4 Univ of Idaho Students Murdered, Bryan Kohberger Arrested, Moscow, Nov 2022 #82

[TL4S]

It's possible! But another answer might be simpler at least in respect of T-Mobile...

I agree that the T-mobile numbers warrant likely originated from the t-mobile geofence warrant (from memory both those warrants were very early days, around 17th November). But, IMO, the T- mobile nos aren't connected to BK, but were other numbers that came up after geo-fence. I assume that after the warrants, LE eliminated the subscribers. If they had traced back to BK on 17th November I guess we would have seen a much earlier arrest. Or is the point that burner phones cannot be traced back? So LE met with a dead end on return of warrants? Honestly can't recall but there was some kind of return I think. There were similar numbers in a warrant for another provider- Verizon wireless-that appear to be linked to the geo fence warrant for Verizon - also mid November from memory. MOO

RE this latest AT&T warrant, I think it's different though.
Scope begins 23rd June which is date BK opened his AT&T account. My reasoning is that investigators had the return on the forensic analysis of BK's phone (unlike the Nov 2022 warrants) and that maybe they recovered deleted call logs from his phone. If this was the case then those two unknown numbers for which infois sought might have been in a deleted call log. That would make sense of the scope beginning June 23rd. MOO

Good thoughts! I'm overworked and also not tech savvy, so it's all over my head, I think. One thing I know is I can look up an unfamiliar number and often Google pulls up a name. I suppose LE needs to get that info through the right procedures, though.

 

[TL4S]

@TL4S

I laughed at the need to stop for the night, not at the idea of multiple devices by someone(s?).

I knew (hoped) that. I'm tired and delirious tonight, so it's probably not the best time for me to try to interpret all these documents, which I can barely interpret on a good day! One last note, though...BK did ask if anyone else had been arrested. I don't personally think anyone else was involved, but multiple numbers is interesting.

 

[jepop]

I compared the first google warrant to this latest one and the wording is different. This is new:

I think it is what @schooling described


View attachment 426014
edit: both warrants list the same time period. I think this one is asking for different information. MOO

I think it is asking for much more than previous one and the reference to recovery email suggests maybe is asking for info deleted by the user but still on google servers. I really think that this warrant may be a follow up after whatever digital evidence has been found on BK's phone laptop/other devices. No time to compare in detail but yes it reads differently to me aswell. Moo

ETA: old email accounts - linking back to purchases by defendant? Kbar? MOO

 

[Sister Golden Hair]

BK did ask if anyone else had been arrested. I don't personally think anyone else was involved, but multiple numbers is interesting.

I don't think it was a random question.

 

[Sister Golden Hair]

Good thoughts! I'm overworked and also not tech savvy, so it's all over my head, I think. One thing I know is I can look up an unfamiliar number and often Google pulls up a name. I suppose LE needs to get that info through the right procedures, though.

It does make sense. But it's also an assumption and quite coincidental that of all the geofence data, LE only had two numbers. Could be anything, but I won't assume at all, esp given the scope of many of the other warrants.

IMO this doesn't fit into a simple box. LE didn't just get those Tinder and DD warrants for nothing. They got them for something and they had to have PC to do it. And curiosity is not PC. There are also three warrants and affidavits out there totally sealed - we don't even know who was served. And there other trails LE was following, too. Those things can't just be disregarded as unimportant when they don't fit, and that commonly happens -- facts are made to fit the theory, and that means missing some things.

Also, re the geofence warrant and the recent AT&T-- a burner phone won't show a name if you google it... and my guess would be that LE ruled out every phone number they could ID and they were left with what they couldn't ID. Just sayin', something to consider
IMO

 

[jepop]

And then there's Strava. This is a twist.

Strava dated 2.26.23
For the period June 27, 2022 to December 30, 2022

Huh. Odd.

And no names. But the area redacted looks like a lllllloooooonnnnnnggggg list of identifiers. Reminds me of the Tinder warrant and all those many blanks. I wonder? Sure looks like more than one person potentially, and it sure isn't a known BK because they wouldn't redact anything specific to him, so gotta wonder. IMO

https://coi.isc.idaho.gov/docs/case/CR29-22-2805/053123%20Order%20to%20Seal%20%20Redact%20-%20Strava%20Inc.pdf

RBBM: Regarding the Strava warrant you write

"...and it sure isn't a known BK because they wouldn't redact anything specific to him, so gotta wonder. IMO"

BK's name remains redacted from the AT&T warrant dated 23 Dec 2022 for historical data from his account for the 24 hours surrounding the time of the murders. CSLI data etc. The warrant has to be the one mentioned in the PCA. The description and date are identicle to those given in the PCA (P16). MOO but very probably fact.

https://coi.isc.idaho.gov/docs/case/CR29-22-2805/022823%20Order%20to%20Seal%20and%20Redact%20-%20ATT%201.pdf

Although BK's name is mentioned in some warrants such as Tinder, Reddit and Google, IMO it can't be assumed that his name will always be listed in warrants that relate to him. MOO

 

[jepop]

Good thoughts! I'm overworked and also not tech savvy, so it's all over my head, I think. One thing I know is I can look up an unfamiliar number and often Google pulls up a name. I suppose LE needs to get that info through the right procedures, though.

