MAR/16/2012/FRI 09 : 13 AM

2ND DISTRI C C U T T OR

. FAX No; B 1 3'95 11 B I] 2

."

...

IN THE SECOND DISTRICT COURT - OGDEN DEPARTMENT

IN AND FOR WEBER COUNTY, STATE OF UTAH
" . -,...
.... ..
- ,

SEARCH WARRANT
No. 1130321

COUNTY OF WEBER, STATE OF UTAH

To any peace officer in the State of Utah: Proof by Affidavit under oath having been made this day before me by Detective BRIAN K EYNON of Ogden, I am satisfied that there is probable cause to believe

THAT
On the premises known as Intermountain Regional Computer Forensic Laboratory, located at 440 W 200 S. Suite 300 Salt Lake City, Utah, further described as Black computer tower (PC), containing hard drive. This computer was recovered from Stewart's bedroom during the execution of a previous search warrant.; In the City of Salt Lake City, County of Weber, State of Utah, there is now certain property or evidence described as: 1. Computer(s), computer hardware, software, related documentation, passwords, data security devices (as described below), videotapes, video recording devices, video recording players, monitors and or televisions, and data were instrumentality's of and will contain evidence related to this crime. The following definitions apply to the terms as set out in this affidavit and attachment:

a. Computer hardware consists of all equipment, which can receive, capture, collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, or similar computer impulses or data . Hardware includes any data-processing devices (including but not limited to central processing units; internal and peripheral storage devices such as fixed disks, external hard drives, floppy disk drives and diskettes , and other memory storage devices); peripheral input/output devices (including but not limited to keyboards, printer,

- Page 1 of Search Warrant No. 1130321 . .

MAR/16/2012/FRI 09 :14 AM

2ND DISTRICT COURT

hX !J Fn N' .

I.J..}

Q I~11

.) 0 ,.)

?n~

11,;vL '.....

p, 003

video display monitors, and related communications devices such as cables and connections), as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (including but not limited to physical keys and locks).

b. Computer software is digital information, which can be interpreted by a computer and any of its related components to direct the way they work. Software is stored in electronic, magnetic, or other digital form. It commonly includes programs to run operating systems, applications, and utilities.

c. Computer-related documentation consists of written, recorded, printed, or electronically stored material, which explains or illustrates how to configure or use computer hardware, software, or other related items. d. Computer passwords and other data security devices are designed to restrict access to or hide computer software, documentation, or data. Data security devices may consist of hardware, software, or other programming code. A password (a string of alphanumeric characters) usually operates a sort of digital key to "unlock" particular data security devices. Data security hardware may include encryption devices, chips, and circuit boards. Data security software of digital code may include programming code that creates "test" keys or "hot" keys, Which perform certain pre-set security functions when touched. Data security software or code may also encrypt; compress, hide, or "booby-trap" protected data to make it inaccessible or unusable, as well as reverse the progress to restore it.

2. Any and all notes, documents, records, or correspondence pertaining to child pornography as defined in Utah criminal code section 76-5a-2 .

76-5a-2. Definitions. As used in this chapter: (1) "Child pornoqraphy" means any visual depiction, including any live performance, photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where: (a) the production of the visual depiction involves the use of a minor engaging in sexually explicit conduct; (b) the visual depiction is of a minor engaging in sexually explicit conduct; or

- Page 2 of Search Warrant No, 1130321 -

MAR/16/2012/FRI 09: 14 A. 2ND DISTRICT COURT

"

.-

(c) the visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct. (2) "Distribute" means the selling, exhibiting, displaying, wholesaling, retailing, providing, giving, granting admission to, or otherwise transferring or presenting child pornography with or without consideration. (3) "Identifiable minor": (a) means a person: (i) (A) who was a minor at the time the visual depiction was created, adapted, or modified; or (8) whose image as a minor was used in creating, adapting, or modifying the visual depiction; and (ii) who is recognizable as an actual person by the person's face, likeness, or other distinguishing characteristic, such as a birthmark, or other recognizable feature; and (b) does not require proof of the actual identity of the identifiable minor. (4) "Live performance" means any act, play, dance, pantomime, song, or other activity performed by live actors in person. (5) "Minor" means a person younger than 18 years of age. (6) "Nudity.or partial nudity" means any state of dress or undress in which the human genitals, pubic region, buttocks, or the female breast, at a point below the top of the areola, is less than completely and opaquely covered. (7) "Produce" means the photographing, filming, taping, directing, producing, creating, designing, or composing of child pornography or the securing or hiring of persons to engage in the production of child pornography. (8) "Sexually explicit conduct" means actual or simulated: (a) sexual intercourse, including qenital-qenital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex; (b) masturbation; (c) bestiality; (d) sadistic or masochistic activities; (e) lascivious exhibition of the genitals or pubic area of any person; (f) the visual depiction of nudity or partial nudity for the purpose of causing sexual arousal of any person; (g) the fondling or touching of the genitals, pubic region, buttocks, or female breast; or (h) the explicit representation of the defecation or urination functions. (9) "Simulated sexually explicit conduct" means a feigned or pretended act of sexually explicit conduct which duplicates, within the perception of an average person, the appearance of an actual act of sexually explicit conduct. Amended by Chapter 176, 2001 General Session 1. Any and all correspondence identifying persons transmitting, through interstate commerce including by United States Mails or by computer) any visual depictions of minors engaged in sexually explicit conduct.
- Page 3 of Search Warrant No. 1130321 "

MAR/l '6 /2012/FRI 09 :14 AM

2HD DISTRICT COURT

FA N 801 395 1182 X o.

