Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.1 Page 1 of 30
AO 106A (08/18) Application for a Warrant by Telephone or Other Reliable Electronic Means
UNITED STATES DISTRICT COURT
for the
Southern District
__________ DistrictofofCalifornia
__________
In the Matter of the Search of )
(Briefly describe the property to be searched ) '22 MJ01124
or identify the person by name and address) ) Case No.
Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA, )
Instagram usernames "matthewtaylorcoleman" and )
"lovewater_surf" )
APPLICATION FOR A WARRANT BY TELEPHONE OR OTHER RELIABLE ELECTRONIC MEANS
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):
SEE ATTACHMENT A
located in the NORTHERN District of CALIFORNIA , there is now concealed (identify the
person or describe the property to be seized):
SEE ATTACHMENT B
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
✔ evidence of a crime;
’
’ contraband, fruits of crime, or other items illegally possessed;
’ property designed for use, intended for use, or used in committing a crime;
’ a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 USC 1119, 1111 FOREIGN MURDER OF U.S. NATIONALS
The application is based on these facts:
SEE ATTACHED AFFIDAVIT
✔ Continued on the attached sheet.
’
’ Delayed notice of days (give exact ending date if more than 30 days: ) is requested under
18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.
Applicant’s signature
SA JOSEPH P. HAMER, FBI
Printed name and title
Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1 by
TELEPHONE (specify reliable electronic means).
Date: March 28, 2022
Judge’s signature
Michael S. Berg
City and state: SAN DIEGO, CA Xxxxxxxxxxxxxxxx
DANIEL E. BUTCHER, U.S. MAGISTRATE JUDGE-
Printed name and title
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.2 Page 2 of 30
AFFIDAVIT
I, Joseph P. Hamer, being duly sworn, declare and state as
follows:
I. INTRODUCTION
1. I am a Special Agent with the Federal Bureau of
Investigation (“FBI”) and have been so employed since May 1,
2016. As a federal agent, I am empowered by United States law
to conduct investigations regarding, and make arrests for,
offenses enumerated in Title 18 of the United States Code.
During my tenure as a Special Agent, I have conducted and
participated in numerous investigations of criminal activity,
executed search and arrest warrants, and seized evidence of
federal criminal violations. Since April 1, 2019, I have been
assigned to work violent crimes against children at the FBI’s
Ventura Resident Agency. In this role, I am responsible for,
among other things, enforcing federal criminal statutes
involving the sexual exploitation of children. I have received
both formal and informal training from the FBI regarding
computer-related investigations and computer technology. My
formal law enforcement training includes 21 weeks of education
at the FBI Academy, where I took classes on writing affidavits
and providing evidentiary testimony, among other topics. Prior
to my assignment at the Ventura Resident Agency, I was assigned
to the Los Angeles Violent Crime Task Force. As a member of
this task force, I investigated various violent crimes,
including bank robbery, extortion, kidnapping, and homicide.
2. This affidavit supports an application by the United
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.3 Page 3 of 30
States of America for a search warrant for Meta Platforms, Inc.,
headquartered at 1601 Willow Road, Menlo Park, California 94025
(“Meta”), to search the following online accounts:
a. Instagram username “matthewtaylorcoleman” (“SUBJECT
ACCOUNT 1”), a personal account used by Matthew Coleman (“M.
COLEMAN”);
b. Instagram username “lovewater_surf” (“SUBJECT ACCOUNT
2”), a business account used by M. COLEMAN, collectively the
(“SUBJECT ACCOUNTS”) as described in Attachment A;
for content and data from October 1, 2018 to August 10, 2021,
for items that constitute evidence of violations of federal
criminal law, namely, Title 18, United States Code, Sections
1119 and 1111: Foreign Murder of United States Nationals (the
“SUBJECT OFFENSE”) as described in Attachment B. On September
8, 2021, a federal grand jury in the Southern District of
California indicted M. COLEMAN for two counts of the SUBJECT
OFFENSE.
3. The facts set forth in this affidavit are based on my
own personal knowledge, knowledge obtained from other
individuals during my participation in this investigation,
including other law enforcement officers, interviews of
witnesses, my review of documents and computer records related
to this investigation, communications with others who have
personal knowledge of the events and circumstances described
herein, and information gained through my training and
experience. Because this affidavit is submitted for the limited
purpose of establishing probable cause in support of the
2
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.4 Page 4 of 30
application for a search warrant, it does not set forth every
fact that I or others have learned during this investigation.
