IN THE UNITED STATES DISTRICT COURT FOR THE

DISTRICT OF COLUMBIA

IN THE MATTER OF THE SEARCH OF )

A HP PAVILION ENTERTAINMENT )

PERSONAL COMPUTER MODEL ) Magistrate Number:

NUMBER DV 2500 )

SERIAL NUMBER 2CE80929M3 )

LOCATED IN THE )

DISTRICT OF COLUMBIA )

Affidavit in Support of a Search Warrant

I, Scott Banker, being duly sworn state as follows:

Introduction

1. I am employed as a Special Agent with the United States Department of State, Diplomatic Security Service (“DSS”), and am assigned to the Office of Professional Responsibility in Arlington, Virginia. I have been employed as a Special Agent for five years. My duties include conducting criminal investigations into violent crimes and sexual assaults involving United States government personnel stationed at diplomatic and consular missions abroad. I have received training in conducting criminal investigations from the Federal Law Enforcement Training Center and specialized training regarding sexual assault investigations from the Navy Criminal Investigative Service. My educational experience includes a Bachelors of Science degree from Baker University, a Juris Doctorate degree from the University of Kansas, and a Masters of Science degree in Defense and Strategic Studies from Missouri State University. Prior to joining the Diplomatic Security Service, I was a criminal prosecutor for four years.

2. I present this affidavit in support of a search warrant for (hotel room), as more fully described in Attachment A, to search for and seize items, as more fully described in

attachment B. Pursuant to the authorities of this Court and Rule 41 of the Federal Rules of Criminal Procedure, I seek authority to search this property for evidence and instrumentalities related to the allegations against Andrew Warren for committing aggravated sexual abuse and sexual abuse, in violation of 18 U.S.C. §§ 2241(b)(2) and 2242.

3. I have not included every fact I know about Andrew Warren and his illegal activities in this affidavit; rather, I have included those facts I believe are needed to demonstrate probable cause for the warrant I seek. The information in this affidavit is based on my personal knowledge and observations, on information conveyed to me by other law enforcement officials, and on my review of records, documents and other physical evidence relevant to Andrew Warren’s activities.

Andrew Warren

4. Andrew Warren (“Warren”) is a United States citizen. Since September 2007, Warren has been employed by the United States Government and assigned to the United States Embassy in Algiers, Algeria. While assigned in Algeria, Warren has resided in a house located at #5 Chemin D’Hydra, Poirsson, El Biar, Algiers, Algeria. Since June 2005, #5 Chemin D’Hydra, Poirsson, El Biar, has been leased by the United States Government for use by embassy employees for their residential use while assigned in Algiers, Algeria, and Warren has used #5 Chemin D’Hydra, Poirsson, El Biar, as his residence since September 2007. Because the residence is used by United States personnel assigned to the mission in Algeria, it falls within the special maritime and territorial jurisdiction of the United States.

The Relevant Criminal Law

5. I am advised that 18 U.S.C. ' 2241(b)(2) makes it a crime to administer to another person by force or threat, or without the knowledge or permission of that other person, a drug intoxicant, or other similar substance and thereby substantially impair the ability of that other person to appraise or control conduct and then to engage in a sexual act with that other person, if the conduct occurred in the special maritime and territorial jurisdiction of the United States. I am further advised that 18 U.S.C. ' 2242 makes it a crime to engage within the special maritime and territorial jurisdiction of the United States in a sexual act with another person if that other person is incapable of appraising the nature of the conduct or is physically incapable of declining participation in, or communicating unwillingness to engage in, that sexual act.

6. I am also advised that with respect to offenses committed by a United States citizen, 18 U.S.C. ' 7(9) defines the term “special maritime and territorial jurisdiction of the United States” to include residences in foreign States and the land appurtenant or ancillary thereto, irrespective of ownership, used for purposes of United States Government missions or entities or used by United States personnel assigned to those missions or entities.