P. 005

2. Any and all records, documents, invoices and materials that concern any accounts with Internet Service Provider.

3. Any and all visual depictions of minors engaging in or involved in obscene or pornographic actions or displays.

4. Any and all diaries, notebooks, notes, and any other records reflecting personal contact and any other activities with minors visually depicted while engaged in sexually explicit conduct.

5. Any and all records, documents, invoices and materials that concern any accounts with Internet Service Provider.

6. Any of the items as described above which are stored in the form of magnetic or electronic coding on computer media or on media capable of being read by a computer with the aid of computer-related equipment, including floppy diskettes, fixed hard disks, or removable hard disk cartridges, software or memory in any form. The search procedure of the electronic data contained in computer operating software or memory devices may include the following techniques:

a. surveying various file "directories" and the individual files they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent files).

b. "opening" or cursorily reading the first few "pages" of such files in order to determine their precise contents;

c. "scanning" storage areas for deliberately hidden files; or

- Page 4 of Search Warrant No. 1130321 -

MAR/16/2012/FRI 09 :14 AM

2ND DISTRICT COURT

FAX N, eo I 395 1182 . I}

p, 006

d. performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation.

And that said property or evidence was unlawfully acquired or is unlawfully possessed, has been used, or is possessed with the purpose of being used to commit or conceal the commission of an offense, or is evidence of illegal conduct. and that said property or evidence: Was unlawfully acquired or is unlawfully possessed, or Has been used to commit or conceal a public offense, or Is being possessed with the purpose to use it as a means of committing or concealing a public offense, or Consists of an item of, or constitutes evidence of, illegal conduct, possessed by a party to the illegal conduct Affiant believes the property and evidence described above is evidence of the crime or crimes of And that said property or evidence was unlawfully acquired or is unlawfully possessed, has been used, or is possessed with the purpose of being used to commit or conceal the commission of an offense, or is evidence of illegal conduct. Your affiant believes that the evidence likely to be obtained from this computer is relevant to an ongoing criminal investigation being conducted by Ogden Police Department, in connection with possible violations of Utah Criminal Code; Child Pornography, 76-5a-2.. YOU ARE THEREFORE COMMANDED: to make a search in the daytime of the above-named or described premises for the herein-above described property or evidence and if you find the same or any part thereof, to bring it forthwith before me at the SECOND DISTRICT COURT - OGDEN DEPARTMENT, County of Weber, State of Utah, or retain such property in your custody, subject to the order of this court.

Dated: 22nd day of February, 2012 lsI

- Page 5 of Search Warrant No. 1130321 -

MAR/16/2012/ FRI 09: 14 AM

2ND DISTRICT COURT

F XNo . :3 01 395 1182 A

t ,, I

n07
~

. ,

.,

IN THE SECOND DISTRICT COURT - OGDEN DEPARTMENT IN AND FOR WEBER COUNTY, STATE OF UTAH

AFFIDAVIT FOR SEARCH WARRANT STATE OF UTAH) .ss County of Weber) The undersigned affiant, Detective BRIAN K EYNON of Ogden, upon a sworn oath, deposes and says:

That your affiant has reason to believe: THAT On the premises known as Intermountain Regional Computer Forensic Laboratory, located at 440 W 200 S. Suite 300 Salt Lake City, Utah, further described as Black computer tower (PC), containing hard drive. This computer was recovered from Stewart's bedroom during the execution of a previous search warrant.; In the City of Salt Lake City, County of Weber, State of Utah, there is now certain property or evidence described as: 1. Computer(s), computer hardware, software, related documentation, passwords, data security devices (as described below), videotapes, video recording devices, Video recording players, monitors and or televisions, and data were instrumentality's of and will contain evidence related to this crime. The following definitions apply to the terms as set out in this affidavit and attachment:

a. Computer hardware consists of all equipment, which can receive, capture, collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, or similar computer lrnpulses or data. Hardware includes any data-processing devices (including but not limited to central processing units; internal and peripheral storage devices such as fixed disks, external hard drives, floppy disk drives and diskettes, and other memory storage devices); peripheral input/output devices (including but not limited to keyboards, printer,

- Page 1 of Affidavit for Search Warrant No. 1130321 -

MAR/16/2012/FRI 09 :15 AM

2ND DISTRICT COURT

p, 008

video display monitors, and related communications devices such as cables and connections), as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (including but not limited to physical keys and locks).

b. Computer software is digital information, which can be interpreted by a computer and any of its related components to direct the way they work. Software is stored in electronic, magnetic, or other digital form. It commonly includes programs to run operating systems, applications, and utilities.

c. Computer-related documentation consists of written, recorded, printed, or electronically stored material, which explains or illustrates how to configure or use computer hardware, software, or other related items. d. Computer passwords and other data security devices are designed to restrict access to or hide computer software, documentation, or data. Data security devices may consist of hardware, software, or other programming code. A password (a string of alphanumeric characters) usually operates a sort of digital key to "unlock" particular data security devices. Data security hardware may include encryption devices, chips, and circuit boards. Data security software of digital code may include programming code that creates "test" keys or "hot" keys, which perform certain pre-set security functions when touched. Data security software or code may also encrypt; compress, hide, or "booby-trap" protected data to make it inaccessible or unusable, as well as reverse the progress to restore it.

