Swallow warrants went to Google, Yahoo and Apple
Investigators in the ongoing criminal probe of former Utah Attorneys General John Swallow and Mark Shurtleff are wading through what appears to be a massive amount of data obtained through a series of sweeping search warrants.
That information may include emails and other evidence lost or deleted from Swallow's accounts data legislative investigators spent considerable time and money trying to recover.
Criminal investigators are taking a decidedly different tack than that of House investigators. Rather than target specific issues on particular accounts, they appear to have amassed vast caches of records from Internet and cellphone companies digging through mountains of files.
"It's a huge amount of data that we're going through," said Salt Lake County District Attorney Sim Gill. "But it's not just the recovery of the data and getting that consistent with what we're trying to do, but also the Herculean task of sifting through it â¦ [and] trying through our investigative process to be as fair and respectful of the judicial and legal process as we can be."
This painstaking process could explain why there has been little public movement in recent months in the probe being conducted by Gill, Davis County Attorney Troy Rawlings, FBI agents and the Utah Department of Public Safety.
Swallow's attorney, Rod Snow, said he is growing concerned with the breadth of the probe and fears investigators may be casting such a wide net because they are trying to build a case instead of just uncover the facts.
"Investigators who are bent on making a case as opposed to learning and presenting the facts to the prosecuting authorities often lose their objectivity, and that's not good and often results in due-process violations," Snow said. "I am not saying that has happened here, but I'm beginning to fear that it may be happening."
A judge issued 11 search warrants, allowing investigators to obtain records from several cellphone companies and, more significantly, computer giants Google, Yahoo and Apple.
The responses have varied, but with Apple's warrant, for example, court records show investigators sought Swallow's entire iCloud backup, his complete email history, plus calendar items, messenger chats, photographs and billing information.
Court documents show Google provided email account information, chat logs, stored photos, contact lists, calendar entries and documents for numerous individuals, including Swallow, Shurtleff, their former campaign consultant Jason Powers, a Powers employee and Shurtleff confidant Tim Lawson.
Cellphone companies turned over call records, voice-mail messages, cell tower tracking data, text messages and billing information for Shurtleff and former Chief Deputy Attorney General Kirk Torgensen. Agents also confiscated Torgensen's iPhone in January to recover data from that device.
Snow said he was never notified about the warrants. Such notice, he said, would add fundamental fairness "since it is their privacy being invaded."
The data dumps are so broad, according to court records, that investigators have set up a team of to 10 to 15 FBI attorneys to sort through the information and determine what might be useful. The "taint team," as it is called, also weeds out records that might be subject to attorney-client privilege or other protections.
Snow said he doesn't like using a "taint team" approach, because it still ends up being government agents screening the information.
"Privileged material must be screened," Snow said, "but there are better ways to accomplish the screening that are more comprehensive and fair than a government taint team."
Reconstructing the data has proven to be challenging, since unknown volumes of Swallow's records were lost or deleted.
The House committee spent tens of thousands of dollars trying to recover that data. The panel found that large amounts, including email and calendar entries, were deleted from Swallow's office accounts. Information was deleted or lost from hard drives on two office computers, his office iPad, his office cellphone and his personal cellphone. The former attorney general also lost a campaign iPad in a cab and a backup computer hard drive on a plane. His home computer crashed, although the committee recovered most of that data.
While House investigators obtained subpoenas for email records on specific issues and tried to recover data lost on the computers, those working with Gill and Rawlings went straight to the Internet companies.
House investigators collected tens of thousands of pages of records, according to the final report. They also shared all of their information with the criminal investigators.
It remains unclear what the broader tactic employed by Gill and Rawlings has yielded and how much overlap there may be with the House material.
"The support from our law enforcement partner agencies has been essential," Gill said. "The amount of work that has been taken on by all the partners in this investigative collaboration has been tremendous."
Gill had previously said the investigation will likely stretch into this summer as prosecutors wade through the information they've gathered.
So far, Lawson is the only individual charged in the probe.
He faces six felonies accusing him of evading taxes, retaliating against witnesses, obstructing justice and a pattern of unlawful activity.
The search for data
• Investigators served warrants Nov. 27 on AT&T Wireless, Cricket Communications and Apple for subscriber and call records, text messages, voice and data usage logs, and subscriber account information for phones belonging to former Attorney General Mark Shurtleff, his confidant Tim Lawson, and former Chief Deputy Attorney General Kirk Torgensen.
• A search warrant was issued Dec. 11 to Apple for information from former Attorney General John Swallow's email account; login records and IP addresses; chats, documents, contact lists, photos, calendars and other stored files; any information stored in the iCloud or backup accounts from any time since 2009. The company provided some data Feb. 6, but it appears Apple may not have provided all the information investigators sought.
• Investigators served a search warrant Dec. 11 on Google Inc. The company turned over a long list of documents, including email histories, saved files, account information, calendar entries, contact lists and photographs for numerous accounts, including Shurtleff, Swallow, Lawson, campaign consultant Jason Powers, as well as several campaign staffers. The list of the general types of files turned over for each of the various accounts fills several pages.
• A warrant was issued Dec. 11 to NetZero for various email records from a Lawson account. That account was purged in 2010, and the company could provide only basic subscriber information.
• Investigators were granted a warrant Dec. 11 to obtain records belonging to Powers' Guidant Strategies, as well as Guidant-related records in Yahoo's possession. Yahoo reported it had no records, and the warrant could not be served on Guidant.
• Warrants were issued Dec. 11 to AT&T and Sprint, which provided logs of voice, text and data usage; billing information; and cell tower location data for phones belonging to Lawson and Swallow.
• Investigators served a warrant Dec. 11 on Yahoo for material from Lawson's account. Yahoo provided user data; subscriber information; dates, times and IP addresses for logins; messenger friend lists; a snapshot of email account contents for last year; address book contents.
• When police arrested Lawson on Dec. 12 at his home, they also seized numerous items, including a slew of computers, data storage devices, CDs, documents, phones, flash drives, bank records and an iPad. The investigators obtained a warrant on Dec. 17 to search the contents.
• Investigators served warrants Dec. 17 on Verizon Wireless and AT&T for text messages, subscriber data, call and cell tower location records for cellphones belonging to Lawson and Shurtleff.
• A judge approved a search warrant Jan. 10 to seize Torgensen's iPhone after he balked at turning it over to investigators voluntarily.
• In response to a Jan. 10 search warrant, Apple provided contents Feb. 25 of the full backup file from the iCloud service, including photos, voice messages and applications for cellphone numbers belonging to Shurtleff and Torgensen.