7. I am also advised that Federal Rule of Criminal Procedure 41 permits a United States Magistrate Judge to issue a warrant authorizing a federal law enforcement officer to search for and seize evidence, fruits, and instruments of a particular crime. Such a warrant is generally issued upon the written application and affidavit of a federal law enforcement officer.

8. I am also advised that, pursuant to 22 U.S.C. ' 2709, DSS agents have general arrest and search authority in addition to primary investigative jurisdiction over passport and visa fraud offenses. I am further advised that under ' 2709 DSS agents also have the duty to “protect and perform protective functions directly related to maintaining the security and safety of … official representatives of the United States Government abroad.” I am further advised that 22 USC § 4802 grants the Secretary of State certain security responsibilities, which have been delegated to DSS for implementation and enforcement. Specifically, 22 USC § 4802 states that the Secretary of State “shall develop and implement . . . policies and programs . . . to provide for the security of United States Government operations of a diplomatic nature and foreign government operations of a diplomatic nature in the United States.” Among the Secretary’s specific security responsibilities in this regard is the “conduct of investigations relating to protection of foreign officials and diplomatic personnel and foreign missions in the United States, suitability for employment, employee security, illegal passport and visa issuance or use, and other investigations, as authorized by law” and “performance of other security, investigative, and protective matters as authorized by law.”

Victim #1 and Victim #2

9. Victim #1 (“V1”) is an Algerian national who also holds German citizenship. She presently resides in Germany, but has family in Algiers whom she visits periodically.

10. Victim #2 (“V2”) is an Algerian national living in Spain. She too has family and friends in Algiers whom she visits periodically.

11. V1 and V2 reported the allegations outlined in this affidavit independently of each other. Furthermore, my investigation of this matter has not uncovered any evidence that these women knew (or indeed know) of the other’s allegations.

Summary of the Facts

12. On or about June 1, 2008, V1 made a statement to the United States Marine Security Guard Detachment Commander at the United States Embassy in Algiers, Algeria. V1 disclosed that on or around September 2007, Warren had sexual intercourse with V1 without her consent, at his residence located at located at #5 Chemin D’Hydra, Poirsson, El Biar, Algiers, Algeria. The Marine reported V1’s statements to the Regional Security Officer, DSS Special Agent Kevin Whitson.

13. DSS Special Agent Jared Campbell traveled to Germany to interview V1 on September 25, 2008. During this interview V1 stated that sometime between the months of August and September 2007, she was invited to a party at Warren’s residence by United States Embassy employees. V1 had never met Warren before, and after introductions, Warren offered to make V1 an alcoholic beverage, which she accepted. Several minutes later, Warren handed V1 a glass which contained a mixed drink of cola and whiskey. The drink was prepared out of V1’s sight and was handed to her by Warren. During the course of the evening, V1 states she consumed several additional mixed drinks, similar to the first glass which contained cola and whiskey. Each beverage was prepared out of the sight of V1 and was handed to her by Warren. As the evening progressed, V1 stated that she began to feel the effects of the alcohol.

14. While consuming the last drink prepared for her by Warren, V1 stated that she suddenly felt nauseated and felt an immediate need to vomit. V1 described the sudden

and violent onset of nausea as nothing like the physiological effects of alcohol that she had experienced while consuming alcohol on previous occasions. V1 physically held her hand over her mouth in order to avoid vomiting on the floor of the residence. V1 ran to a bathroom where she vomited into a toilet.

15. While V1 was vomiting, Witness #1 (“W1”), a female, was trying to assist V1 in the bathroom. V1 remembered Warren standing in the bathroom doorway while she was sick, saying that V1 should stay the night at his house. After this memory, V1 could not remember anything that happened the rest of the evening. W1 stated that all of the other individuals at the party left the house around this time, and that only V1, W1 and Warren stayed the night in the residence.