II. STATEMENT OF PROBABLE CAUSE
A. A.C. Reported M. COLEMAN Missing.
4. On August 9, 2021, Sgt. Larson of the Santa Barbara
Police Department (“SBPD”) contacted FBI SA Jennifer Bannon
regarding a possible parental kidnapping. Sgt. Larson provided
SA Bannon with a copy of a missing person police report that was
taken by the SBPD. I reviewed the police report and learned the
following:
a. On August 7, 2021, SBPD Officer Barriga spoke to
A.C. via telephone regarding her husband, M. COLEMAN. A.C.
reported to SBPD that she, M. COLEMAN, and their two children,
R.C. (10 months old) and K.C. (two years old),1 planned to go on
a camping trip. Instead, A.C. said that M. COLEMAN had left
their home in Santa Barbara, California (the “Coleman
Residence”) in the family’s Mercedes Sprinter van with R.C. and
K.C. A.C. reported that M. COLEMAN did not tell her where he
was going and was not answering her text messages. The officer
attempted to contact M. COLEMAN via telephone but received no
response.
b. On August 8, 2021, A.C. called SBPD to follow up
on the previous day’s report. SBPD Officer Michael Chung
responded to the Coleman Residence and met with A.C., who
According to R.C.’s birth certificate, she was born in
1
September 2020. According to K.C.’s birth certificate, he was
born in October 2018. Both were born in the United States and
were U.S. citizens. The time period requested under the warrant
to search the SUBJECT ACCOUNTS begins the month of K.C.’s birth.
3
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.5 Page 5 of 30
requested SBPD’s assistance in reporting M. COLEMAN and their
two children missing. Officer Chung asked A.C. whether she
could attempt to use the “Find My iPhone” application to locate
M. COLEMAN’s phone. A.C. agreed and turned on a laptop, which
showed that M. COLEMAN’s last known location was in Rosarito,
Baja California, Mexico at approximately 2:24 p.m.
B. M. COLEMAN Is Located Returning from Mexico and R.C.’s
and K.C.’s Bodies Are Found.
5. On August 9, 2021, at about 11:50 a.m., Sgt. Larson,
SBPD Detective Davis, and District Attorney Investigator (DAI)
Aijian, went to the Coleman Residence where they met A.C.’s
friends, T.C. and A.P., who explained that A.C. had just left
for San Diego. T.C. and A.P. showed how they were using the
Find My iPhone app on a MacBook Pro computer (the “MacBook”) to
track M. COLEMAN’s iPhone movements in Mexico toward the San
Ysidro Port of Entry (“SYPOE”).2
6. A.P. and T.C. asked for help coordinating the search
for M. COLEMAN, R.C., and K.C. A.P. and T.C. showed Det. Davis
and DAI Ajian a text message from M. COLEMAN’s iCloud account on
the MacBook. The text message from M. COLEMAN to A.C. was sent
on August 9, at 3:12 a.m., stating: “Hi babe, miss you too.
Things have been rough but starting to get some clarity as well.
Still confused on a lot of things though and processing through
2 According to Det. Davis’s report, A.P. identified the
MacBook as belonging to M. COLEMAN and said A.C. was able to log
in because she had his password. Later, A.P. provided the FBI
with text messages between her and A.C. These text messages,
which were on August 9 between about 1:23 p.m. and 2:33 p.m.,
show A.C. providing A.P. with M. COLEMAN’s iCloud login and
password, and A.C. asking for “any updates on Matt’s location”
with A.P. responding, “It looks like he is at the border.”
4
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.6 Page 6 of 30
them. So many crazy thoughts going through my head right now,
hard to explain. Yeah, funny your getting some clarity through
my grandmas old bibles. Wasn't there 2? Anyways, was actually
still thinking of burning them in case theres a chip in them or
something. Going to keep processing through everything and hope
to get some answers. Hope all this craziness ends soon. Love
you.”
7. A.P. and T.C. also showed Det. Davis and DAI Aijian
responsive text messages from A.C. to M. COLEMAN asking if her
children were okay, as well as a message from A.C. to M. COLEMAN
on August 9 at 9:24 a.m., stating: “We are doing this together
babe. Praying for clarity over you and your mind this morning.
Everything you’ve believed and known to be true is happening
right now. I’m partnering with you from SB. Let’s take back
our city. The gateway of revival for the state of California
and the nation and the world. You were created to change the
course of world history. Take care of my little giant slayer
and my the voice of heaven’s dove. They sure are special.”
8. Sgt. Larson thereafter seized the MacBook, and law
enforcement obtained search warrants for the MacBook.
9. At approximately 1:00 p.m., on August 9, M. COLEMAN
arrived at the SYPOE in the Mercedes Sprinter van. M. COLEMAN
was referred to Secondary Inspection. There were no other
occupants in the Mercedes Sprinter van. Federal agents took
custody of the Mercedes Sprinter van. That same day, a Mexican
liaison partner with the Secretaria de Seguridad Publica
Municipal de Rosarito relayed to FBI Supervisory Special Agent
5
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.7 Page 7 of 30
Joyce Deniz that they had located two deceased children matching
R.C.’s and K.C.’s descriptions in a ditch at approximately 8:00
a.m. on August 9.
C. M. COLEMAN Is Interviewed at the SYPOE and Discusses,
Among Other Things, Instagram.
