Professional Documents
Culture Documents
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that there is now concealed on the following person or property
located in the Western District of Arkansas (identify the person or describe property to
be searched and give its location): See "Attachment A"
This court has authority to issue this warrant under 18 U.S.C. §§ 2703(c)(1 )(A) and 2711
(3)(A) and Federal Rule of Criminal Procedure 41
The person or property to be searched, described above, is believed to conceal (identify the person or describe the
property to be seized): See "Attachment B"
The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
rif property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Applicant's signature
Date:
Judge's signature
ATTACHMENT A
PROPERTY TO BE SEARCHED
This search warrant applies to all content and information contained in Apple email account:
controlled by Apple, Inc., a company that accepts service of legal process at located at 1 Infinite
Loop, MIS 36-SU, Cupertino, CA 95104 from June of 2017 until present.
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 3 of 16 PageID #: 3
ATTACHMENT B
Any e-mails, records, files, logs, or information that is active or has been deleted from
Provider account jonathan.wieneke@me.com but is still available to the Provider; or that has
been preserved in that Provider account pursuant to a request made under 18 U.S.C. §2703(f).
The Provider must disclose to the government the following content or information:
a. All e-mails, including stored or preserved copies of e-mails sent to and from the
account, draft e-mails, the source and destination addresses associated with each
e-mail, the date and time at which each e-mail was sent or received, and the size
and length of each e-mail, any and all attachments, any and all emails that were
holder, to include full name, physical address, telephone numbers, and other
identifiers; reveals session times and duration; establishes the date on which the
account was created, and the IP address used to register the account; establishes
log-in IP addresses associated with session times and dates, account status,
log files, and means and source of payment (including any credit or bank account
number);
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 4 of 16 PageID #: 4
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken.
constitutes fruits, contraband, evidence and instrumentalities of violations of Title 18, United
States Code, Sections; 1832-Theft of Trade Secrets, including information pertaining to the
following matters:
Apple, Inc. shall disclose responsive data, if any, by sending to Homeland Security
Investigations, C/O: Special Agent Gerald Faulkner at 3419 North Plainview Avenue,
Fayetteville, Arkansas 72703 via U.S. Postal Service or another courier service
(gerald.f.faulkner@ice.dhs.gov).
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 5 of 16 PageID #: 5
ATTACHMENT C
STATE OF ARKANSAS
ss. A F F I D A V I T
COUNTY OF WASHINGTON
Security Investigations (HSI), currently assigned to the Assistant Special Agent in Charge Office
in Fayetteville, Arkansas. I have been so employed with HSI since April 2009. As part of my
daily duties as an HSI agent, I investigate criminal violations relating to theft of trade secreted
information and economic espionage. I have received training in the area of protection of trade
secrets, and have had the opportunity to observe and review numerous examples of venues
individuals utilize in attempts to defraud or financially gain from converting proprietary data into
personal advantages. I have also reviewed numerous search warrants and arrest warrants, a
number of which involved theft of trade secrets investigations. This affidavit is being submitted
based on information from my own investigative efforts as well as information obtained from
others who have investigated this matter and/or have personal knowledge of the facts herein.
information associated with a certain account that is stored at a premise owned, maintained,
at One Apple Park Way in Cupertino, California 95014. This affidavit is made in support of an
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 6 of 16 PageID #: 6
application for a search warrant under Title 18, United States Code (U.S.C.) §§ 1832, relating to
Theft of Trade Secrets; to require Apple, Inc. to disclose to the government records and other
information in its possession pertaining to the subscriber or customer associated with the
U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A) to require Apple, Inc. to disclose to the
government the requested records and other information in its possession. As such, your Affiant
is requesting authority to search the e-mail account where the items specified in Attachment A
may be found, and to seize all items listed in Attachment B as instrumentalities, fruits, and
evidence of crime.
4. Since this affidavit is being submitted for the limited purpose of securing a search
warrant, I have not included each and every fact known to me concerning this investigation. I
have set forth only the facts I believe necessary to establish probable cause to believe that
evidence, fruits, and instrumentalities of the violations of Title 18, U.S.C. §§ 1832, Theft of Trade
Secrets, are presently located within the e-mail account jonathan.wieneke@me.com. Where
statements of others are set forth in this Affidavit, they are set forth in substance and in part.
5. This investigation, described more fully below, has revealed that the individual
protected and trade secret information from his work email account to his personal email address
Arkansas and there is probable cause to believe there is evidence, fruits, and instrumentalities of
Statutory Authority
6. This investigation concerns alleged violation of Title 18, United States Code,
a. Under 18 U.S.C. Section 1832, it is a federal crime for whoever with intent to convert a
trade secret, that is related to or included in a product that is produced for or placed in interstate
or foreign commerce, to the economic benefit of anyone other than the owner thereof, and
intending or knowing that the offense will injure any owner of that trade secret knowingly
(a) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud,
uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates,
b. A trade secret means any and all forms and types of financial, business, economic
information, which the owner takes reasonable measures to keep such information a secret, and
the information devices independent economic value, actual or potential, from not being generally
known to others who can derive economic value from such. See 18 USC Section 1839(3).