16. V1 stated that when she woke up the next morning, she was lying on a bed, completely nude, with no memory of how she had been undressed, or what had occurred after she had gotten sick in Warren’s bathroom. The bedroom door was closed, and there was no one else in the room. V1 had a slight headache and felt physical discomfort in her vaginal area that made her believe that she recently had engaged in sexual intercourse, though she had no memory of having intercourse.

17. V1 stated that she saw a yellow container or trash can to the left of the bed. V1 observed a used condom with what she believed to be sperm inside the condom, lying near the yellow container on the floor. V1 became upset, and called W1 on her mobile phone. V1 asked W1 to come to her location quickly. W1 was in another part of the house, and she quickly proceeded to the bedroom. V1 showed W1 the used condom on the floor. V1 then quickly dressed, and the two left the bedroom. After V1 left the

residence, she states that she has not seen, nor has she had any contact with Warren since the date of the incident.

18. An agent assisting me has interviewed W1. W1 stated that she saw Warren with a video recording machine the night of the party, and W1 further stated that she saw Warren taping V1 with the video recording machine at various times during the party.

19. An agent assisting me has also interviewed another witness about V1, this second witness (“W2”) stated that he was at the party at Warren’s described by V1 above and that V1 was there. W2 added that he observed V1 drinking heavily on her own during the party and becoming intoxicated.

20. On September 15, 2008, V2 made a statement to Deputy Chief of Mission for the United States Embassy in Algeria, Thomas F. Daughton. During the meeting, V2 stated that Warren had sexual intercourse with her without her consent on approximately February 17, 2008. The Deputy Chief of Mission immediately reported V2’s allegation to the Regional Security Officer, DSS Special Agent Kevin Whitson.

21. On September 25, 2008, DSS Special Agent Gregory Schossler traveled to Spain to interview V2. During that interview, V2 stated that she had been acquainted with Warren for several months prior to the incident on February 17, 2008. V2 stated that she and her husband met Warren at a United States Embassy related function in Cairo, Egypt, and that she met with Warren once in Algiers, after his employment was transferred from the United States Embassy in Egypt to the United States Embassy in Algeria.

22. V2 stated that, on or about February 17, 2008 Warren invited her to his residence, located at #5 Chemin D’Hydra, Poirsson, El Biar, Algiers, Algeria. When V2 arrived at the residence, Warren gave her a tour of his home. Then, they sat down in his living

room, and began talking. V2 stated that Warren asked her if he could take a picture of her while she was sitting on his couch. V2 agreed, and Warren took a digital photograph of her on his cell phone.

23. V2 stated that Warren offered to make her a drink. Warren went into his kitchen to prepare the drink, and he returned to the living room with an apple martini. The apple martini was prepared out of the sight of V2, and handed directly to V2 by Warren. V2 and Warren both consumed one apple martini each while they talked. A short time later, Warren offered V2 another apple martini. Warren went into the kitchen to prepare the second apple martini out of the sight of V2. She followed him into the kitchen, but he quickly handed her a platter with crackers, and asked her to take the platter into the living room. A few minutes later, Warren walked back into the living room and handed V2 a second apple martini. V2 stated that at this point, she was not suffering from any significant effects of the alcohol regarding the first apple martini she consumed.

24. While drinking the second apple martini, V2 suddenly felt faint and felt the immediate needed to vomit. V2 described the sudden and violent onset of the illness as nothing like the physiological effects of alcohol related sickness that she had experienced when she consumed alcohol on previous occasions. V2 stated she immediately began to pass in and out of consciousness. V2’s recollections of the ensuing events are characterized as passing in and out of consciousness, due to the debilitating effects of the illness.

25. After nearly fainting and experiencing the immediate need to vomit, V2’s next recollection was being located in Warren’s upstairs bathroom, on the floor. V2 could see and hear, but she could not move. Warren was in the bathroom, and he was attempting to

remove V2’s pants. Although V2 could not physically resist Warren, she was able to speak, and she asked him to leave the bathroom. Warren continued to undress V2, and told her she would feel better after a bath. V2 stated that she had difficulty comprehending what was happening to her. Eventually Warren was able to remove V2’s blue jeans, boots, and her blazer.