IDK, strikes me that it would be correct procedure to go the way of warrant for numbers which can't be matched to a name. Moo

 

[Sister Golden Hair]

RBBM: Regarding the Strava warrant you write

"...and it sure isn't a known BK because they wouldn't redact anything specific to him, so gotta wonder. IMO"

BK's name remains redacted from the AT&T warrant dated 23 Dec 2022 for historical data from his account for the 24 hours surrounding the time of the murders. CSLI data etc. The warrant has to be the one mentioned in the PCA. The description and date are identicle to those given in the PCA (P16). MOO but very probably fact.

https://coi.isc.idaho.gov/docs/case/CR29-22-2805/022823%20Order%20to%20Seal%20and%20Redact%20-%20ATT%201.pdf

Although BK's name is mentioned in some warrants such as Tinder, Reddit and Google, IMO it can't be assumed that his name will always be listed in warrants that relate to him. MOO

You may be right, but I'm not going to assume re AT&T, and in all the others, he appears to be listed. IMO. There would be no reason to redact his name, just like the victims' names aren't redacted. There are intentional redactions, so I'm assuming intentional, not accidental. And also on the Strava warrant, that's a lot of blank space for just one person IMO again. But who knows? You may be right. I just don't agree, and for equally valid reasons IMO.

 

[schooling]

Google Warrant
I remain steadfast in my belief that it's the cloud that will ultimately be BKs downfall.

Google is probably tracking your location, even if you turn it off, says report

While your location history is paused, some services still store your location data.

www.cnet.com

and

Google's My Activity reveals just how much it knows about you

Search company launches new opt-in ad service for non-Google sites and tools that show how it tracks your internet activity

www.theguardian.com

These are two features that the majority of Android users do not know are turned on by default. It's often pretty shocking for people who go into either for the first time.

Do Me A Favor and Go into Google and Search for "My Activity History". It should be the first link.

 

[Nila Aella]

I think it is asking for much more than previous one and the reference to recovery email suggests maybe is asking for info deleted by the user but still on google servers. I really think that this warrant may be a follow up after whatever digital evidence has been found on BK's phone laptop/other devices. No time to compare in detail but yes it reads differently to me aswell. Moo

ETA: old email accounts - linking back to purchases by defendant? Kbar? MOO

Another possibility is that LE did not find any digital evidence on the original google warrant and they now have to dig deeper? The time period is the same as before Jan 1 2021- Dec 30 2022 (not focusing on something found). There are three sealed google warrants in between these two for BK though (we do not know who those are for but BK is listed in these two, why not listed in the sealed 3?). MOO

 

[Sister Golden Hair]

we do not know who those are for but BK is listed in these two, why not listed in the sealed 3?

That's a really good question. It's either a mistake or it's not BK. I lean towards the latter.

ETA: I think it's an assumption to just plop BK's name into a blank space and assume that's the answer when it hasn't been done that way previously.

I think that because BK's name hasn't been redacted in the other warrants subsequent to his arrest, it probably isn't being redacted here, and that's not an assumption, that's observing a pattern and giving LE/Prosecution the benefit of the doubt that they're getting it right. Now maybe they didn't get it right, but I'm not going to assume that just so I can assume BK's the missing name.

 

[schooling]

I think @schooling is saying that only your cellular phone provider and the customer have IMEI numbers. So strava, reddit, social media companies etc don't have it. So couldn't search records via IMEI? I guess if Apple is your cellular provider they would have it? I'm out of my depth and may have misinterpreted though, so waiting to hear what the OP thinks!

Apple stays out of the stolen phone/device arena largely because they do not want to get into the storing of IMEI business. IMEI's are like your phones social security number. If someone has it they can clone your phones identity.

The displaying of any IMEI on a Apple purchase is likely a local call...meaning that data is pulled from the device explicitly for the receipt and not stored by Apple in any meaningful way other than to display it. This might be a thing when you purchase an iPhone with service tied to it...but Apple tries to use a devices Serial Number anytime that they can.

In Android there is an explicit permission to give apps access to IMEI (on an iPhone I don't even think there's a API to ask). I can't think of a legitimate reason for them to request it...so I'd be highly suspect of any app that does that. I'll do some research on permissions the apps in the warrant request...I would be surprised if IMEI was one of them.