10. Later that day, M. COLEMAN was interviewed by FBI SA
Nathaniel Dingle, during which time SA Dingle read M. COLEMAN
his Miranda rights and M. COLEMAN waived his rights and agreed
to speak with agents. I reviewed the video recorded interview
during which time M. COLEMAN made, among others, the following
statements:
a. M. COLEMAN confessed to killing his children,
R.C. and K.C. M. COLEMAN said that he drove his children to
Mexico on Saturday, August 7, 2021. M. COLEMAN said that he
believed his children were going to grow into monsters so he had
to kill them. At approximately 5:00 a.m., on August 9, M.
COLEMAN drove south on Descanso Road. He pulled off to the side
of a road in the area of Rancho Del Cielo. M. COLEMAN stated
that first he killed R.C., using a spear fishing gun that
pierced R.C. in the heart. After he killed his children, M.
COLEMAN said that he moved their bodies approximately 30 yards
away and placed them in some brush.3 M. COLEMAN stated that he
drove a couple of miles where he then discarded the spear
fishing gun and bloody clothes near a creek. He threw bloody
3 M. COLEMAN provided agents with the approximate location
of the bodies, which coincided with where the bodies were
located by Mexican authorities.
6
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.8 Page 8 of 30
clothes into a blue trash bin somewhere off the side of a road
in Tijuana, Mexico.
b. M. COLEMAN said that five or six days ago he
started noticing strange coincidences. He discussed QAnon4 and
Illuminati conspiracy theories as well as Strong’s numbers (an
index of every word in the Bible). He said visions and signs
revealed that his wife, A.C., possessed serpent DNA (M. COLEMAN
mentioned that he was not sure if his wife was a shape shifter)
and had passed it onto his children and that all things were
pointing to the idea that his children have corrupted DNA that
will spread if something is not done about it. M. COLEMAN
explained that he was either crazy or the only person that is
left on Earth that is a true man, and that while he was in
Mexico – before killing his children – M. COLEMAN laid in bed
seeing all the pieces being decoded like “The Matrix,” and he
was Neo.5 M. COLEMAN also discussed time travel, teleportation,
R.C. and K.C. telling him about babies being placed in
fireworks, food, and walls. M. COLEMAN explained that his
children were communicating with him; that K.C. told him that
A.C. and a family friend were abusing K.C. and R.C.; and that
eventually M. COLEMAN saw the big picture that he had to kill
his children to prevent them from becoming an alien species that
would release carnage over the Earth.
4 M. COLEMAN mentioned during the interview that “Q” was
actually talking to him.
5 “The Matrix” is a science fiction film. Neo is the lead
character.
7
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.9 Page 9 of 30
c. During the interview, M. COLEMAN showed the
interviewing agents several hand signals or signs that M.
COLEMAN said were an indication that someone was a part of the
conspiracy and showing their allegiance. M. COLEMAN then
explained that he scrolled through Instagram and took
screenshots of individuals making these hand signals or signs.
M. COLEMAN explained that he does not use Facebook anymore, but
had recently searched through his friend, A.M.’s, Facebook
account and saw a posted photograph of A.M. making one of the
gestures over his eye. M. COLEMAN showed agents the hand
gesture. According to M. COLEMAN, after seeing A.M.’s posting
with the hand gesture, M. COLEMAN knew that the “whole thing was
a setup” and “they” were using people to get to M. COLEMAN.
d. M. COLEMAN identified and initialed photographs
of R.C.’s and K.C.’s dead bodies as his children.
e. M. COLEMAN said he knew what he did was wrong,
but it was the only course of action that would save the world.
f. M. COLEMAN signed a consent form allowing the FBI
to search his iPhone and provided the passcode.
D. M. COLEMAN Makes Additional Statements About
Instagram, Religion, and Conspiracies.
11. On August 10, 2021, while I was transporting M.
COLEMAN to the Santa Ana jail, M. COLEMAN discussed his
religious beliefs, work as a pastor, Nephilim, and the biblical
story of Abraham sacrificing his son Isaac. Also, on August 10,
while SA Bannon and I were transporting M. COLEMAN to the
Ventura County jail, M. COLEMAN said that about five days before
8
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.10 Page 10 of 30
he left for Mexico, he started to get clarity. M. COLEMAN said
he saw messages on Instagram that were showing hand signs,
proving “they” were targeting M. COLEMAN, and M. COLEMAN began
to understand what those messages meant.
12. On August 11, while I was transporting M. COLEMAN from
Ventura County Jail to the United States Marshals Service, he
explained that he first learned of “Lizard People” on Twitter
and from “that British guy with white hair.”6
E. A.C. is Interviewed at the SYPOE and Discusses, Among
Other Things, Instagram.
13. On August 9, 2021, after M. COLEMAN had entered the
SYPOE without his children, FBI SA Zachary Schaefer and SA Jesse
Chappell conducted a Mirandized interviewed of A.C. I reviewed
the recording of that interview and observed the following:
a. A.C. explained that she and her husband were
researching QAnon, and M. COLEMAN became significantly more
paranoid that people around him were involved in a conspiracy.
