Access Denied: The FBI's Battle to Unlock the San Bernardino iPhone

III. Seizure and examination of Subject Device

5. The SUBJECT DEVICE was seized pursuant to the search warrant in Case No. ED 15-0451M, issued by the Honorable David T. Bristow, United States Magistrate Judge, on December 3, 2015. The SUBJECT DEVICE was found inside of the SUBJECT VEHICLE identified in the warrant. The underlying search warrant is attached hereto as Exhibit 1 and incorporated by reference.

6. I know based on my participation in this investigation and conversations with other involved agents and San Bernardino County Information Technology personnel, that the search warrant arose out of an investigation into the December 2, 2015 shooting death of 14 people, and the shooting and injuring of 22 others, at the Inland Regional Center ("IRC") in San Bernardino, California, and the participation by Syed Rizwan Farook ("Farook") and his wife Tafsheen Malik ("Malik") in that crime. Subsequent to the search warrant at issue, the FBI has obtained numerous warrants to search the digital devices and online accounts of Farook and Malik. Through those searches the FBI has discovered, for example, that on December 2, 2015, at approximately 11:14 a.m., a post on a Facebook page associated with Malik stated, "We pledge allegiance to Khalifa bu bkr al bhaghdadi al quraishi," referring to Abu Bakr Al Baghdadi, the leader of Islamic State of Iraq and the Levant ("ISIL"), also referred to as the Islamic State ("IS"), or the Islamic State of Iraq and al-sham ("ISIS"), or Daesh. ISIL, formerly known as Al- Qa'ida in Iraq ("AQI"), has been designated a foreign terrorist organization by the United States Department of State and has been so designated since December 2004. Farook and Malik died later that same day in a shoot-out with law enforcement.

7. The SUBJECT DEVICE is owned by Farook's employer at the San Bernardino County Department of Public Health ("SBCDPH"), and was assigned to, and used by, Farook as part of his employment. While the SBCDPH does not have access to the passcode to the phone, it has given its consent to the search of it and to Apple's assistance with that search.

8. The SUBJECT DEVICE is "locked" or secured with a numeric passcode. I have been very involved in the attempts to gain access to the locked phone and comply with the search warrant. With the consent of the SBCDPH, I and other agents have been able to obtain several icloud backups for the SUBJECT DEVICE, and I am aware that a warrant was executed to obtain from Apple all saved icloud data associated with the SUBJECT DEVICE. I know from speaking with other FBI agents that evidence in the iCloud account indicates that Farook was in communication with victims who were later killed during the shootings perpetrated by Farook on December 2, 2015. In addition, toll records show that Farook communicated with Malik using the SUBJECT DEVICE between July and November 2015, but this information is not found in the backup iCloud data. Importantly, the most recent backup is dated October 19, 2015, which indicates to me that Farook may have disabled the automatic iCloud backup feature associated with the SUBJECT DEVICE. I believe this because I have been told by SBCDPH that it was turned on when it was given to him, and the backups prior to October 19, 2015 were with almost weekly regularity. I further believe that there may be relevant, critical communications and data on the SUBJECT DEVICE around the time of the shooting which has thus far not been accessed, may reside solely on the SUBJECT DEVICE, and cannot be accessed by any other means known to either the government or Apple. In addition, I have personally examined two other mobile devices belonging to Farook that were physically destroyed and discarded in a dumpster behind the Farook residence.

9. I have explored other means of obtaining this information with employees of Apple and with technical experts at the FBI, and we have been unable to identify any other methods feasible for gaining access to the currently inaccessible data stored within the SUBJECT DEVICE.