and Apple began providing Internet services for OS X, iOS and Windows.

Members ofMobileMe were then given a@me.com email address.

c. MobileMe allowed users to access personal data from any computer

connected to the Internet using the web interface at me.com or a number of

supported applications, including Microsoft Outlook, as long as the user

used the correct updated version.

d. In 2012, MobileMe was replaced with the iCloud, depending on when a

user created their iCloud account, their email address and aliases may end

with @icloud.com, @me.com or @mac.com.

Summary of the Investigation to Date

16. In early 2018, your Affiant was contacted by representatives of Walmart

Cooperate (WC) headquarters, located in Bentonville, Arkansas, in reference to additional

information the company had obtained in relation to an ongoing federal Theft of Trade Secrets

investigation. According to WC representatives, the newly acquired information pertained to

 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 11 of 16 PageID #: 11

additional "highly sensitive" data files having been illegally exfiltrated from their maintained and

secured computer systems and sent to a personal email address by a former employee just prior to

his resignation with WC. The WC maintained and secured computer system from which these

proprietary data files were taken contained, among other things, production and pricing

information of products offered for sale by WC and its subsidiaries. WC representatives believed

this employee had knowingly conducted the data exfiltration for financial gain or use for

employment with another company.

17. Your Affiant received and reviewed documents from WC outlining the allegations

along with specific files exfiltrated by the former employee. Upon reviewing the documents,

your Affiant identified the individual responsible for extracting the files from WC as being

Jonathan WIENEKE. The documents outlined WIENEKE had previously worked at WC as a

buyer through Sam's Club. In such capacity, WIENEKE was primarily tasked with being a

liaison of sorts between WC and a specific vendor, namely Outdoor Leisure Products (OLP). He

held such position until voluntarily leaving WC in October 2017. WIENEKE then accepted a

position with Masterbuilt Manufacturing, LLC, an approximate ten (10) year supplier to both WC

and Sam's Club. Per documents provided by WM, Masterbuilt merged/bought out, in part, OLP,

just prior to WIENEKE leaving WC.

18. Per WC representative, after WIENEKE left WC employment, WC began an

internal investigation into his access and utilization of their computer systems. The internal

review revealed on October 5, 2017, WIENEKE sent six (6) emails from

Jonathan.Wieneke@samsclub.com to his personal email address of jonathan.wieneke@me.com

(SUBJECT EMAIL ACCOUNT). All of the emails had an attached Excel Spreadsheet

containing "highly sensitive" Sam's Club proprietary data. Three (3) of these particular emails

triggered an alert to WC Data Assurance & Cyber Intelligence monitoring teams because the

information within the spreadsheets contained financial, sales, and product information exclusive
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 12 of 16 PageID #: 12

to WC. WIENEKE was alerted the same day by WC representatives about the emails at which

time he advised, "I deleted the info".

18. Upon WIENEKE's resignation, WC representatives interviewed his former

supervisor and sought clarification about the six (6) emails with attachments sent to WIENEKE's

personal email address of jonathan.wieneke@me.com (SUBJECT EMAIL ADDRESS). After

reviewing the exfiltrated data, WIENEKE's supervisor concluded all of the emails with

attachments were limited to WIENEKE's area of responsibility within the "Seasonal Department"

but he saw nothing in his calendar, in terms of upcoming projects, that would support

WIENEKE's need for the vast amount of data he exfiltrated, especially in October 2017 while he

was transitioning to a new employer. WIENEKE's supervisor further acknowledged the data

exfiltrated from WC was "highly sensitive" and believed WIENEKE's actions suggested he

intended to use the information for his own advantage after leaving Sam's Club or WC. It was

also explained the data WIENEKE sent to his personal email account contained information that

would be helpful to him in his new employment at Masterbuilt, such as estimated volume by

stock keeping unit (SKU) and club sales by week. It was explained by WIENEKE's supervisor

this information could also be used by a competitor or supplier to review WC sales data and

described possession of these files as, "like an open book test with all the answers." WIENEKE's

exfiltrated emails allotted him the opportunity to retain WC data on costs, volume, other

suppliers, and factories giving him a blueprint for items to use and find factories to source similar

products giving Masterbuilt an unfair financial advantage.

19. The documents provided by WC included charts of the specific dates, times and

data exfiltrated by WIENEKE to his personal email address which your Affiant reviewed and

describes as follows:

Exfiltration Number 1

Date: October 5, 2017

 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 13 of 16 PageID #: 13

Time: 10:07 PM (CDT)

Email From: Jonathan. Wieneke@Samsclub.com
Email To: jonathan.wieneke@me.com
Subject Line: Cat 16 Fall 2017 Master Item List
Attachment: Cat 16 Fall 2017 Master Item List3.xlsx
Classification: Highly Sensitive
File Description: The tab 'Master Item List' contains detailed item information for over 175
merchandise items, including cost, space, timeframe, recipients' information, exit, feature,
comments and a financial summary segment for each item. Other tabs contain 'Line Review'
data pertaining to Category 16 (Seasonal Hardware) as well as retail sales, unit sales, average sell
price and gross profit.

Exfiltration Number 2

Date: October 5, 2017

Time: 10:08 PM (CDT)
Email From: Jonathan.Wieneke@Samsclub.com
Email To: jonathan.wieneke@me.com
Subject Line: Spring 2017 Cat 16 Master Item List
Attachment: V2 Cat 16 Master Item List-GEMS 6.1.16.xlsx
Classification: Highly Sensitive
File Description: The tab 'Master Item List' contains detailed item Information for over 160
items, including cost information, space, timeframe and a financial summary segment for each
item. Other tabs contain 'Line Review' data pertaining to Category 16 (Seasonal Hardware) as
well as retail sales, unit sales, average sell price and gross profit.