A.C. said that M. COLEMAN started doing a lot of research on
leaders running “the church” and found that they may have been
part of the conspiracy. A.C. explained that M. COLEMAN began
seeing “signs” in people’s social media posts, and M. COLEMAN
believed he was able to connect the people running “the church”
to people in their community and to some of their best friends.
6 I believe, based on my investigation of this case, “that
British guy with white hair” refers to David Icke, a British
conspiracy theorist with white hair, who has published several
books, including “Children of the Matrix” which describes, among
other things, “Nefilim,” “interbreeding [] between the
reptilians and the blond-haired, blue-eyed, Nordic peoples,”
“reptilian DNA,” and “‘royal’ bloodlines[ of] the reptilian-
Nordic hybrids,” and their relation to the “Illuminati.”
9
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.11 Page 11 of 30
A.C. said that M. COLEMAN found information on their friends’
Instagram accounts that M. COLEMAN believed showed that they
were “all in this thing together.” M. COLEMAN even accused A.C.
of being a part of the conspiracy.
F. M. COLEMAN’s and A.C.’s Communications On and About
Instagram.
14. Pursuant to a federal warrant, I reviewed M. COLEMAN’s
iPhone, which had been seized at the SYPOE, and found the
following:
a. Between October 1, 2018 and August 9, 2021, M. COLEMAN
exchanged over 400 direct messages using SUBJECT ACCOUNT 1
(which appears to be M. COLEMAN’s personal Instagram account)
and SUBJECT ACCOUNT 2 (which appears to be M. COLEMAN’s business
Instagram account) with approximately 60 different Instagram
users.7
b. From SUBJECT ACCOUNT 1, for example, on August 6,
2021, the day before M. COLEMAN took his children to Mexico, he
exchanged four Instagram direct messages with “L.A.” L.A. asked
M. COLEMAN if “you guys” wanted to do a photo session. M.
COLEMAN thanked L.A. and stated he had just had a photo shoot.
Additionally, SUBJECT ACCOUNT 1 exchanged approximately 10
Instagram direct messages between May 19, 2021 and July 3, 2021,
with an Instagram account that I believe to be a personal
account belonging to A.C. (“A.C.’s Instagram Account”),8 but I
7 Further explanation of the identification of these
accounts is set forth, infra.
8 The basis for my identification of A.C.’s Instagram
Account belonging to A.C. is set forth, infra.
10
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.12 Page 12 of 30
was not able to see the content of those messages on M.
COLEMAN’s iPhone.
c. From SUBJECT ACCOUNT 2, for example, between July 20,
2021 and July 27, 2021, M. COLEMAN exchanged approximately 10
Instagram direct messages with Instagram user “F.J.” SUBJECT
ACCOUNT 2 sent multiple photos to F.J. that I am unable to see.
F.J. responded to SUBJECT ACCOUNT 2 by writing, “Thanks so much!
This is going to get them pumped for Thursday and hopefully more
days/years to come!!!” Based on the content of other messages
in the exchange, and the fact that SUBJECT ACCOUNT 2 is used as
M. COLEMAN’s business Instagram account, I believe that F.J. was
talking to SUBJECT ACCOUNT 2 about the surf business or surf
lessons.
d. In addition to Instagram direct messages on SUBJECT
ACCOUNTS 1 and 2, I also saw several text messages between M.
COLEMAN and others that included links to Instagram posts. For
example, on July 20, 2021, A.M. sent M. COLEMAN a text message
with a link to an Instagram account that appears to belong to
the United States Marine Corps. The image depicts a Marine in
his camouflage uniform. The caption reads, “The calm before the
storm.” That phrase, while common, also is often used by QAnon
followers. In reviewing that Instagram post, I found in the
comments section that other Instagram users posted QAnon related
comments such as, “WWG1WGA,” – which means “Where we go one, we
go all” – as well as “TRUMP ‘Q.’”
11
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.13 Page 13 of 30
e. On August 3, 2021, A.C., who was listed in M.
COLEMAN’s phone as “[A.] Wifey”9 sent the following Instagram
screenshots to M. COLEMAN via text message:
I know, based on my research and investigation of this case,
that these images depict Candace Owens, a popular conservative
commentator. According to my review of Instagram,
9 The phone number associated with “{A.] Wifey” on M.
COLEMAN’s phone matches the number on the iPhone that was seized
from A.C. at the SYPOE on August 9, 2021 and that I have
searched pursuant to a federal warrant.
12
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.14 Page 14 of 30
“eyesontheright5.0” – which is the Instagram handle associated
with the screenshots A.C. sent to M. COLEMAN on August 3, 2021,
supra paragraph 14.e., – writes in its Instagram header “I post
on my eyesontheright4.0[]” and “This is my backup.”
Additionally, “Eyesontheright4.0” writes in its Instagram header
“Symbolism is the language of the satanic elite.”
