Professional Documents
Culture Documents
Harold Henthorn Search Warrant
Harold Henthorn Search Warrant
)
)
)
)
)
)
Case No.
14-sw-05039-KLM
SEE ATTACHMENT A, which is attached to and incorporated in this Application and Affidavit
located in the
State and
District of
Colorado
property to be seized):
SEE ATTACHMENT B, which is attached to and incorporated in this Application and Affidavit
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
evidence of a crime;
contraband, fruits of crime, or other items illegally possessed;
property designed for use, intended for use, or used in committing a crime;
a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section
18 USC 1001
18 USC 1111
Offense Description
False Material Statement
Second Degree Murder
) is requested
s/Elizabeth Shott
Applicants signature
Date:
signed in my presence.
submitted, attested to, and acknowledged
wledged by reliable electronic means.
25, 2012
14August
Jan 2014
JJudges signature
Kristen L. Mix
United States Magistrate Judge
Printed name and title
ATTACHMENT A
DESCRIPTION OF LOCATION TO BE SEARCHED
This warrant applies to Internet Protocol, (IP) addresses associated with web browser
search information that is stored at premises controlled by Google, Inc, a web browser provider
headquartered at 1600 Amphitheatre Parkway, Mountain View CA 94043.
IP INFORMATION
ATTACHMENT B
DESCRIPTION OF ITEMS TO BE SEIZED AND SEARCHED
custody, or control of the Provider, all Google browser search entries based on the IP addresses
referenced in Attachment A, between the noted start and stop time.
II.
and instrumentalities of violations of 18 USC 1111, involving Harold A Henthorn from June 30,
2012 through and including July 10, 2013, including information pertaining to the following
matters:
a. The death of Toni Henthorn;
b. The May 2011 incident that resulted in the injury of Toni Henthorn;
c. Any other incidents resulting in injury to Toni Henthorn;
d. The nature of the relationship between Toni Henthorn and Harold Henthorn;
e. Insurance for Toni Henthorn or Harold Henthorn;
f. Insurance policies owned by or benefiting Harold Henthorn;
g. The employment of Toni Henthorn or Harold Henthorn;
h. The finances of Toni Henthorn or Harold Henthorn;
i. Financial profiling of Toni Henthorn or other women known by Harold Henthorn;
j. Research into Rocky Mountain National Park; and
Pursuant to 18 U.S.C. 2703(b)(1)(A) and 2705(b), the Court orders the Provider not to
The Court further orders the Provider to continue to maintain the subject account in an
all records attached to this certificate were made at or near the time of the
occurrence of the matter set forth, by, or from information transmitted by, a person with
knowledge of those matters;
b.
such records were kept in the ordinary course of a regularly conducted business
I further state that this certification is intended to satisfy Rule 902(11) of the Federal
Rules of Evidence.
Date
Signature
information associated with a certain account that is stored at premises controlled by Google,
Inc, a web browser service headquartered at 1600 Amphitheatre Parkway, Mountain View CA
94043. The information to be searched is described in the following paragraphs and in
Attachment A. This affidavit is made in support of an application for a search warrant under 18
U.S.C. 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Google, Inc. to disclose to the
government copies of the information (including the content of communications) further
described in Section I of Attachment B. Upon receipt of the information described in Section I
of Attachment B, government-authorized persons will review that information to locate the items
described in Section II of Attachment B.
2.
I am a Special Agent (SA) with the National Park Service (NPS), United States
Department of the Interior. I am presently assigned to the Intermountain Region, duty stationed
in Denver. I have been employed by the NPS as a Special Agent since 2001. From 1992 until
2001, I was a Law Enforcement Park Ranger with the National Park Service. I have received
specialized training at the Federal Law Enforcement Training Center, completing the Criminal
Investigator Training Program.
3.
The facts in this affidavit come from my personal observations, my training and
experience and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.
Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that violations of Title 18, United States Code, Section 1111,
and Title 18, United States Code, Section 1001, have been committed by Harold A. Henthorn.