2. Any and all notes, documents, records, or correspondence pertaining to child pornography as defined in Utah criminal code section 76-5a-2.

76-5a-2. Definitions. As used in this chapter: (1) "Child pornography" means any visual depiction, including any live performance, photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where: (a) the production of the visual depiction involves the use of a minor engaging in sexually explicit conduct; (b) the visual depiction is of a minor engaging in sexually explicit conduct; or

- Page 2 of Affidavit for Search Warrant No. 1130321 -

MAR/16/2012/FRI 09 :1 5 AM . 2ND DISTRICT 'COURT

P 009 .

(c) the visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct. (2) "Distribute" means the selling, exhibiting, displaying, wholesaling, retailing, providing, giving, granting admission to, or otherwise transferring or presenting child pornography with or without consideration. (3) "Identifiable minor": (a) means a person: (i) (A) who was a minor at the time the visual depiction was created, adapted, or modified; or (B) whose image as a minor was used in creating, adapting, or modifying the visual depiction; and (ii) who is recognizable as an actual person by the person's face, likeness, or other distinguishing characteristic, such as a birthmark, or other recognizable feature; and (b) does not require proof of the actual identity of the identifiable minor. (4) "Live performance" means any act, play, dance, pantomime, song, or other activity performed by live actors in person. (5) "Minor" means a person younger than 18 years of age. (6) "Nudity or partial nudity" means any state of dress or undress in which the human genitals, pubic region, buttocks, or the female breast, at a point below the top of the areola, is less than completely and opaquely covered. (7) "Produce" means the photographing, filming, taping, directing, producing, creating, designing, or composing of child pornography or the securing or hiring of persons to engage in the production of child pornography. (8) "Sexually explicit conduct" means actual or simulated: (a) sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex; (b) masturbation; (c) bestiality; (d) sadistic or masochistic activities; (e) lascivious exhibition of the genitals or pubic area of any person; (f) the visual depiction of nudity or partial nudity for the purpose of causing sexual arousal of any person; (g) the fondling or touching of the genitals, pubic region, buttocks, or female breast; or (h) the explicit representation of the defecation or urination functions. (9) "Simulated sexually explicit conduct" means a feigned or pretended act of sexually explicit conduct which duplicates, within the perception of an average person, the appearance of an actual act of sexually explicit conduct. Amended by Chapter 176, 2001 General Session 1. Any and all correspondence identifying persons transmitting, througll interstate commerce including by United States Mails or by computer, any visual depictions of minors engaged in sexually explicit conduct.
~

Page 3 of Affidavit for Search Warrant No. 1130321 -

MAR/16/2012/FRI 09 : 15 AM

2ND DISTRICT COURT

FAX No , aOI 395 1182

P. l

n1n
'-' '-'

2. Any and all records, documents, invoices and materials that concern any accounts with Internet Service Provider.

3. Any and all visual depictions of minors engaging in or involved in obscene or pornographic actions or displays.

4. Any and all diaries, notebooks, notes, and any other records reflecting personal contact and any other activities with minors visually depicted while engaged in sexually explicit conduct.

5. Any and all records, documents, invoices and materials that concern any accounts with Internet Service Provider.

6. Any of the items as described above which are stored in the form of magnetic or electronic coding on computer media or on media capable of being read by a computer with the aid of computer-related equipment, including floppy diskettes, fixed hard disks, or removable hard disk cartridges, software or memory in any form. The search procedure of the electronic data contained in computer operating software or memory devices may include the following techniques:

a. surveying various file "directories" and the individual files they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent files).

b. "opening" or cursorily reading the first few "paqes" of such files in order to determine their precise contents;

c. "scanning" storage areas for deliberately hidden files; or

- Page 4 of Affidavit for Search Warrant No. 1130321

MAR/16/2012/FRI 09: 15 A 2ND DISTRICT COURT M

FAX N pnl o
l\ . _ J

'"'

~q~

\,J ....,

l1R?
"oJ ...

P. 011

d. performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation.

And that said property or evidence was unlawfully acquired or is unlawfully possessed, has been used, or is possessed with the purpose of being used to commit or conceal the commission of an offense, or is evidence of illegal conduct. and that said property or evidence: Was unlawfully acquired or is unlawfully possessed, or Has been used to commit or conceal a public offense, or

Is being possessed with the purpose to use it as a means of committing or concealing a public offense, or Consists of an item of, or constitutes evidence of, illegal conduct, possessed by a party to the illegal conduct. Affiant believes the property and evidence described above is evidence of the crime or crimes of And that said property or evidence was unlawfully acquired or is unlawfully possessed, has been used, or is possessed with the purpose of being used to commit or conceal the commission of an offense, or is evidence of illegal conduct. Your affiant believes that the evidence likely to be obtained from this computer is relevant to an ongoing criminal investigation being conducted by Ogden Police Department, in connection with possible violations of Utah Criminal Code; Child Pornography,
76~5a-2 ..