15. In addition to Instagram direct messages and text
messages about Instagram that I found on M. COLEMAN’s and A.C’s
iPhones, during my review of M. COLEMAN’s iPhone, I found
numerous screenshots of other people’s Instagram posts in which
people are posing while making some type of hand gesture.
a. For example, I found a screenshot that was
created on July 31, 2021, of a musician. The Instagram post by
musician was dated April 3, 2017, and it is a picture of the
musician holding up three fingers. Another example I found was
a screenshot of an Instagram post that was created on August 6,
2021. The screenshot depicts a woman and young boy holding up
two fingers, making the “peace” sign.
G. M. COLEMAN’s Friend, A.M., Discusses M. COLEMAN’s Use
of Instagram.
16. On August 20, 2021, M. COLEMAN’s friend A.M., was
interviewed by SA Bannon and me. During the interview, A.M.,
told us the following:
a. M. COLEMAN started noticing “signs” everywhere,
including postings on Instagram from musicians, teachers, and
his friends. M. COLEMAN took notice of symbols he saw in
photographs. Approximately three weeks before M. COLEMAN left
13
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.15 Page 15 of 30
for Mexico, M. COLEMAN started asking A.M. about these
photographs and the hand gestures and symbols depicted in the
photographs. M. COLEMAN stated the people in the photographs
making these signs were evil, disguised as good, therefore these
people were “compromised.” A.M. also said that on August 5,
2021, two days prior to M. COLEMAN taking his children to
Mexico, M. COLEMAN began showing A.M. screenshots from Instagram
of A.M.’s closest friends making hand gestures such as peace
signs. M. COLEMAN accused A.M. of being a “loyalist,” which was
why A.M. could not see that he was being controlled.
b. Within hours of M. COLEMAN taking his children to
Mexico, A.C. called A.M., and A.M. went to the Coleman
Residence. A.C. showed A.M. a Facebook photograph of A.M and
his friends when A.M. was approximately 13 years old (making the
photograph over 10 years old). The photograph depicted A.M. and
his friends making hand gestures. Based, at least in part, on
these hand gestures, A.M. said that A.C. accused him of “being
in on it” and eventually A.C. chased A.M. out of the Coleman
Residence.
H. Identification of SUBJECT ACCOUNT 1, SUBJECT ACCOUNT
2, AND A.C.’s INSTAGRAM ACCOUNT.
17. After M. COLEMAN’s arrest, FBI personnel conducted an
open-source search through the Internet for Instagram accounts
associated with M. COLEMAN and located SUBJECT ACCOUNT 1 and
SUBJECT ACCOUNT 2.
18. Law enforcement identified SUBJECT ACCOUNT 1
(“matthewtaylorcoleman”) by matching the name “Matthew Taylor
14
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.16 Page 16 of 30
Coleman” and the profile photograph, which shows a picture of M.
COLEMAN. Additionally, law enforcement identified SUBJECT
ACCOUNT 2 (“lovewater_surf”) by matching the name of COLEMAN's
business, LoveWater Surf. Law enforcement agents and officers
investigating this case learned the name of M. COLEMAN’s
business during their interviews and investigation. For
example, agents have interviewed several employees at Lovewater
Surf who indicated M. COLEMAN owned the business. Additionally,
the public profile portion of a Facebook account that I believe
was a personal account of M. COLEMAN’s (it has the name “Matthew
Taylor Coleman” and a photograph that matches M. COLEMAN) states
that M. COLEMAN is the “Founder at Loverwater Surf School.”
SUBJECT ACCOUNT 1, which also contains the name, “Matthew Taylor
Coleman,” has a link in the profile section to
lovewatersurf.com. I also believe M. COLEMAN exclusively or
primarily operated SUBJECT ACCOUNT 2 because (1) the business is
a relatively small surfing school, and several employees were
temporary or seasonal; (2) none of the employees that agents
have interviewed described their duties as marketing or managing
social media accounts; (3) in reviewing M. COLEMAN’s digital
devices, agents have not found any communications with, or
indication he employs, a social media manager or marketing arm;
(4) M. COLEMAN appeared to control other digital platforms used
as part of the business, including FareHarbor (a business
management software platform that M. COLEMAN accessed from his
digital devices and which was used to run all aspects of the
business); (5) M. COLEMAN’s iPhone had several Instagram direct
15
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.17 Page 17 of 30
messages to and from SUBJECT ACCOUNT 2; and (6) M. COLEMAN’s
digital devices contained several photos, videos, and URLs
related to the Lovewater Surf School.
19. After M. COLEMAN’s arrest, investigators conducted an
open-source search through the Internet for Instagram accounts
associated with A.C. and located A.C.’s Instagram Account. The
account had A.C.’s name and a profile photograph that depicted
A.C.
20. The FBI has sent letters to Meta requesting it
preserve the contents of the SUBJECT ACCOUNTS, most recently on
January 25, 2022 (SUBJECT ACCOUNT 1 was first preserved on
August 9, 2021, SUBJECT ACCOUNT 2 on August 12, 2021).