Exfiltration Number 3

Date: October 5, 2017

Time: 10:11 PM (CDT)
Email From: Jonathan. Wieneke@Samsclub.com
Email To: jonathan.wieneke@me.com
Subject Line: Cat 16 Spring 2018 Master Item List
Attachment: Cat 16 Spring 2018 Master Item List.xlsx
Classification: Highly Sensitive
File Description: The tab 'Master Item List' contains detailed item information for
approximately 150 items, including cost information, space, timeframe, recipients' information,
exit, feature, comments, and a financial summary segment for each item.

Exfiltration Number 4

Date: October 5, 2017

Time: 10:13 PM (CDT)
Email From: Jonathan. Wieneke@Samsclub.com
Email To: jonathan.wieneke@me.com
Subject Line: IQS Rankam 23 inch kettle grill with cast iron
Attachment: IQS Rankam 23 inch kettle grill with cast iron grid 07312017.xlsx
Classification: Highly Sensitive
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 14 of 16 PageID #: 14

File Description: The first line of the spreadsheet notates boldly within an oversize red colored
cell "Sam's Club Internal Import Quote Sheet-DO NOT SHARE." The page included a photo
of a grill and included general information, product highlights, a container loading section, a
costing section, and a final costing section. Near the bottom of the spreadsheet, another row
warned "ALL INFORMATION BELOW THIS LINE IS STRICTLY FOR THE USE OF
WALMART/SAM'S CLUB/DSG. DO NOT SHARE!!!"

Exfiltration Number 5

Date: October 5, 2017

Time: 10:15 PM (CDT)
Email From: Jonathan. Wieneke@Samsclub.com
Email To: jonathan.wieneke@me.com
Subject Line: Sam's US Buy Trip Recap C16 Spring 2018 09252017.xlsx
Attachment: Sam's US Buy Trip Recap C16 Spring 2018 09252017.xlsx
Classification: Highly Sensitive
File Description: The spreadsheet contained detailed item descriptions for 25 items, including
vendor and factory name, audit status for the factories, production testing results, costing
information, shipping data, and related internal purchase order status. Note: The data includes
Masterbuilt products as well as its competitors, like Rankam VDG Industries and Vision Grills.

Exfiltration Number 6

Date: October 5, 2017

Time: 10:17 PM (CDT)
Email From: Jonathan. Wieneke@Samsclub.com
Email To: jonathan.wieneke@me.com
Subject Line: Sam's US Buy Trip Recap C16 Fall 2017 09252017.xlsx
Attachment: Sam's US Buy Trip Recap C16 Fall 2017 09252017.xlsx
Classification: Highly Sensitive
File Description: The spreadsheet contains detailed item descriptions for 23 items, including
vendor and factory name, audit status for the factories, production testing results, costing
information, shipping data, and related internal purchase order status. Again, Masterbuilt is
shown therein, as well as their competitors' similar products.

20. While investigating a similar case involving Theft of Trade Secrets by a former

WC employee, your Affiant learned upon initial employment with the company, all WC

employees must complete training on the proper procedures and regulations for safeguarding WC

proprietary data and information. Your Affiant had previously received and reviewed a document

provided by WC representatives entitled "Global Statement of Ethics" referencing guidelines all

employees are provided upon their hiring. A review of this document revealed the Statement of

Ethics applies to all associates at all levels of the organization worldwide and all members of the
 Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 15 of 16 PageID #: 15

board of directors of Wal-Mart, Inc. It also applies to all associates and directors of Walmart

controlled subsidiaries. The section further went on to state Walmart expects all suppliers,

consultants, law firms, public relations firms, contractors and other service providers to act

ethically and in a manner consistent with the Statement of Ethics. The document had a section

entitled "Walmart Assets" that explained there is a responsibility to use Walmart property and

assets for Walmart business and not allow them to be used for any type of personal gain. The

employee is responsible for maintaining Walmart property under their control and should take

reasonable steps to protect it from theft, misuse, loss, damage or sabotage. A further review of

the document showed a question and answer section with a particular question relating to the

ongoing investigation. The question was phrased, "A co-worker of mine has recently given her

resignation. Since then, she's been emailing supplier contact information to her home computer

so she can start her own business. Is this a violation?" The corresponding answer was "Yes. The

supplier information she obtained through her position at Walmart is considered confidential

company information. She should not be using it for her personal business. You should report

this to Global Ethics." According to WC representatives, WIENEKE would have also been made

to complete training and agree to the terms and conditions outlined in the WC Global Statement

of Ethics upon his initial employment with the company.

Conclusion

55. Based on the foregoing information, probable cause exists to believe there is

located on the computer servers of Apple, Inc., One Apple Park Way in Cupertino, California

95014 evidence of violations of Title 18, United States Code, Section 1832 - Theft of Trade

Secrets. Your affiant prays upon his honorable court to issue a search warrant to Apple, Inc., for

the items set forth in attachment "B" (which is attached hereto and incorporated herein by
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 16 of 16 PageID #: 16

reference), that constitute evidence, fruits, and instrumentalities of violation of Title 18, United

States Code, Sections 1832.

Gerald Faulkner, Special Agent

Homeland Security Investigations

Affidavit subscribed and sworn to before me this ~9fV\. dayof tf\~ C

2018

Erin L. Weide,riiann
United States Magistrate Judge