There is also probable cause to search the information described in Attachment A for evidence of
these crimes, as described in Attachment B.
JURISDICTION
5.
This Court has jurisdiction to issue the requested warrant because it is a court of
On September 29, 2012, at about 5:54 PM, the Estes Park Police Department
received a 911 phone call from Harold Henthorn (HENTHORN) from his cell phone (303)
246-4475, stating he was in Rocky Mountain National Park off the Deer Mountain Trail, and his
wife Toni Henthorn had fallen off a cliff and needed Alpine Rescue. There were no other
witnesses. The area where the fall occurred is a remote back country location within the exterior
boundary of Rocky Mountain National Park in the District of Colorado. The call was transferred
to the National Park Service (NPS) dispatch center.
7.
Using the same cell phone, HENTHORN contacted his brother-in-law Barry
8.
HENTHORN continued a text dialog with Bertolet, and when Bertolet requested
if he needed help, HENTHORN replied H, which he took to mean, yes get help. Bertolet
contacted NPS dispatchers and talked with them until EMS arrived on scene
9.
At about 6:25 PM HENTHORN text messaged Barry Bertolet, Pulse 60, Resp
11.
At about 6:39 PM, Bertolet text messaged HENTHORN and told him help is on
5.
the way and asked, what is status to which HENTHORN replied, no min pulse.
12.
A review of call logs from HENTHORNs cell phone and recordings from NPS
dispatch showed that at about 6:39 PM, HENTHORN called the NPS dispatch to tell them he
started a fire and asked about when to start CPR. NPS dispatch requested Estes Park Police
Department dispatch to do a CPR protocol with HENTHORN while on the phone.
13.
14.
HENTHORN called NPS Dispatch at 7:17 PM, and again at 7:22 PM. The
Bertolet text messaged back at 7:25 Maybe still there. Keep on with CPR. HENTHORN
replied with a text message to Bertolet at about 7:25 PM, Y.
17.
At about 7:31 PM, HENTHORN called the number 303-791-2696, also belonging
19.
belonging to Barker, Can you get Steve t and drive to estes pk.
22.
At about 7:35:02 PM, the text continued from HENTHORN to Barker, ASAP.
23.
24.
need.
26.
27.
28.
At about 7:36:43 PM, HENTHORN text messaged Barker, Call 911 when you
arrive.
29.
At about 7:36:53 PM, Barker texted back to HENTHORN, 911? and then Oh
30.
At about 7:37:16 PM, HENTHORN text messaged Barker, Tell me your eta.
31.
32.
At about 7:37:47 PM HENTHORN text messaged back to Barker, Flight for life
crap.
requested, then Y.
33.
At about 7:41 PM, HENTHORN called the NPS dispatch to verify if they had his
35.
At about 7:55 PM, HENTHORN called the NPS and talked for 115 seconds and
asked for the status of the responding ranger. HENTHORN told the NPS dispatcher if the ranger
told HENTHORN where the ranger was, HENTHORN could direct the ranger to HENTHORNs
location. HENTHORN then gave his latitude and longitude coordinates and description to the
dispatcher. HENTHORN then told the dispatcher his battery was low and requested the
dispatcher to text him with the ETA of the ranger and hung up.
36.
10 min out.
37.
At about 8:01 PM, HENTHORN called the NPS. The call was picked up by the
Incident Command Post on an unrecorded line. The call lasted for about 90 seconds.
38.
I reviewed the reports from Law Enforcement Ranger Faherty and have spoken to
him during the investigation. He told me when he arrived on scene it was dark, but he saw
HENTHORN was at the base of an approximately 120 foot cliff, and had a small fire going. I
verified sunset was at 6:44 PM on that day.
40.
Law Enforcement Ranger Faherty told me HENTHORN met him at the edge of
the ledge about 10 feet from where Toni Henthorn was lying supine. HENTHORN walked over
to Toni Henthorn and did some chest compressions as Law Enforcement Ranger Faherty
prepared his EMS gear. At that time he asked HENTHORN to move and assessed Toni
Henthorns condition, and determined her pupils were fixed and dilated with no pulse.