26. As V2 passed in and out on consciousness, she remembers being in the bathtub wearing her shirt, but she could not remember how she got into the bathtub. V2 states that she felt herself slip underwater. V2 next remembers being out of the bathtub, attempting to put her blue jeans back on. V2 next remembers being on Warren’s bed, as he entered the bedroom and began to undress V2 again. V2 states that she felt like she was physically “paralyzed”, and although she could not move, she told Warren to stop. V2 could see, hear, and speak, but could not move her muscles. Warren made a statement to the effect of “nobody stays in my expensive sheets with clothes on”. Warren took off V2’s blue jeans and underwear. V2 states that she repeatedly asked Warren “what’s happening to me?” as Warren undressed her.

27. V2 next remembers lying on her back in the bed. Warren was nude, on his knees and he had an erection. V2 realized that Warren was about to penetrate her vagina, and stated that she asked Warren to use a condom. V2 recalls that as she slipped in and out of consciousness, she had conscious images of Warren penetrating her vagina repeatedly with his penis.

28. Sometime later, V2 woke up in Warren’s bed, but did not understand what had happened to her. V2 does not remember how she got her clothes back on, or how she drove home.

29. In the days following the incident, on or about February 19, 2008, V2 sent a text message to Warren, accusing him of abusing her. According to V2, Warren replied “I am sorry” in a text message to her. V2 told her husband and her psychologist about the incident on February 17, 2008, but did not inform anyone at the United States Embassy until she next returned to Algeria in September 2008.

30. On October 9, 2008, Warren flew from Algeria to the United States, for a meeting scheduled on October 10, 2008. On October 9, 2008, Warren checked into Hilton Washington Hotel, Room 7212, located at 1919 Connecticut Ave., NW, Washington, DC. This hotel is located in the District of Columbia.

31. On October 10, 2008, I met with Warren at his place of employment in Northern Virginia to inform him of the allegations leveled against him by V1 and V2. During this meeting, Warren agreed to cooperate with the investigation. Warren admitted during this meeting that he had engaged in consensual sexual intercourse with V1 and V2 at his residence in Algiers, Algeria. Warren informed me that his personal lap top computer was in his hotel room located at the Washington Hilton Hotel and that photographs of V1 and V2 were probably on his personal lap top computer. Following this meeting, Warren voluntarily surrendered his cell phone and digital camera, which were located in his rental car, to me for forensic analysis. That analysis uncovered multiple photographs of V1 and V2, along with various other women. He declined consent to the seizure or search of his personal computer.

32. I know based on my training and experience, including specific training provided to me by the Diplomatic Security Training Center regarding the collection of electronic data, that electronic data located on a lap top or desk top computer can be easily deleted,

destroyed, or altered within seconds. Based upon this information, I instructed two DSS Special Agents to immediately begin surveillance on Warren’s hotel room while I began to prepare an affidavit for a search warrant to search his hotel room for his personal lap top. Prior to my completion of the requisite documents needed to obtain a search warrant, Warren arrived at his hotel room. Fearing that Warren might attempt to destroy or alter any evidence located on his lap top computer, I ordered the two DSS Special Agents to ask Warren to surrender the computer into their custody. Warren then provided the agents with a HP Pavilion Entertainment Personal Computer Model Number DV 2500, Serial Number 2CE80929M3. The computer was transported by these agents to the United States Attorney’s Office for the District of Columbia, located in Washington, DC, where it was received and where it presently is located.

33. On October 13, 2008, DS Special Agents executed a search warrant on Warren’s residence in Algiers, Algeria. During the search, agents recovered among other items, apple martin mix, Multiple data storage devices, including multiple computer hard drives, memory cards, Valium and Xanax and a handbook on the investigation of sexual assaults.