8. Your Affiant has become familiar with the Internet, which is a global network of
computers and other electronic devices that communicate with each other using various means,
including standard telephone lines, high-speed telecommunications links (Me., copper and fiber
optic cable), and wireless transmissions including satellite. Due to the structure of the Internet,
connections between computers on the Internet routinely cross state and international borders,
even when the computers communicating with each other are in the same state.
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 8 of 16 PageID #: 8
9. Individuals and entities use the Internet to gam access to a wide variety of
information; to send information to, and receive information from, other individuals; to conduct
commercial transactions; and to communicate via electronic mail ("e-mail") or Instant Messaging
services (IM). An individual who wants to use the Internet must first obtain an account with a
computer or cellular telephone that is linked to the Internet - for example, through a commercial
service - which is called an "Internet Service Provider" or "ISP". Once the individual has
accessed the Internet, whether from a residence, a university, a place of business or via their
cellular service provider, that individual can use Internet services, including sending and
10. The Internet is a worldwide computer network that connects computers and
facilitates the communication and the transfer of data and information across state and
international boundaries. A user accesses the Internet from a computer network or Internet
Service Provider ("ISP") that connects to the Internet. The ISP assigns each user an Internet
Protocol ("IP") Address. Each IP address is unique. Every computer or device on the Internet is
referenced by a unique IP address the same way every telephone has a unique telephone number.
An IP address is a series of four numbers separated by a period, and each number is a whole
individual accesses the Internet, the computer from which that individual initiates access is
assigned an IP address. The ISP logs the date, time and duration of the Internet session for each
IP address and can identify the user of that IP address for such a session from these records,
11. Computers as well create a "Log File" that automatically records electronic events
that occur on the computer. Computer programs can record a wide range of events including
remote access, file transfers, long/logoff times, systems errors, Uniform Resource Locator
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 9 of 16 PageID #: 9
addresses (websites), unique searches performed on the Internet and various forms of electronic
communications.
12. Computer files or remnants of such files can be recovered months or even years
after they have been downloaded onto the hard drive, deleted, or viewed via the Internet.
Electronic files downloaded to a hard drive can be stored for years at little or no cost. Even when
such files have been deleted, they may be recoverable months or years later using readily-
available forensic tools. When a person "deletes" a file on a home computer, the data contained
in the file does not actually disappear; rather, that data remains on the hard drive until it is
overwritten by new data. Therefore, deleted files, or remnants of deleted files, may reside in free
space or slack space - that is, in space on the hard drive that is not allocated to an active file or
that is unused after a file has been allocated to a set block of storage space - for long periods of
13. Similarly, files that have been viewed via the Internet are automatically
downloaded into a temporary Internet directory or cache. The browser typically maintains a fixed
amount of hard drive space devoted to these files, and the files are only overwritten as they are
replaced with more recently viewed Internet pages. Thus, the ability to retrieve residue of an
electronic file from a hard drive depends less on when the file was downloaded or viewed than on
14. The use of the Internet and more specifically electronic communications via the
Internet provides individuals the ability to mask their true identities as well as their physical
locations. Additionally, the use of the Internet provides individuals and their associates the
ability to access social networking sites free of charge to further their criminal activity.
15. Based on my knowledge and experience and information obtained from other law
enforcement personnel with training and experience in this area, the following is known about
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 10 of 16 PageID #: 10
@me.com accounts:
services were being gradually transitioned and replaced by iCloud and the
service ceased as of June 30, 2012, with transfers to iCloud available until
b. iTools and .Mac were designed primarily to provide Internet services for
email address, showing the services tied to the Mac hardware. In 2008,
with the release of the iPhone 3G, the services were renamed MobileMe
and Apple began providing Internet services for OS X, iOS and Windows.