The facts to establish the grounds for issuance of a Search Warrant are: The facts establishing the grounds for issuance of a search warrant are: Your affiant is a swom Law Enforcement Officer with 16 years experience in the State of California and in the State of Utah (since 2005), and is currently employed by the Ogden Police Department, in Ogden, Weber County, Utah, assigned to the Major Crimes Bureau. The Major Crimes Bureau has the responsibility of follow-up investigations of crimes committed by adults and juveniles involving crimes against persons and property. The primary objective of this Bureau is to provide both investigative and general support to other divisions of the Ogden Police Department. Your affiant has been assigned primarily to investigate crimes against persons which includes but is not limited to Homicide, Assault, and Robbery. During your affiant's career in law enforcement, he has also investigated various other

Page 5 of Affidavit for Search Warrant No. 1130321

MAR/16/2012/FRI 09 :15 AM

2ND DISTRICT COURT

F XNo . 801 395 1182 A

P 012 .

offenses including burglary and theft, financial crimes, child abuse, and domestic violence. Your affiant has attended the following sample of training related to law enforcement: a. Los Angeles Police Department P.O.S.T. Academy b. Field Training Officer c. P.O.S.T. Instructor d. Interview and Interrogation e. TASER training f. S.W.A.T. training g. K-9 Training h. Narcotics Enforcement i. Search / Arrest Warrant j. Arrest and Control Instructor k. International and Domestic Terrorism I. Domestic Violence Law Enforcement Training rn . Threat management n. Incident Command System o. High Risk Patrol Tactics Your affiant is personally acquainted with the facts in this case and has conducted an investigation of the matter referred to herein. On 01-04-2012, at approximately 2040 hours, Agents from the Weber-Morgan Narcotics Strike Force attempted to serve a drug related warrant at Matthew David Stewart's residence, located at 3268 Jackson, Ogden. During the execution of that warrant, Stewart shot and killed Agent Jared Francom, and seriously injured Agent Kasey Burrell, Agent Nate Hutchinson, Agent Jason Vanderwarf, Agent Sean Grogan, and Officer Mike Rounkles. After a subsequent gun battle with officers in the rear yard of his residence, Stewart was arrested and later booked into the Weber County Jail. During the subsequent investigation of this case, I interviewed Stewart's ex-girlfriend, identified as Stacey Wilson. Wilson told me that Stewart is very much in to World of Warcraft (computer game), 911 conspiracy theories (where Stewart believes that the U.S. government is responsible for the 911 attacks), 2012 End of the World theories, and that he also believes that the U.S. Constitution does not provide the federal government the right to collect taxes. Wilson told me that Stewart has not paid his Federal or State taxes since 2005. Wilson remembers Stewart telling her that he used to be a security guard at the IRS and that if "they" ever forced him to pay taxes, he knew how to "get into" the

- Page 6 of Affidavit for Search Warrant No. 1130321

MAR/16/2012/FRI 09 :16 AM

2ND DISTRICT COURT

FAX No . :301 395 1182

p . . Oli -

IRS. and that once inside, he would "kill IRS employees". Wilson also told me that Stewart would often tell her that Timothy McVey was misunderstood and that he (McVey) did not mean to kill the children inside the Federal building .

Wilson stated that Stewart was consistently on his computer and that he would research anti-U.S. government websites. Wilson stated that Stewart did not have a home or cellular telephone, and that he would often communicate with friends via World of Warcraft on his computer. Wilson also told me that Stewart does not have a Facebook, or Myspace account. She did advise me that his last known email addressissupernaturalmyth@yahoo.com. During the execution of another search warrant for Stewart's residence, I recovered various computer generated documents related to anti-U.S. government websites, marijuana manufacturing methods and products, anti-police websites, Oklahoma City bombing related websites, and guns and ammunition websites. I also recovered a map of the 12th St IRS building, located in Ogden Utah. This map was highlighted with ingress and egress routes. I also recovered an instruction sheet for potassium chloride (compound used in making explosives). During the collection of evidence while executing the aforementioned search warrant, explosive materials and what appeared to be the makings of a bomb were observed by your affiant in a linen closet. These items were later collected, and detonated by bomb squad personnel. Related to that incident, investigators discovered that Stewart had ordered the bomb making material via the internet. I observed the black PC (no name brand) computer tower on a table top, located in the Northern bedroom of Stewart's residence. I recovered that computer and booked into OPD evidence. I later obtained a search warrant (reference E Warrant #1127861, signed by Judge Hyde) for the aforementioned PC and served that warrant. While observing and extracting pertinent evidence related to that warrant, I observed multiple images consistent with child pornography.