41.
At about 8:12 PM, Law Enforcement Ranger Faherty reported that Toni Henthorn
about 8:23 PM, Steve Tokarski text messaged HENTHORN, Harold Steve here. Jack & I r
northbound 225. Where do we go. We are praying & church praying too.
43.
At about 8:26 PM, HENTHORN text messaged Steve Tokarski back, Estes,
Via Lyons.
44.
did not want to leave his wife and was going to stay with Tonis body overnight. Law
Enforcement Ranger Faherty told HENTHORN he should take care of himself and hike out.
HENTHORN mildly protested but hiked out with Faherty.
45.
Toni Henthorns backpack was recovered with her body. I reviewed the contents
of her pack and her clothing and there were no light sources located in the backpack or any
house at 9205 S. Sand Hill St., Highlands Ranch, CO, for a follow up interview.
48.
HENTHORN and spoke to him several times during the investigation and learned in part the
following:
a.
When he walked into the house HENTHORN excused himself and turned on a
slide show on a computer next to him, complete with music that featured photos
of himself, Toni and their daughter Haley Henthorn.
b. HENTHORN appeared to be grieving but did not cry or show as much emotion as
he did immediately following the fall.
c.
d. HENTHORN told him he had been on the Deer Mountain trail before and the last
time was 2 to 3 months prior on a scouting trip to locate the best trail to take
Toni on the anniversary trip. HENTHORN said he used a topographical map, not
a park map, to plan the hikes.
e. HENTHORN told him their original plan on September 29 was to hike in the Bear
Lake area, but they changed their plan to hike up Deer Mountain Trail because it
was very busy in the park.
f. HENTHORN stated they started the hike around 1:30 to 1:45 PM and at a point
where the trail leveled off, they reached a use trail leading north from the Deer
Mountain trail. HENTHORN said they wanted to find a romantic spot for views,
and to be alone. They reached a rocky knob on the top of the ridge where they
Law Enforcement Ranger Faherty later contacted Nickis Steakhouse and was
told there was an anniversary dinner reservation for 7:00 PM for a party of 2 under the name
Henchorn but nothing for 8:00 PM for HENTHORN.
50.
after Toni Henthorn died, HENTHORN told her he had taken six different hikes at Rocky
Mountain National Park, about two weeks before, trying to find the hike to take Toni on their
anniversary weekend. HENTHORN told her he planned every minute of their trip.
51.
On December 21, 2012, FBI Special Agent Chris Calarco and I interviewed Katy
Carvill, the Henthorns babysitter who was taking care of Haley on September 29, 2012. Carvill
told us the soccer game the Henthorns daughter played in on September 29, 2012, ended at
about 3:00 PM, and she sent a text message to HENTHORNs cell phone around 3:00 PM with a
picture of her with their daughter Haley telling him they won the game. She did not receive a
reply text. A review of text records from Verizon showed the message delivered time to
HENTHORNs phone was 5:54 PM.
52.
HENTHORN left a green 1998 Jeep Grand Cherokee Laredo with Colorado
license #RDR478 at the Deer Mountain trail head and left the keys with the National Park
Service Rangers so they could secure his vehicle in a safe location. On September 30, 2012, the
vehicle was impounded by Rocky Mountain National Park Rangers, and as per the parks
standard operating procedures, an inventory of the contents was performed by Law Enforcement
Ranger Carmen Selent and the vehicle was secured in a garage bay within Rocky Mountain
National Park.
53.
I reviewed the report by Law Enforcement Ranger Selent and spoke to her during
HENTHORN about the map, HENTHORN appeared at a loss for words and told him it was his
map but it was not from the September 29, 2012, trip. HENTHORN could not explain why there
was an X on the map near the site of the fall.
55.