III. TRAINING AND EXPERIENCE REGARDNG INDIVIDUALS WHO COMMIT
VIOLENT CRIMES AND THE USE OF SOCIAL MEDIA BY THOSE WHO
BELIEVE IN OR PARTICIPATE IN CONSPIRACY THEORIES.
21. Based on my training and experience and my
discussions with other law enforcement personnel, I know that
some people who are arrested for violent crimes will feign
mental illness (i.e., engage in malingering behavior) whereas
others may suffer from legitimate mental illness. One way to
determine if a person has a legitimate mental illness or is
malingering, or to determine the extent to which a person
understood the nature of their actions, is to examine their
conduct and communications with others in the time around and
leading up to specific events. For that reason, I believe an
examination of M. COLEMAN’s social media content and
communications will help establish his true mental state leading
16
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.18 Page 18 of 30
up to and around the time of the murders, as well as his mental
state in relation to R.C., K.C., and A.C.
22. Additionally, based on my training and experience
and my discussions with other law enforcement personnel, I know
that people who participate in and believe in conspiracy
theories, such as QAnon or Illuminati, will often find like-
minded individuals through online groups that are hosted on
various social media platforms like Facebook, Instagram, and
Twitter. I also know, based on my training and experience and
discussions with other law enforcement personnel, that
individuals who participate in and believe in conspiracy
theories, such as QAnon or Illuminati, will often communicate
with other like-minded individuals on social media platforms
such as Facebook, Instagram, and Twitter as well as through
encrypted chat platforms such as WhatsApp, Signal, and Telegram.
IV. TRAINING AND EXPERIENCE REGARDING INSTAGRAM/META
23. Instagram is a service owned by Meta, a United
States company and a provider of an electronic communications
service as defined by 18 U.S.C. §§ 3127(1) and 2510.
Specifically, Instagram is a free-access social networking
service, accessible through its website and its mobile
application, that allows subscribers to acquire and use
Instagram accounts, like the target account(s) listed in
Attachment A, through which users can share messages,
multimedia, and other information with other Instagram users and
the general public.
17
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.19 Page 19 of 30
24. Meta collects basic contact and personal identifying
information from users during the Instagram registration
process. This information, which can later be changed by the
user, may include the user’s full name, birth date, gender,
contact e-mail addresses, physical address (including city,
state, and zip code), telephone numbers, credit card or bank
account number, and other personal identifiers. Meta keeps
records of changes made to this information.
25. Meta also collects and retains information about how
each user accesses and uses Instagram. This includes
information about the Internet Protocol (“IP”) addresses used to
create and use an account, unique identifiers and other
information about devices and web browsers used to access an
account, and session times and durations.
26. Each Instagram account is identified by a unique
username chosen by the user. Users can change their usernames
whenever they choose, but no two users can have the same
usernames at the same time. Instagram users can create multiple
accounts and, if “added” to the primary account, can switch
between the associated accounts on a device without having to
repeatedly log-in and log-out.
27. Instagram users can also connect their Instagram and
Facebook accounts to utilize certain cross-platform features,
and multiple Instagram accounts can be connected to a single
Facebook account. Instagram accounts can also be connected to
certain third-party websites and mobile apps for similar
functionality. For example, an Instagram user can “tweet” an
18
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.20 Page 20 of 30
image uploaded to Instagram to a connected Twitter account or
post it to a connected Facebook account or transfer an image
from Instagram to a connected image printing service. Meta
maintains records of changed Instagram usernames, associated
Instagram accounts, and previous and current connections with
accounts on Meta and third-party websites and mobile apps.
28. Instagram users can “follow” other users to receive
updates about their posts and to gain access that might
otherwise be restricted by privacy settings (for example, users
can choose whether their posts are visible to anyone or only to
their followers). Users can also “block” other users from
viewing their posts and searching for their account, “mute”
users to avoid seeing their posts, and “restrict” users to hide
certain activity and prescreen their comments. Instagram also
allows users to create a “close friends list” for targeting
certain communications and activities to a subset of followers.
29. Users have several ways to search for friends and
associates to follow on Instagram, such as by allowing Meta to
access the contact lists on their devices to identify which
contacts are Instagram users. Meta retains this contact data
unless deleted by the user and periodically syncs with the
user’s devices to capture changes and additions. Users can
similarly allow Meta to search an associated Facebook account
for friends who are also Instagram users. Users can also
manually search for friends or associates.
30. Each Instagram user has a profile page where certain
content they create and share (“posts”) can be viewed either by
19
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.21 Page 21 of 30
the general public or only the user’s followers, depending on
privacy settings. Users can customize their profile by adding
their name, a photo, a short biography (“Bio”), and a website
address.
31. One of Instagram’s primary features is the ability to
create, edit, share, and interact with photos and short videos.
Users can upload photos or videos taken with or stored on their
devices, to which they can apply filters and other visual
effects, add a caption, enter the usernames of other users
(“tag”), or add a location. These appear as posts on the user’s
profile. Users can remove posts from their profiles by deleting
or archiving them. Archived posts can be reposted because,
unlike deleted posts, they remain on Meta’s servers.