2. Your affiant believes that the evidence likely to be obtained from this computer is relevant to an ongoing criminal investigation being conducted by Ogden Police Department, in connection with possible violations of Utah Criminal Code; Child Pornography, 76-5a-2 . 3. Based upon your affiant's knowledge, training and experience, your affiant knows that searching and seizing information from computers often requires to seize most or all electronic storage devices (along with related peripherals) to be

- Page 7 of Affidavit for Search Warrant No. 1130321 -

MAR/16/2012/FRI" 09 : 16 AM

2ND DISTRICT COURT

FAX No. 801

1182

P I] 14 .

searched later by a qualified computer expert in a laboratory or other controlled environment. This is true because of the following:

a. The volume of evidence. Computer storage devices (like hard disks, diskettes, tapes, laser disks) can store the equivalent of millions of information. Additionally, a suspect may try to conceal criminal evidence; he or she might store it in random order with deceptive file names. This may require searching authorities to examine all the stored data to determine which particular files are evidence or instrumentalities of crime. This sorting process can take weeks or months, depending on the volume of data stored, and it would be impractical and invasive to attempt this kind of data search on-site.

b. Technical Requirements. Searching computer systems for criminal evidence is a highly technical process requiring expert skill and a properly controlled environment. The vast array of computer hardware and software available requires even computer experts to specialize in some systems and applications, so it is difficult to know before a search which expert is qualified to analyze the system and its data. In any event, however, data search protocols are exacting scientific procedures designed to protect the integrity of the evidence and to recover even "hidden," erased , compressed, password-protected, or encrypted files. Because computer evidence is vulnerable to inadvertent or intentional modification or destruction (both from external sources or from destructive code imbedded in the system as a "booby trap"), a controlled environment may be necessary to complete an accurate analysis. Further, such searches often require the seizure of most or all of a computer system's input/output peripheral devices, related software, documentation, and data security devices (including passwords) so that a qualified computer expert can accurately retrieve the system's data in a laboratory or other controlled environment. In light of these concerns, your affiant hereby requests the Court's permission to seize the computer hardware (and associated peripherals) that are believed to contain some or all of the evidence described in the warrant, and to conduct an off-site search of the hardware for the evidence described, if, upon arriving at the scene, the agents executing the search conclude that it would be impractical to search the computer hardware on-site for this evidence. This affidavit has been reviewed by Dee Smith of the Weber County Attorney Office, and it has been approved for presentation to the court. WHEREFORE, your affiant prays that a Search Warrant be issued for the seizure of said items in the daytime.
I declare under criminal penalty of the State of Utah that the foregoing is true and correct.

"Page 8 of Affidavit for Search Warrant No. 1130321

MAR/16/2012/FRI 09 :16 AM

2ND DISTRICT COURT

FAX No . 801 395 1182

P. 015

Executed on: 22nd day of February, 2012 by

lsi BRIAN K EYNON

- Page 9 of Affidavit for Search Warrant No. 1130321 -

MAR/16/2012/ FRI 09 :16 AM

2ND DISTRICT COURT

P 016 .

RETURN TO SEARCH WARRANT NO. 1130321 The personal property listed below or set out on the inventory attached hereto was taken from the person of Intermountain RCFL. Re; Matthew Stewart, by virtue of a search warrant dated the 22nd day of February, 2012, and issued by Magistrate NOEL S HYDE of the SECOND DISTRICT COURT - OGDEN DEPARTMENT: Multiple imagages consistent with child pronography. I, Detective BRIAN K EYNON of Ogden, by whom this warrant was executed, do swear that the above listed or below attached inventory contains a true and detailed account of all the property taken by me under the warrant, on the 22nd day of February, 2012. All of the property taken by virtue of said warrant will be retained in my custody subject to the order of this court or of any other court in which the offense in respect to which the property, or things taken, is triable.

I declare under criminal penalty of the State of Utah that the foregoing is true and correct.
Executed on: 22nd day of February, 2012 by /s/ BRIAN K EYNON

Page 1 of Return of Service for Search Warrant No. 1130321 -

MAR/16/20 12/ FR I 09 :16 AM

2ND DISTRICT COURT

F XNo , : 01 3'9 :, 1182 A 3

P, 017

IN THE SECOND DISTRICT COURT - OGDEN DEPARTMENT

IN AND FOR WEBER COUNTY, STATE OF UTAH

SEARCH WARRANT No. 1127861

COUNTY OF WEBER, STATE OF UTAH To any peace officer in the State of Utah: Proof by Affidavit under oath having been made this day before me by Detective BRIAN K EYNON of Ogden, I am satisfied that there is probable cause to believe THAT On the premises known as Ogden Police Property Division, located at 2186 . Lincoln Ave. Ogden, further described as Red brick building with a green roof.; In the City of In the City of Ogden, County 0, County of Weber, State of Utah, there is now certain property or evidence described as: Black computer tower (PC) , containing hard drive. This computer was recovered from Stewart's bedroom during the execution of a previous search warrant.

1. Computer(s), computer hardware, software, related documentation, passwords, data security devices (as described below), videotapes, video recording devices, video recording players, monitors and or televisions, and data were instrumentality's of and will contain evidence related to this crime. The followinq definitions apply to the terms as set out in this affidavit and attachment:

a. Computer hardware consists of all equipment, which can receive, capture, collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, or similar computer impulses or data. Hardware includes any data-processing devices (including but not limited to central processing units; internal and peripheral storage devices such as fixed disks, external hard drives, floppy disk drives and diskettes, and other memory storage devices);

- Page 1 of Search Warrant No. 1127861 -

MAR/16/2012/ FRI 09 :17 AM

2ND DISTRICT COURT

FAX No , : 01 JJJ 112 3 c;, n~ v

P 018 .

peripheral input/output devices (including but not limited to keyboards, printer, video display monitors, and related communications devices such as cables and connections), as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (including but not limited to physical keys and locks).