 

[jjleroche]

I'd have to do a doc compare, but that's entirely possible. Same time, but different warrant dates, too.

ETA: i really have to start a Go-Fund-Me because I cannot possibly do my day job and all this, so clearly lol...

I think it's very generous of you to provide your expertise to us all. It certainly makes it infinitely easier for us W/Ss (certainly for me anyway!) to make some sense of the complexity of the warrant matters. Just a casual glance at some of the warrants causes me to feel the need for a nap!

 

[Sister Golden Hair]

I think it's very generous of you to provide your expertise to us all. It certainly makes it infinitely easier for us W/Ss (certainly for me anyway!) to make some sense of the complexity of the warrant matters. Just a casual glance at some of the warrants causes me to feel the need for a nap!

Oh, thank you, but I'm not an expert. I think even most experts aren't experts because really, can you ever know everything about anything? But anyway, that's just me. I just need to make sense of this mess for myself, so I share. There are so many incongruencies, and I wish I were the person who could look at the oddities and think, "Oh, that's definitely this!", but I'm not, and there are a number of ways to fit these pieces together IMO, ways that make sense of lots of the pieces, not the select few.

 

[schooling]

Snapchat

It''s interesting that LE has narrowed their focus to the time where BK got into town and that they are using Snapchat to source for any possible unknown BK accounts. Seems like they suspect some throwaway account that they haven't found yet.

Regarding the location of posts requests. A lot of focus has been on YikYak but Snapchat is a much easier to use stalker tool. The Snap Map allows people to see your posting location in real time. And not only that...but if your posts are set to public someone can just click on areas around the Snap Map and see posts from random users and where they are at that moment.

These are some of the featured Snap 3rd party integrations referenced in the warrant...

https://help.snapchat.com/hc/en-us/articles/7012332511252-What-are-Integrated-Features-on-Snapchat-

But I believe Snap's pretty liberal with their API so that list is not exhaustive.

What sticks out to me though is...

All records pertaining to communications between Snapchat and any person regarding the user or the user’s Snapchat accounts, including contacts with support services, and all records of actions taken, including suspensions of the accounts;

This one is really odd! Are they trying to find out if one of the accounts reported another account for unwanted harassment? Did someone reach out to support and attempt to get more info on a user they came across? This one is probably the most interesting to me. ESPECIALLY when you consider how invasive (even though the user likely doesn't realize it) the Snap Map could be.

 

[jepop]

You may be right, but I'm not going to assume re AT&T, and in all the others, he appears to be listed. IMO. And also on the Strava warrant, that's a lot of blank space for just one person IMO again. But who knows?

RE AT&T 12/23: I'll only note that the assumption I'm making seems rational to me. The warrant could either be the one mentioned in PCA with which it directly matches, or it could be for someone else completely and the match could be coincidental. If the latter is true then for some reason the 23 rd December BK warrant for AT&T has not been released at all or not yet released. I think the first option is the most logical assumption. Moo

Re: Strava: It's not clear to me that there is space there. I think it could be where the page ends and the next begins, Imo. Other warrants have used dots and blanks with inter-joining words. I think the warrant is seeking data on a strava account using an IMEI (device number)- as an identifier. If there are other identifiers redacted in the space then I think they would be a phone number or email address, not names. MOO

My speculation at the moment is that this warrant possibly relates to what has been extracted from the defendant's devices (laptop/phone). If a remnant of a deleted strava account was recovered but not a name that the defendant used for the account, then LE would be seeking that info via warrant to the company, using device IMEI as a lead in. That's speculation and MOO but it's one idea that makes sense to me, given that forensic analysis of BK's devices is likely to have been undertaken or at least in progress. To my mind, that is one contextual difference between earlier Jan/Feb warrants and others that have gone out in March and APril. MOO

I understand there will be differences of opinion re filling in some of blanks left by the redacted warrants and I respect that.
MOO

 

[jepop]

Another possibility is that LE did not find any digital evidence on the original google warrant and they now have to dig deeper? The time period is the same as before Jan 1 2021- Dec 30 2022 (not focusing on something found). There are three sealed google warrants in between these two for BK though (we do not know who those are for but BK is listed in these two, why not listed in the sealed 3?). MOO

IDK re sealed google warrants.I suppose there might be some clues in the wording for sealing. My guess would be likely BK's if after arrest. I can't remember the inital dates for sealing. If served before BK arrest late Nov to early Dec -hard to guess IMO. Possible alternate POI now eliminated which would also justify a reason for the continued sealing. I do have a premise that LE were not soley focused on BK after Nov 29, and would have continued following feasible leads including getting PC for those leads where deemed necessary via detective informed affidavits. MOO. Do you have any thoughts on reasons for sealing?