32. Users can interact with posts by liking them, adding
or replying to comments, or sharing them within or outside of
Instagram. Users receive notification when they are tagged in a
post by its creator or mentioned in a comment (users can
“mention” others by adding their username to a comment followed
by “@”). An Instagram post created by one user may appear on
the profiles or feeds of other users depending on a number of
factors, including privacy settings and which users were tagged
or mentioned.
33. An Instagram “story” is similar to a post but can be
viewed by other users for only 24 hours. Stories are
automatically saved to the creator’s “Stories Archive” and
remain on Meta’s servers unless manually deleted. The usernames
20
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.22 Page 22 of 30
of those who viewed a story are visible to the story’s creator
until 48 hours after the story was posted.
34. Instagram allows users to broadcast live video from
their profiles. Viewers can like and add comments to the video
while it is live, but the video and any user interactions are
removed from Instagram upon completion unless the creator
chooses to send the video to IGTV, Instagram’s long-form video
app.
35. Instagram Direct, Instagram’s messaging service,
allows users to send private messages to select individuals or
groups. These messages may include text, photos, videos, posts,
videos, profiles, and other information. Participants to a
group conversation can name the group and send invitations to
others to join. Instagram users can send individual or group
messages with “disappearing” photos or videos that can only be
viewed by recipients once or twice, depending on settings.
Senders can’t view their disappearing messages after they are
sent but do have access to each message’s status, which
indicates whether it was delivered, opened, or replayed, and if
the recipient took a screenshot. Instagram Direct also enables
users to video chat with each other directly or in groups.
36. Instagram offers services such as Instagram Checkout
and Facebook Pay for users to make purchases, donate money, and
conduct other financial transactions within the Instagram
platform as well as on Facebook and other associated websites
and apps. Instagram collects and retains payment information,
21
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.23 Page 23 of 30
billing records, and transactional and other information when
these services are utilized.
37. Instagram has a search function which allows users to
search for accounts by username, user activity by location, and
user activity by hashtag. Hashtags, which are topical words or
phrases preceded by a hash sign (#), can be added to posts to
make them more easily searchable and can be “followed” to
generate related updates from Instagram. Meta retains records
of a user’s search history and followed hashtags.
38. Meta collects and retains location information
relating to the use of an Instagram account, including user-
entered location tags and location information used by Meta to
personalize and target advertisements.
39. Meta uses information it gathers from its platforms
and other sources about the demographics, interests, actions,
and connections of its users to select and personalize ads,
offers, and other sponsored content. Meta maintains related
records for Instagram users, including information about their
perceived ad topic preferences, interactions with ads, and
advertising identifiers. This data can provide insights into a
user’s identity and activities, and it can also reveal potential
sources of additional evidence.
40. In some cases, Instagram users may communicate
directly with Meta about issues relating to their accounts, such
as technical problems, billing inquiries, or complaints from
other users. Social networking providers like Meta typically
retain records about such communications, including records of
22
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.24 Page 24 of 30
contacts between the user and the provider’s support services,
as well as records of any actions taken by the provider or user
as a result of the communications.
41. For each Instagram user, Meta collects and retains the
content and other records described above, sometimes even after
it is changed by the user (including usernames, phone numbers,
email addresses, full names, privacy settings, email addresses,
and profile bios and links).
V. PROCEDURES FOR ELECTRONICALLY STORED INFORMATION
42. Federal agents and investigative support personnel are
trained and experienced in identifying communications relevant
to the crimes under investigation. The personnel of Meta are
not. It would be inappropriate and impractical for federal
agents to search the vast computer network of Meta for the
relevant accounts and then to analyze the contents of those
accounts on the premises of Meta. The impact on Meta's business
would be disruptive and severe.
43. Therefore, in order to accomplish the objective of the
search warrant with a minimum of interference with the business
activities of Meta, to protect the privacy of Meta’s subscribers
whose accounts are not authorized to be searched, and to
effectively pursue this investigation, the FBI seeks
authorization to allow Meta to make a digital copy of the entire
contents of the SUBJECT ACCOUNTS. That copy will be provided to
me or to any authorized federal agent. The copy will be imaged
and the image will then be analyzed to identify communications
and other electronic records subject to seizure pursuant to
23
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.25 Page 25 of 30
Attachment B. Relevant electronic records will be copied to
separate media. The original media will be sealed and
maintained to establish authenticity, if necessary.