b. Computer software is digital information, which can be interpreted by a computer and any of its related components to direct the way they work. Software is stored in electronic, magnetic, or other digital form. It commonly includes programs to run operating systems, applications, and utilities.

c. Computer-related documentation consists of written, recorded, printed, or electronically stored material, which explains or illustrates how to configure or use computer hardware, software, or other related items. d. Computer passwords and other data security devices are designed to restrict access to or hide computer software, documentation, or data. Data security devices may consist of hardware, software, or other programming code. A password (a string of alphanumeric characters) usually operates a sort of digital key to "unlock" particular data security devices. Data security hardware may include encryption devices, chips, and circuit boards. Data security software of digital code may include programming code that creates "test" keys or "hot" keys, which perform certain pre-set security functions when touched. Data security software or code may also encrypt; compress, hide, or "booby-trap" protected data to make it inaccessible or unusable, as well as reverse the progress to restore it.

2. Any and all notes, documents, records, or correspondence.

3. Any and all records, documents, invoices and materials that concern any accounts with Internet Service Provider.

4. Any of the items as described above which are stored in the form of magnetic or electronic coding on computer media or on media capable of being read by a computer with the aid of computer-related equipment, including floppy diskettes, fixed hard disks, or removable hard disk cartridges, software or memory in
Page 2 of Search Warrant No. 1127861 -

MAR/16/2012/ FRI 09 :17 AM

2ND DISTRICT COURT

FAX N 801 395 1182 o.

P. I] 19

any form. The search procedure of the electronic data contained in computer operating software or memory devices may include the following techniques:

a. surveying various file "directories" and the individual files they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent files).

b. "opening" or cursorily reading the first few "pages" of such files in order to determine their precise contents;

c. "scanning" storage areas for deliberately hidden files; or

d. performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation. and that said property or evidence: Was unlawfully acquired or is unlawfully possessed, or Has been used to commit or conceal a public offense, or Is being possessed with the purpose to use it as a means of committing or concealing a public offense, or Consists of an item of, or constitutes evidence of, illegal conduct, possessed by a party to the illegal conduct. Affiant believes the property and evidence described above is evidence of the crime or crimes of Utah Criminal Code Aggravated Murder, 76-5-206 (b).. YOU ARE THEREFORE COMMANDED: to make a search in the daytime of the above-named or described premises for the herein-above described property or evidence and if you find the same or any part thereof, to bring it forthwith before me at the SECOND DISTRICT COURT - OGDEN DEPARTMENT, County of Weber, State of Utah, or retain such property in your custody, subject to the order of this court.

- Page 3 of Search Warrant No. 1127861 -

MAR/16/2012/ FRI 09: 17 A 2ND DISTRICT C UT M OR

0 ' il F.AX N R l ; q5 11 0 ~ v, 'oJ""........ UL

P 02 0 .

Dated: 9th day of February, 2012 lsi

- Page 4 of Search Warrant No. 1127861

MAR/16/2012/ FRI 09 :17 AM

2ND DISTRICT COURT

p. n? 1 .... .... .

IN THE SECOND DISTRICT COURT - OGDEN DEPARTMENT IN AND FOR WEBER COUNTY, STATE OF UTAH
..

"'"

AFFIDAVIT FOR SEARCH WARRANT

STATE OF UTAH) :ss County of Weber) The undersigned affiant, Detective BRIAN K EYNON of Ogden, upon a sworn oath, deposes and says: That your affiant has reason to believe: THAT On the premises known as Ogden Police Property Division, located at 2186 Lincoln Ave. Ogden, further described as Red brick building with a green roof.: In the City of In the City of Ogden, County 0, County of Weber, State of Utah, there is now certain property or evidence described as: Black computer tower (PC), containing hard drive. This computer was recovered from Stewart's bedroom during the execution of a previous search warrant.

1. Computer(s), computer hardware, software, related documentation, passwords, data security devices (as described below), videotapes, video recording devices, video recording players, monitors and or televisions, and data were instrumentality's of and will contain evidence related to this crime. The following definitions apply to the terms as set out in this affidavit and attachment:

a. Computer hardware consists of all equipment, which can receive, capture, collect, analyze, create, display, convert, store, conceal , or transmit electronic, magnetic, or similar computer impulses or data. Hardware includes any data-processing devices (including but not limited to central processing units; internal and peripheral storage devices such as fixed disks, external hard drives, floppy disk drives and diskettes, and other memory storage devices);
- Page 1 of Affidavit for Search Warrant No. 1127861

MAR/16/2012/ FRI 09 :17 AM

2ND DISTRICT COURT

FAX NO.30l 395 1132

P 022 .

peripheral input/output devices (including but not limited to keyboards, printer, video display monitors, and related communications devices such as cables and connections), as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (including but not limited to physical keys and locks).

b. Computer software is digital information, which can be interpreted by a computer and any of its related components to direct the way they work. Software is stored in electronic, magnetic, or other digital form. It commonly includes programs to run operating systems, applications, and utilities.

c. Computer-related documentation consists of written, recorded, printed, or electronically stored material, which explains or illustrates how to configure or use computer hardware, software, or other related items. d. Computer passwords and other data security devices are designed to restrict access to or hide computer software, documentation, or data. Data security devices may consist of hardware, software, or other programming code. A password (a string of alphanumeric characters) usually operates a sort of digital key to "unlock" particular data security devices. Data security hardware may include encryption devices, chips, and circuit boards. Data security software of digital code may include programming code that creates "test" keys or "hot" keys, which perform certain pre-set security functions when touched. Data security software or code may also encrypt; compress, hide, or "booby-trap" protected data to make it inaccessible or unusable, as well as reverse the progress to restore it.