RE latest Google warrant; might well be related to what wasn't found in previous ones. The scope is the same as you say. And yes what is being sought seems much wider and deeper. I'm just aware that forensic analysis of BK devices would have potentially been a massive job and that there might be follow up on that at some point, especially if defendant was in the habit of deleting what he might consider incriminating. That would demand a deep dig into Google servers to see if anything has been stored there even after user deletion MOO.

 

[Nila Aella]

Snapchat

It''s interesting that LE has narrowed their focus to the time where BK got into town and that they are using Snapchat to source for any possible unknown BK accounts. Seems like they suspect some throwaway account that they haven't found yet.

Regarding the location of posts requests. A lot of focus has been on YikYak but Snapchat is a much easier to use stalker tool. The Snap Map allows people to see your posting location in real time. And not only that...but if your posts are set to public someone can just click on areas around the Snap Map and see posts from random users and where they are at that moment.

These are some of the featured Snap 3rd party integrations referenced in the warrant...

https://help.snapchat.com/hc/en-us/articles/7012332511252-What-are-Integrated-Features-on-Snapchat-

But I believe Snap's pretty liberal with their API so that list is not exhaustive.

What sticks out to me though is...

All records pertaining to communications between Snapchat and any person regarding the user or the user’s Snapchat accounts, including contacts with support services, and all records of actions taken, including suspensions of the accounts;

This one is really odd! Are they trying to find out if one of the accounts reported another account for unwanted harassment? Did someone reach out to support and attempt to get more info on a user they came across? This one is probably the most interesting to me. ESPECIALLY when you consider how invasive (even though the user likely doesn't realize it) the Snap Map could be.

Wow! I see grubhub, strava, and door dash on that list third party list.

This latest snap warrant is for all victims plus survivors June 23- August 1.
Previous snap warrants for these same individuals also had the same wording you mentioned about support services but were dated Aug 1 - Nov 19.

Idaho Judicial Cases of Interest

MOO

 

[katydid23]

First few hot take thoughts on the warrants:

In General

• Does anyone if it's standard practice to list IMEI number on these things? NO ONE but your cellular provider and you get your IMEI number. It's not reported out via HTTP headers nor is it included in the data that Google or Apple pass to App Creators.

Strava

• I remember buzz about a BK account being up on Strava for weeks following the murder, inactive of course.
• It looks like LE is looking for any and all accounts associated with BK using email, Android ID (app store) and the IP that the account was created from
• I posted awhile back about the use of cookies and IP addresses to link people who have multiple accounts somewhere. Strava likely uses techniques that are even more advanced (hardware fingerprinting) but I don't see anything listed.
• Again, the IMEI thing is extremely confusing as Strava would not have this information and just because they have LE involved...it's not like they can go back and get data that they never stored(this will be the last time I point this out because LE does it repeatedly).

Reddit

• Looks like BK had 3 specific email addresses that they know about and one phone number
• Reddit at one point allowed registration and password recovery by phone number. They no longer allow recovery (2 factor auth only) and now phone number registration is limited to certain regions. Anyway...
• Reddit's LE rules are written to limit scope and put the onus on LE to ask for specific things. Even though LE did a good job and seemed to be very thorough and explicit....
• I think what they didn't request presents a few problems. Reddit used to allow people to signup with no email address at all. Just a username. So if LE doesn't explicitly ask Reddit to use their super secret hardware fingerprinting to give them all of BKs accounts I'm not sure they will volunteer it if they follow this warrant down to the letter.
• Again,the IMEI..ugh. Anyway...really the last time I'll mention it. Wish they had asked for something like the desktop GPU (see above 'super secret') or whatever black magic sorcery Reddit uses to identify alias accounts.

To Be Continued.....Top Chef is on.

Edit: I couldn't help but to quickly peek into the Google warrant. And it looks like the two things I cited long ago as BKs biggest worries are listed there. BRB!

I am curious about Strava, but from what I understand, he couldn't have been using the app during the night in question because his phone was off or in airplane mode. But could he have been using it to follow one of the girls while they worked out or ran?

P.S. -Good Top Chef tonight. I am rooting for Buddha but I like all of the remaining 4. Sad to see Ali leave though. He is great and a very nice man.

 

[Sister Golden Hair]

And it's time to ask the question again:

From today's additions
AT&T & Snapchat -
The documents or materials contain facts or statements that might threaten or endanger the life of safety of individuals

Whose life? BK is in jail, the four are dead, everyone knows the names of DM and BF, so whose life is in danger if an affidavit of PC for AT&T and Snapchat isn't sealed?