Probable Cause to Search The Lap Top Computer

34. On October 7, 2008, I spoke with a toxicologist on duty in the Chemistry Unit of the FBI Laboratory. This toxicology expert has over 7 years of experience in the investigation of drug facilitated sexual assaults, and she explained that the victims' symptoms were consistent with drugs used to facilitate sexual assaults. The expert also explained that due to the sedative properties of these drugs, victims often have no memory of an assault, only an awareness or sense that they were violated. Common effects are sensations of drunkenness that do not correspond to the amount of alcohol

consumed, unexplained gaps in memory, altered levels of consciousness, disorientation, sickness, and the feeling of paralysis. Some victims of date rape drugs remember brief periods of awakening where they are aware of their surroundings, and can sometimes speak, but are unable to move.

35. Through the toxicology expert, I learned that drugs which are commonly used to facilitate sexual assault are prescribed sleeping medications, muscle relaxants, anxiety pills, Xanax, and Valium, which are then converted from pill form to powdered form. "GHB" (gamma-hydroxybutyrate), a "Schedule 1" drug under the Controlled Substances Act, is a nervous system depressant used for euphoric and sedative effects (diluted in water/beverages). GHB is produced commercially in very limited and tightly controlled quantities under the name Xyrem. I also learned that Industrial Solvents, such as "GBL" (gamma-butyrolactone) and "BD" (1,4-Butanediol) are sold in liquid form as floor stripper, fish tank cleaner, ink stain remover, ink cartridge cleaner and nail enamel remover. GHB can be produced easily by combining GBL with either potassium hydroxide or sodium hydroxide, and instructions for GHB production are available on the Internet. Furthermore, once ingested into the human body, the human body will convert the GBL into GHB.

36. The expert relayed that these substances are commonly sold over the Internet and are mixed in the victim's drinks, usually without their knowledge, to mask the salty taste. These drugs are rapidly absorbed and metabolized by the body. Detectable levels remain in the urine for 8 to 12 hours and in the blood for 4 to 8 hours. Symptoms of these drugs appear within 15 to 30 minutes of ingestion, and the effects persist for 3 to 6 hours. It

was also relayed by the expert that information on how to obtain and use the above-described substances to facilitate sexual assaults can be found on the Internet.

37. V1 and V2 reported experiencing similar symptoms associated with the ingestion of substances described in paragraphs 32 and 33, and since the reported incidents occurred approximately eight months apart, there is reason to believe that Warren maintains these substances and other items associated with the preparation of the substances in his residence on a continuing basis.

38. As noted above, W1 stated that Warren video taped V1 on the night of the party and V2 stated that Warren took a photograph of her in his residence on the night of the alleged sexual assault using his cellular telephone. I know from my training and experience that digital photographs taken by means of cellular telephones, digital cameras, and video cameras can be transferred to and stored in other digital storage media including but not limited to computers, thumb drives and compact discs.

39. In light of (1) V2’s statement that Warren took a photograph of her on the night of her alleged assault, (2) the toxicologists opinion that information concerning how to obtain and use chemical substances to facilitate sexual assaults may be found on the Internet, and (3) the toxicologist’s opinion that these chemical substances are sold over the Internet, and (4) Warrens statement that V1and V2 “probably” are on the laptop computer, I have probable cause to believe that evidence of Warren’s sexual assaults may be stored on Warren’s laptop computer. Based on my knowledge, training, and experience, including the experience of other agents with whom I have spoken, I know that computer files or remnants of such files can be recovered months or even years after they have been downloaded onto a hard drive, deleted or viewed via the Internet.