2. Any and all notes, documents, records, or correspondence.

3. Any and all records, documents, invoices and materials that concern any accounts with Internet Service Provider.

4. Any of the items as described above which are stored in the form of magnetic or electronic coding on computer media or on media capable of being read by a computer with the aid of computer-related equipment, including floppy diskettes, . fixed hard disks, or removable hard disk cartridges, software or memory in
- Page 2 of Affidavit for Search Warrant No. 1127861 -

MAR/16/2012/FRI 09 :18 A

2ND DISTRICT COURT

FhY N' sn 1 ~yl: 11 Q .)

""'.. 11.

V.

I,) .

..} "", ...J

UL

P. 023

any form. The search procedure of the electronic data contained in computer operating software or memory devices may include the following techniques:

a. surveying various file "directories" and the individual files they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent files).

b. "openlnp'' or cursorily reading the first few "pages" of such files in order to determine their precise contents;

c. "scanning" storage areas for deliberately hidden files; or

d. performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation. and that said property or evidence: Was unlawfully acquired or is unlawfully possessed, or Has been used to commit or conceal a public offense, or Is being possessed with the purpose to use it as a means of committing or concealing a public offense, or

Consists of an item of, or constitutes evidence of, illegal conduct, possessed by a party to the illegal conduct. Affiant believes the property and evidence described above is evidence of the crime or crimes of Utah Criminal Code Aggravated Murder, 76-5-206 (b).. The facts to establish the grounds for issuance of a Search Warrant are: The facts establishing the grounds for issuance of a search warrant are: Your affiant is a sworn Law Enforcement Officer with 16 years experience in the State of California and in the State of Utah (since 2005), and is currently employed by the Ogden Police Department, in Ogden, Weber County, Utah, assigned to the Major Crimes Bureau. The Major Crimes Bureau has the responsibility of follow-up investigations of crimes committed by adults and juveniles involving crimes against persons and

Page 3 of Affidavit for Search Warrant No. 1127861 -

MAR/16/2012/FR I 09 :18 AM

2ND DISTRICT COURT

AX " qOI F.. N . \; J

~q(; ~ w J

11 '0'L ""

p, 024

property. The primary objective of this Bureau is to provide both investigative and general support to other divisions of the Ogden Police Department. Your affiant has been assigned primarily to investigate crimes against persons which includes but is not limited to Homicide, Assault, and Robbery. During your affiant's career in law enforcement, he has also investigated various other offenses including burglary and theft, financial crimes, child abuse, and domestic violence. Your affiant has attended the following sample of training related to law enforcement: a. Los Angeles Police Department P.O.S.T. Academy b. Field Training Officer c. P.O.S.T. Instructor d. Interview and Interrogation e. TASER training f. S.W.A.T. training g. K-9 Training h. Narcotics Enforcement i, Search I Arrest Warrant j. Arrest and Control Instructor k. International and Domestic Terrorism L Domestic Violence Law Enforcement Training m. Threat management n. Incident Command System o. High Risk Patrol Tactics Your affiant is personally acquainted with the facts in this case and has conducted an investigation of the matter referred to herein. On 01-04-2012, at approximately 2040 hours, Agents from the Weber-Morgan Narcotics Strike Force attempted to serve a drug related warrant at Matthew David Stewart's residence, located at 3268 Jackson, Ogden. During the execution of that warrant, Stewart shot and killed Agent Jared Francom, and seriously injured Agent Kasey Burrell, Agent Nate Hutchinson, Agent Jason Vanderwarf, Agent Sean Grogan, and Officer Mike Rounkles. After a subsequent gun battle with officers in the rear yard of his residence, Stewart was arrested and later booked into the Weber County Jail. During the subsequent investigation of this case, I interviewed Stewart's ex-girlfriend, identified as Stacey Wilson. Wilson told me that Stewart is very much in to World of Warcraft (computer game), 911 conspiracy theories (where Stewart believes that the U.S. government is responsible for the 911 attacks), 2012 End of the World theories, and that he also believes that the U.S. Constitution does not provide the federal government

- Page 4 of Affidavit for Search Warrant No. 1127861 "

MAR/1 6/20 12/ FR I 09 : 18 AM

2ND DISTRICT C UT OR

F X No . B I 3'35 1182 A I]

P 025 .

the right to collect taxes. Wilson told me that Stewart has not paid his Federal or State taxes since 2005. Wilson remembers Stewart telling her that he used to be a security guard at the IRS and that if "they" ever forced him to pay taxes, he knew how to "get into" the IRS, and that once inside, he would "kill IRS employees". Wilson also told me that Stewart would often tell her that Timothy McVey was misunderstood and that he (McVey) did not mean to kill the children inside the Federal bUilding. Wilson stated that Stewart was consistently on his computer and that he would research anti-U.S. government websites. Wilson stated that Stewart did not have a home or cellular telephone, and that he would often communicate with friends via World of Warcraft on his computer. Wilson also told me that Stewart does not have a Facebook, or Myspace account. She did advise me that his last known email addressissupernaturalmyth@yahoo.com . During the execution of another search warrant for Stewart's residence, I recovered various computer generated documents related to antl-u.s. government websites, marijuana manufacturing methods and products, anti-police websites, Oklahoma City bombing related websites, and guns and ammunition websites. I also recovered a map of the 12th St IRS building, located in Ogden Utah. This map was highlighted with ingress and egress routes. I also recovered an instruction sheet for potassium chloride (compound used in making explosives).