I spoke with Barry Bertolet on October 22, 2012, who told me on or around
October 19, 2012, HENTHORN told him Ranger Faherty asked about the map. HENTHORN
told Bertolet the following:
a. HENTHORN had scoped the trail out a couple days before taking Toni out there.
b. He had no idea about the map or that the map was in his car.
c. HENTHORN didnt remember making the map or why and said it may have been
a map he made for his nephew Daniel Jarvis, who stayed with them a couple
years ago.
56.
On October 2, 2012, the NPS and the Larimer County Coroners Office received
an anonymous letter stating HENTHORNs wife from 17 years ago died in a suspicious accident
where HENTHORN was the only witness and to, Please thoroughly investigate the death of Dr.
Toni HenthornSadly there are many similarities to these two accidents.
57.
Subsequently the National Park Service, Estes Park Police Department, Larimer
County Sheriffs Office and Coroners Office and the Department of Homeland Security
received a total of 16 calls and letters between October 1, 2012 and October 24. 2012, requesting
the death of Toni Henthorn be investigated or to express concerns about Toni Henthorns death.
58.
On October 23, 2012, Law Enforcement Ranger Faherty and I hiked the Deer
Mountain Trail in the area described by HENTHORN and could not find the use trail,
described by HENTHORN. There were several areas where the soil had drained into the trail.
We followed those drainages until they disappeared. None led directly to the upper rock knob
described by HENTHORN.
59.
We hiked to the first knob area described by HENTHORN. From this vantage
point I observed a steep talus slope leading down from the rock outcropping. The area is very
secluded and the upper rock outcropping is not visible from the trail. To reach the upper rock
outcropping we had to hike through lodge pole pines and mixed conifer woods, which held
downed trees and other natural obstacles. The location is about .24 miles from the trail.
60.
I observed the steep talus slope leading down to the second knob described by
HENTHORN, where Toni Henthorns body was recovered below. The rocky slope was steep
and required careful navigation. The area where Toni Henthorn fell from was an uneven rocky
area with a small pine tree growing from the edge and small up thrust rocks at the edge of the
cliff. The top of the second knob had room to move about freely and easily accommodated Law
Enforcement Ranger Faherty and myself and our gear.
61.
After reaching the top of the second knob, I identified the small pine tree on the
cliff above where Toni Henthorns body was recovered and compared it to the one as seen in the
picture of HENTHORN from the camera recovered with Toni Henthorns body. The tree
appeared to be the same tree in the pictures.
62.
I hiked down the steep slope to the area where Toni Henthorns body was
recovered. The slope had to be navigated carefully due to the steep terrain and natural obstacles.
I timed the hike back up to the top of the cliff where Toni Henthorn fell, which took less than 10
minutes.
63.
I hiked out in good lighting from the incident location and back to the trailhead in
Toni Henthorns parents told me Toni had bad knees and had several surgeries.
told me Toni had bad knees. She said Toni would go on walks, not climbs. She also told me
Toni is a very cautious person with humongous responsibilities.
66.
October 1, 2012 interview with HENTHORN, HENTHORN told him there was a $1.5 million
Life Insurance Trust in Toni Henthorns name, and that Tom Scheffel was the attorney for the
trust and HENTHORN was the trustee. The trust was for their daughter, Haley Henthorn.
67.
I contacted Tom Scheffel, who confirmed there is a Life Insurance Trust for $1.5
million with Harold HENTHORN as a trustee and the trust to go to their daughter, Haley
Henthorn. Neal Creswell was the agent who brokered the policy. Neal Creswell confirmed the
policy was with ING-Reliastar.