user created their iCloud account, their email address and aliases may end
information the company had obtained in relation to an ongoing federal Theft of Trade Secrets
additional "highly sensitive" data files having been illegally exfiltrated from their maintained and
secured computer systems and sent to a personal email address by a former employee just prior to
his resignation with WC. The WC maintained and secured computer system from which these
proprietary data files were taken contained, among other things, production and pricing
information of products offered for sale by WC and its subsidiaries. WC representatives believed
this employee had knowingly conducted the data exfiltration for financial gain or use for
17. Your Affiant received and reviewed documents from WC outlining the allegations
along with specific files exfiltrated by the former employee. Upon reviewing the documents,
your Affiant identified the individual responsible for extracting the files from WC as being
buyer through Sam's Club. In such capacity, WIENEKE was primarily tasked with being a
liaison of sorts between WC and a specific vendor, namely Outdoor Leisure Products (OLP). He
held such position until voluntarily leaving WC in October 2017. WIENEKE then accepted a
position with Masterbuilt Manufacturing, LLC, an approximate ten (10) year supplier to both WC
and Sam's Club. Per documents provided by WM, Masterbuilt merged/bought out, in part, OLP,
internal investigation into his access and utilization of their computer systems. The internal
review revealed on October 5, 2017, WIENEKE sent six (6) emails from
(SUBJECT EMAIL ACCOUNT). All of the emails had an attached Excel Spreadsheet
containing "highly sensitive" Sam's Club proprietary data. Three (3) of these particular emails
triggered an alert to WC Data Assurance & Cyber Intelligence monitoring teams because the
information within the spreadsheets contained financial, sales, and product information exclusive
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 12 of 16 PageID #: 12
to WC. WIENEKE was alerted the same day by WC representatives about the emails at which
supervisor and sought clarification about the six (6) emails with attachments sent to WIENEKE's
reviewing the exfiltrated data, WIENEKE's supervisor concluded all of the emails with
attachments were limited to WIENEKE's area of responsibility within the "Seasonal Department"
but he saw nothing in his calendar, in terms of upcoming projects, that would support
WIENEKE's need for the vast amount of data he exfiltrated, especially in October 2017 while he
was transitioning to a new employer. WIENEKE's supervisor further acknowledged the data
exfiltrated from WC was "highly sensitive" and believed WIENEKE's actions suggested he
intended to use the information for his own advantage after leaving Sam's Club or WC. It was
also explained the data WIENEKE sent to his personal email account contained information that
would be helpful to him in his new employment at Masterbuilt, such as estimated volume by
stock keeping unit (SKU) and club sales by week. It was explained by WIENEKE's supervisor
this information could also be used by a competitor or supplier to review WC sales data and
described possession of these files as, "like an open book test with all the answers." WIENEKE's
exfiltrated emails allotted him the opportunity to retain WC data on costs, volume, other
suppliers, and factories giving him a blueprint for items to use and find factories to source similar
19. The documents provided by WC included charts of the specific dates, times and
data exfiltrated by WIENEKE to his personal email address which your Affiant reviewed and
describes as follows:
Exfiltration Number 1
Exfiltration Number 2
Exfiltration Number 3
Exfiltration Number 4
File Description: The first line of the spreadsheet notates boldly within an oversize red colored
cell "Sam's Club Internal Import Quote Sheet-DO NOT SHARE." The page included a photo
of a grill and included general information, product highlights, a container loading section, a
costing section, and a final costing section. Near the bottom of the spreadsheet, another row
warned "ALL INFORMATION BELOW THIS LINE IS STRICTLY FOR THE USE OF
WALMART/SAM'S CLUB/DSG. DO NOT SHARE!!!"
Exfiltration Number 5
Exfiltration Number 6
20. While investigating a similar case involving Theft of Trade Secrets by a former
WC employee, your Affiant learned upon initial employment with the company, all WC
employees must complete training on the proper procedures and regulations for safeguarding WC
proprietary data and information. Your Affiant had previously received and reviewed a document
employees are provided upon their hiring. A review of this document revealed the Statement of
Ethics applies to all associates at all levels of the organization worldwide and all members of the
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 15 of 16 PageID #: 15
board of directors of Wal-Mart, Inc. It also applies to all associates and directors of Walmart
controlled subsidiaries. The section further went on to state Walmart expects all suppliers,
consultants, law firms, public relations firms, contractors and other service providers to act
ethically and in a manner consistent with the Statement of Ethics. The document had a section
entitled "Walmart Assets" that explained there is a responsibility to use Walmart property and
assets for Walmart business and not allow them to be used for any type of personal gain. The
employee is responsible for maintaining Walmart property under their control and should take
reasonable steps to protect it from theft, misuse, loss, damage or sabotage. A further review of
the document showed a question and answer section with a particular question relating to the
ongoing investigation. The question was phrased, "A co-worker of mine has recently given her
resignation. Since then, she's been emailing supplier contact information to her home computer
so she can start her own business. Is this a violation?" The corresponding answer was "Yes. The
supplier information she obtained through her position at Walmart is considered confidential
company information. She should not be using it for her personal business. You should report
this to Global Ethics." According to WC representatives, WIENEKE would have also been made
to complete training and agree to the terms and conditions outlined in the WC Global Statement
Conclusion
55. Based on the foregoing information, probable cause exists to believe there is
located on the computer servers of Apple, Inc., One Apple Park Way in Cupertino, California
95014 evidence of violations of Title 18, United States Code, Section 1832 - Theft of Trade
Secrets. Your affiant prays upon his honorable court to issue a search warrant to Apple, Inc., for
the items set forth in attachment "B" (which is attached hereto and incorporated herein by
Case 5:18-cm-00032-ELW Document 1 Filed 03/28/18 Page 16 of 16 PageID #: 16
reference), that constitute evidence, fruits, and instrumentalities of violation of Title 18, United
Erin L. Weide,riiann
United States Magistrate Judge