During the collection of evidence while executing the aforementioned search warrant, explosive materials and what appeared to be the makings of a bomb were observed by your affiant in a linen closet. These items were later collected, and detonated by bomb squad personnel. Related to that incident, investigators discovered that Stewart had ordered the bomb making material via the internet. I observed the black PC (no name brand) computer tower on a table top, located in the Northern bedroom of Stewart's residence. I recovered that computer and booked into OPD evidence.

2. Your affiant believes that the evidence likely to be obtained from this computer is relevant to an ongoing criminal investigation being conducted by Ogden Police Department, in connection with possible violations of Utah Criminal Code Aggravated Murder, 76-5-206 (b). 3. Based upon your affiant's knowledge, training and experience, your affiant knows that searching and seizing information from computers often requires to seize most or all electronic storage devices (along with related peripherals) to be

Page 5 of Affidavit for Search Warrant No. 1127861 -

MAR/16/2012/FRI 09: 18 AM

2ND DISTRICT COURT

FAX No. 8I] 1 395 1182

p, 026

searched later by a qualified computer expert in a laboratory or other controlled environment. This is true because of the following:

a. The volume of evidence. Computer storage devices (like hard disks, diskettes, tapes, laser disks) can store the equivalent of millions of information. Additionally, a suspect may try to conceal criminal evidence; he or she might store it in random order with deceptive file names. This may require searching authorities to examine all the stored data to determine which particular files are evidence or instrumentalities of crime. This sorting process can take weeks or months, depending on the volume of data stored, and it would be impractical and invasive to attempt this kind of data search on-site.

b. Technical Requirements. Searching computer systems for criminal evidence is a highly technical process reqUiring expert skill and a properly controlled environment. The vast array of computer hardware and software available requires even computer experts to specialize in some systems and applications, so it is difficult to know before a search which expert is qualified to analyze the system and its data. In any event, however, data search protocols are exacting scientific procedures designed to protect the integrity of the evidence and to recover even "hidden," erased, compressed, password-protected, or encrypted files. Because computer evidence is vulnerable to inadvertent or intentional modification or destruction (both from external sources or from destructive code imbedded in the system as a "booby trap"), a controlled environment may be necessary to complete an accurate analysis. Further, such searches often require the seizure of most or all of a computer system's inpuUoutput peripheral devices, related software, documentation, and data security devices (including passwords) so that a qualified computer expert can accurately retrieve the system's data in a laboratory or other controlled environment. In light of these concerns, your affiant hereby requests the Court's permission to seize the computer hardware (and associated peripherals) that are believed to contain some or all of the evidence described in the warrant, and to conduct an off-site search of the hardware for the evidence described, if, upon arriving at the scene, the agents executing the search conclude that it would be impractical to search the computer hardware on-site for this evidence. This affidavit has been reviewed by Dee Smith of the Weber County Office, and it has been approved for presentation to the court. WHEREFORE, your affiant prays that a Search Warrant be issued for the seizure of said items in the daytime.
I declare under criminal penalty of the State of Utah that the foregoing is true and correct.

- Page 6 of Affidavit for Search Warrant No. 1127861 -

MAR/16/2012/ FR I 09 : 18 AM

2ND DI STRI CT COUT R

FAX No . 801 39 5 1182

P. 027

Executed on: 9th day of February, 2012 by lsi BRIAN K EYNON

- Page 7 of Affidavit for Search Warrant No. 1127861 -

MAR/16/2012/ FRI 0'3; 18 AM

2ND DISTRI CT C U T OR

..., L ...

p n'')R

RETURN TO SEARCH WARRANT

NO. 1127861 The personal property listed below or set out on the inventory attached hereto was taken from the person of Matthew David Stewart, by virtue of a search warrant dated the 9th day of February, 2012, and issued by Magistrate NOEL S HYDE of the SECOND DISTRICT COURT - OGDEN DEPARTMENT: Black custom PC compter tower belonging to Matthew Stewart. Transported computer to RCFL (#12070-1), Salt Lake City. Forensic audit pending . I, Detective BRIAN K EYNON of Ogden, by whom this warrant was executed, do swear that the above listed or below attached inventory contains a true and detailed account of all the property taken by me under the warrant, on the 13th day of February, 2012. All of the property taken by virtue of said warrant will be retained in my custody subject to the order of this court or of any other court in which the offense in respect to which the property, or things taken, is triable.

I declare under criminal penalty of the State of Utah that the foregoing is true and correct.
Executed on : 14th day of February. 2012 by /s/ BRIAN K EYNON

- Page 1 of Return of Service for Search Warrant No. 1127861 -