68.
following:
a. There is a $1.5 million life insurance policy with American General Life
Insurance on Toni Henthorn with Harold HENTHORN as the beneficiary taken
out in 2001, shortly after they were married.
b. There are no insurance policies on Harold HENTHORN with American General
Life Insurance.
c. There is another life insurance policy on Toni Henthorn with Genworth Financial
for $1.5 million, which was created in 2005.
d. On May 11, 2011, the beneficiary for the Genworth Financial life insurance
policy was changed from Harold HENTHORN to the Harold A. Henthorn &
Toni B. Henthorn Trust.
e. There are no current insurance policies on Harold HENTHORN with Genworth
Financial.
f. Tom Sheffel told me he also set up a $1 million dollar trust in Harold Henthorn's
name with Haley Henthorn as the beneficiary. Neal Creswell told me there was a
policy on HENTHORN with ING Reliastar.
with AXA Equitable Life Insurance. Toni Henthorn listed Haley Henthorn as the beneficiary in
the initial paperwork.
70.
71.
weekend 2011, while working at their cabin at Grand Lake, Colorado, a 20 foot beam fell on
Toni Henthorn, cracking her vertebrae. Toni Henthorn told Yvonne Bertolet she was called
outside by HENTHORN from where she was inside. When she came outside she saw something
on the ground and bent over. At that time the beam hit her. She told her mother if she hadnt
bent over when she did the beam would have killed her. The only witness to the accident was
HENTHORN. On April 3, 2013, I spoke with SA Calarco about an interview he conducted of
Andrew Sullivan on March 18, 2013. SA Calarco provided, in part, the following information
A review of the paperwork from Grand County Emergency Services indicated the
time of the ambulance call was 22:09 PM Mountain Time, and the cause of injury was due to a
6x2 piece of plywood which she was struck by when her husband was chucking the plywood
over the deck.
74.
Transcripts received from Swedish Hospital in Denver, the hospital where Toni
spotlight. She was outside with her husband cleaning up. She was under the deck
bending over to pick up glass. Her husband was on the deck. A 20 foot 2x4 fell
off the deck about 10 feet, striking her on her shoulder blades.
b. After she was struck she got instant severe numbness over her entire body and did
not recall how she ended up lying on the ground. Records indicate HENTHORN
told the doctor he assisted Toni to the ground.
75.
As a result of the accident, Toni Henthorn sustained paresthesia to her left index
76.
On October 12, 2012, I interviewed both of Toni Henthorns parents and her
finger.
e. After the beam incident she feared for Tonis safety. She did not think
HENTHORN would kill her but did fear he would hurt her.
f. HENTHORN was controlling of Toni and would not allow her to have long
distance minutes on her cell phone to call them.
g. HENTHORN would not let them speak alone on the phone and whenever they
would call Toni, HENTHORN would return the call, and if Toni was on the call it
was usually on speakerphone with her in the background.
77.
78.
one year prior to her death. According to Dr. Stewart Frankel, one of the partners of the
business, they would be paying back about $186,000 to HENTHORN because Toni never signed
the life insurance paperwork for the business.
79.
Toni Henthorns monthly salary was about $9,800, according to Dr. Frankel.
80.
Toni Henthorns 2011 tax return showed she made $114,236 in wages from
Associates in Eyecare.
81.
nonprofits. On December 21, 2012, I was given a photo of a business card of his by one of
HENTHORNs friends, Cathy Lynch, which stated Development Services, Inc. Not for profit
Fund Raising. The card listed an address of 9205 S. Sand Hill Street, Suite 200, Littleton, CO
(HENTHORNs home address) as the address and an email of [email protected] as the
business email. Next to Harold HENTHORNs name on the card was CFRE.
82.
I confirmed with Certified Fund Raising Executives they were the only
organization that had a CFRE certification, and HENTHRON had never received or applied for a
certification with them.
83.
Barry Bertolet told me HENTHORN travelled a lot for his work but could not tell
me the name of his business or who his clients were. During Toni Henthorns memorial in
Colorado, none of her family met any co-workers or clients of HENTHORNs and dont believe
anyone related to his work came to the service.
84.
On December 21, 2012, FBI Special Agent Chris Calarco and I interviewed the
A review of tax returns from 2005 through 2011 showed HENTHORN did not
claim any income, nor did he claim any loss of income, from his business Development
Services, Inc. There were no references to Development Services, Inc. on any of the tax
returns, nor any businesses affiliated with HENTHORN. All wages listed were Toni Henthorns.