44. Analyzing the data to be provided by Meta may require
special technical skills, equipment, and software. It may also
be very time-consuming. Searching by keywords, for example,
often yields many thousands of "hits," each of which must be
reviewed in its context by the examiner to determine whether the
data is within the scope of the warrant. Merely finding a
relevant "hit" does not end the review process. Keyword
searches do not capture misspelled words, reveal the use of
coded language, or account for slang. Keyword searches are
further limited when electronic records are in or use foreign
languages. Certain file formats also do not lend themselves to
keyword searches. Keywords search text. Many common electronic
mail, database, and spreadsheet applications, which files may be
attachments, do not store data as searchable text. Instead,
such data is saved in a proprietary non-text format. And, as the
volume of storage allotted by service providers increases, the
time it takes to properly analyze recovered data increases
dramatically. Internet Service Providers also do not always
organize the electronic files they provide chronologically,
which makes review more time consuming and may require the
examiner to review each page or record for responsive material.
45. Based on the foregoing, searching the recovered data
for the information subject to seizure pursuant to this warrant
may require a range of data analysis techniques and may take
24
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.26 Page 26 of 30
weeks or even months. Keywords need to be modified continuously
based upon the results obtained and, depending on the
organization, format, and language of the records provided by
the ISP, examiners may need to review each record to determine
if it is responsive to Attachment B. The personnel conducting
the examination will complete the analysis within 90 days of
receipt of the data from the service provider, absent further
application to this court.
46. Based upon my experience and training, and the
experience and training of other agents with whom I have
communicated, it is necessary to review and seize all electronic
messages that identify any users of the subject account(s) and
any electronic messages sent or received in temporal proximity
to relevant electronic messages that provide context to the
relevant messages.
47. All forensic analysis of the imaged data will employ
search protocols directed exclusively to the identification and
extraction of data within the scope of this warrant.
VI. CONCLUSION
48. Based on the foregoing, I request that the Court issue
the proposed search warrant.
49. Pursuant to 18 U.S.C. § 2703(g), the presence of a law
enforcement officer is not required for the service or execution
of this warrant. The government will execute this warrant by
serving it on Meta. Because the warrant will be served on Meta,
which will then compile the requested records at a time
convenient to it, reasonable cause exists to permit the
25
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.27 Page 27 of 30
execution of the requested warrant at any time in the day or
night.
X
JOSEPH P. HAMER
Special Agent
Federal Bureau of Investigation
Attested to by the applicant in
accordance with the requirements
of Fed. R. Crim. P. 4.1 by
telephone on March 28th , 2022.
DANIEL E. BUTCHER Michael S. Berg
Xxxxxxxxxxxxxxxxxxxx
United States Magistrate Judge
26
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.28 Page 28 of 30
ATTACHMENT A
Meta Platforms, Inc. (Meta) is an Internet Service Provider
headquartered at 1601 Willow Road, Menlo Park, California 94025.
Meta hosts the following electronic communication accounts that
are the subject of this search warrant and application: (1)
Instagram username “matthewtaylorcoleman” (“SUBJECT ACCOUNT 1”),
and (2) Instagram username “lovewater_surf” (“SUBJECT ACCOUNT
2”), collectively the (“SUBJECT ACCOUNTS”).
i
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.29 Page 29 of 30
ATTACHMENT B
I. Service of Warrant
The officer executing the warrant shall permit Meta Platforms,
Inc., as custodian of the computer files described in Section II
below, to locate the files and copy them onto removable
electronic storage media and deliver the same to the officer.
II. Items to be provided by the ISP
All subscriber and/or user information and content, all
electronic mail, images, text messages, direct messages,
histories, searches, phone and VoIP logs, contacts or friend
lists, profiles, method of payment, detailed billing records,
access logs, backup data, transactional data, and any other
files or records associated with the following accounts and
screen name(s): (1) Instagram username “matthewtaylorcoleman”
(“SUBJECT ACCOUNT 1”), and (2) Instagram username
“lovewater_surf” (“SUBJECT ACCOUNT 2”), collectively the
(“SUBJECT ACCOUNTS”).
III. Search of the data
The search of the data supplied by Meta pursuant to this warrant
will be conducted by the FBI and any government personnel
working with the FBI as provided in the “Procedures For
Electronically Stored Information” section of the affidavit
submitted in support of this search warrant and will be limited
to the period of October 1, 2018 to August 10, 2021, and to the
seizure of data, communications, records, or information:
a) tending to show M. COLEMAN’s, A.C.’s, R.C.’s, or K.C.’s
travel inside or outside of the United States;
b) tending to indicate M. COLEMAN’s state of mind, competency,
or coherence in relation to A.C., R.C., K.C., and the
SUBJECT OFFENSE;
c) tending to indicate a plan to commit the SUBJECT OFFENSE or
conceal the commission of the SUBJECT OFFENSE;
d) tending to indicate interest in QAnon, Illuminati, or
conspiracy theories;
e) about the use, purchase, or acquisition of a spear fishing
gun; and
ii
Case 3:22-mj-01124-MSB Document 1 Filed 03/28/22 PageID.30 Page 30 of 30
f) tending to identify the user(s) of SUBJECT ACCOUNT 1 or
SUBJECT ACCOUNT 2;
which is evidence of violations of Title 18, United States Code,
Sections 1119 and 1111, foreign murder of U.S. nationals.
iii