Electronic files downloaded to a hard drive can be stored for years at little or no cost. Even when such files have been deleted, they can be recovered months or years later using readily-available forensics tools. When a person “deletes” a file on a home computer, the data contained in the file does not actually disappear; rather, that data remains on the hard drive until it is overwritten by new data. Therefore, deleted files, or remnants of deleted files, may reside in free space or slack space - that is, in space on the hard drive that is not allocated to an active file or that is unused after a file has been allocated to a set block of storage space - for long periods of time before they are overwritten. In addition, a computer's operating system may also keep a record of deleted data in a “swap” or “recovery” file. Similarly, files that have been viewed via the Internet are automatically downloaded into a temporary Internet directory or “cache.” The browser typically maintains a fixed amount of hard drive space devoted to these files, and the files are only overwritten as they are replaced with more recently viewed Internet pages. Thus, the ability to retrieve residue of an electronic file from a hard drive depends less on when the file was downloaded or viewed than on a particular user's operating system, storage capacity, and computer habits.

40. Based upon my training and experience and information related to me by agents and others involved in the forensic examination of computers, I know that computer data can be stored on a variety of systems and storage devices including hard disk drives, on computer. I also know that a forensic search of a computer may take several weeks to complete.

a. Searching computer systems is a highly technical process which requires specific expertise and specialized equipment. There are many types of computer hardware

and software in use today. It may be necessary to consult with computer personnel who have specific expertise in the type of computer, software application or operating system that is being searched.

b. Searching computer systems requires the use of precise, scientific procedures which are designed to maintain the integrity of the evidence and to recover “hidden,” erased, compressed, encrypted or password-protected data. Computer hardware and storage devices may contain “booby traps” that destroy or alter data if certain procedures are not scrupulously followed. Since computer data is particularly vulnerable to inadvertent or intentional modification or destruction, a controlled environment, such as a law enforcement laboratory, is essential to conducting a complete and accurate analysis of the equipment and storage devices from which the data will be extracted.

c. The volume of data stored on many computer systems and storage devices will typically be so large that it will be highly impractical to search for data during a short period of time. A single megabyte of storage space is the equivalent of 500 double-spaced pages of text. A single gigabyte of storage space, or 1,000 megabytes, is the equivalent of 500,000 double-spaced pages of text. Storage devices capable of storing 160 gigabytes (GB) of data are now commonplace in desktop computers. Consequently, each non-networked, desktop computer found during a search can easily contain the equivalent of 80 million pages of data, which, if printed out, would result in a stack of paper over four miles high. Further, a 160 GB drive could contain as many as approximately 150 full run movies or 150,000 songs.

d. Computer users can attempt to conceal data within computer equipment and storage devices through a number of methods, including the use of innocuous or misleading filenames and extensions. For example, files with the extension “.jpg” often are image files; however, a user can easily change the extension to “.txt” to conceal the image and make it appear that the file contains text. Computer users can also attempt to conceal data by using encryption, which means that a password or device, such as a “dongle” or “keycard,” is necessary to decrypt the data into readable form. In addition, computer users can conceal data within another seemingly unrelated and innocuous file in a process called “steganography.” For example, by using steganography a computer user can conceal text in an image file which cannot be viewed when the image file is opened. Therefore, a substantial amount of time is necessary to extract and sort through data that is concealed or encrypted to determine whether it is evidence, contraband or instrumentalities of a crime.

Conclusion

41. Based on the foregoing, I have probable cause to believe that on or about September 2007 and on or about February 17, 2008, within the special maritime and territorial jurisdiction of the United States, Andrew Warren committed the offense of aggravated sexual abuse, in violation of 18 U.S.C. §§ 2241(b)(2) and 2242. In addition, based on the forgoing, I have probable cause to believe that evidence and instrumentalities relating to these crimes, as further described in attachment B, will be on

Andrew Warren’s HP Pavilion Personal Computer Model DV 2500, Serial Number 2CE80929M3, located within the District of Columbia.

________________________________________

Special Agent Scott Banker

Diplomatic Security Service

United States Department of State

Sworn to and subscribed before me on this _______ day of _________________, 2008.

_________________________________________

United States Magistrate Judge