86.
State of Colorado for Development Services, Inc, with HENTHORN as the registered agent,
nor find any business with HENTHORN as the owner.
87.
On October 22, 2012, I interviewed Allison Talley and learned in part, the
following:
a.
Talley was a friend of Tonis from Mississippi and remained friends after Toni
and HENTHORN moved to Colorado. Talley told me HENTHORN called her on
September 24, 2012. She found the call strange and made notes from it. Talley
told me the following:
b. HENTHORN told her he was planning the surprise trip to Estes Park for the next
weekend.
b. He told her he was pursuing an account in Albuquerque, New Mexico, but did not
tell her who the account was with.
c. HENTHORN told her Toni wasnt making any money, and no doctor in Colorado
makes more than $50,000. He told her he wanted Toni to quit.
d. She thought Toni was making good money and did not know why HENTHORN
said that.
e. HENTHORN also lied to her about Tonis family not calling Toni on her 50th
birthday. She knew they called her but again did not know why he lied.
f. At the end of the call, she had an intuition Toni was going to take Haley and leave
HENTHORN.
88.
On October 3, 2012, I interviewed Linda Rankin who told me, in part, the
following:
a. Rankin has known HENTHORN for about 35 years.
b. On September 27, 2012, she spoke to HENTHORN who told her he was unhappy
Toni was going to have to pay into Obamacare and was basically going to have
to work for free.
b. HENTHORN told her during the same conversation that he was currently in Las
Vegas bidding for a job.
c. HENTHORN was always flying around for work, fundraising for hospitals and
churches, and did quite well.
d. HENTHORN told her he was unhappy Toni had a business so far away from
home and wanted her to work closer.
89.
On October 17, 2012, I interviewed Ginger Wilson, who worked for Toni
Henthorn in Mississippi. Wilson told me that before Toni married him, HENTHORN had told
her he had created financial profiles of three women he was dating and after asking some of his
friends which one he should marry, decided on Toni.
90.
Between October 10, 2012 and January 11, 2013, I spoke several times with Barry
Bertolet. Bertolet is the brother of Toni Henthorn and lives in Mississippi. During the incident,
HENTHORN was texting him about Tonis condition. Bertolet, in part, told me the following:
a. After the incident, HENTHORN told Bertolet regarding the incident that cell
coverage was poor and he had to move away from the area up and down the rocks
to text him.
b. Bertolet was surprised when he learned Toni had died from shock and had been
bleeding profusely. As a doctor, he knew that as someone becomes hypovolemic,
they become tachycardic and respirations increase, not decrease, which is what
HENTHORN told him happened. He got from HENTHORNs text message that
Toni was actually not doing that bad since her pulse and respirations were not that
far from normal.
c. Bertolet told me that on or around October 19, 2012, he spoke with HENTHORN
who changed his story and told him Toni had a high heart rate of 110 to 115 and
respirations of 5 to 11 after she fell, but never mentioned she was bleeding.
d. HENTHORN initially told him during the incident, he received a text about his
daughter Haley winning a soccer match when he saw a blur, looked up and saw
Toni was gone and had fallen from a 24 foot cliff.
e. HENTHORN called him on October 11, 2012, and changed his story to he was
looking for a text message about his daughter Haley getting to the babysitters
house.
f.
HENTHORN told other family members the same thing about looking for a text
about Haley winning a soccer game, and then later changed his story that he was
looking for a text that Haley got to the babysitters house.
91.
During the weekend of October 20, and 21, 2012, while HENTHORN was in
Mississippi for Toni Henthorns memorial service, he asked to meet with Barry and Todd
Bertolet. I spoke with both Barry and Todd Bertolet on October 22, 2012, via speakerphone and
they provided me, in part, the following information:
a. HENTHORN told them Ranger Faherty was irritated about his statement about
looking at a text which came when Toni fell. Ranger Faherty told HENTHORN,
no you werent, the text came in 30 minutes after your call to rescuers.
b. HENTHORN told the Bertolets he misspoke and he was looking for texts from
Tonis hospital as she was on call. HENTHORN went on and on about the
hospital text messages to Barry and Todd Bertolet and how Toni had traded on
call duty with someone else.
c. HENTHORN told their parents while he was in Mississippi for Toni Henthorns
service, on or around October 19, 2012, he was indicted in Colorado and was
expecting to be arrested when he returned home. HENTHORN told their parents
he expected to be in jail for 2 weeks waiting for a bail hearing, and he had found
someone to take care of Haley.
d. During the meeting with HENTHORN, during the weekend of October 20 and 21,
2012, he also told them he was being investigated and told them Ranger Faherty
had a vendetta against him.
e. HENTHORN told them Ranger Faherty asked him about the park map. He told
the Bertolet brothers he had scoped out the trail before taking Toni out to it but
had no idea about the map or that the map was in his car. He may have made the
map for his nephew Daniel Jarvis.
f. HENTHORN told them he thinks he is in trouble based on the rogue ranger
who has a vendetta against him.
g. HENTHORN asked them about the oil interests in Tonis name and if they were
coming to him as, it would look bad for him, if he got that money. They asked
him twice if there was a will to which he would not reply. HENTHORN never let
them know about Tonis will but later told them the money from the will was all
Toni Henthorns cell phone was left at her office during the weekend of
September 29, 2012 and was later retrieved on October 1, 2012 by a friend. I reviewed the calls
for Toni Henthorn from Contact One Call Center, her answering service for work. There were
no calls made to Harold HENTHORNs cell number nor were there any text messages sent to
either her phone or his cell phone.
93.
A camera was recovered with Toni Henthorns body. The camera was smashed
but the SD card was removed from the camera and the pictures were reviewed by Law
Enforcement Ranger Faherty, who later gave copies of the pictures to HENTHORN on October
1, 2012.
94.
Using a SD card write blocker, I reviewed the SD card recovered from Toni
Henthorns camera. Recovered data with the photos showed a date and time stamp of the last
photo to be September 29, 2012 at 5:00:30 PM and was a picture of HENTHORN standing on
the edge of a cliff next to a small pine tree. There were no pictures of Toni Henthorn at the
lower knob location where she fell.
95.
Whitener was friends with HENTHORN from when he married his wife, Myra, who knew
HENTHORN from grade school. Whitener told us, in part, the following;
a. He and his wife would spend extended vacation times with the Henthorns, but he
never saw a lot of openness between Toni and HENTHORN during their
marriage.
b. During the reception after the service for Toni Henthorn in Mississippi on
October 19, 2012, HENTHORN went into a litany about how he was in a bind
and he was in a legal situation which was a tangle for him.
c. HENTHORN told him he was being investigated for the death of Toni and the
people investigating him were being too zealous and he had to get an attorney.
It was obvious that it occupied HENTHORNs mind and time. He looked
distraught and under pressure.
d. HENTHORN told him he was being investigated for killing Toni, however he
never said he didnt kill Toni during their conversation. It tormented Whitener
that HENTHORN did not deny killing Toni.
e. HENTHORN told him he was being investigated because the ranger was
overzealous.
f. HENTHORN appeared more distraught he was being investigated than over the
death of his wife. It troubled him HENTHORN didnt say anything about losing
his wife or show remorse over her death. He didnt cry or seem to be in
mourning.
g. The HENTHORNs marriage wasnt a democracy, it was more like a dictatorship
with HENTHORN as the dictator. HENTHORN would tell Toni to do this, or
get my stuff for me. Toni would rarely challenge HENTHORN. When she did,
HENTHORN would overrule her. He didnt see HENTHORN having a lot of
concern for Toni to have a say in things.
96.
On April 19, 2013, SA Chris Calarco and I interviewed Jack Barker, a friend of
97.
Protocol (IP) address used at the residence 9205 S. Sand Hill St. Highlands Ranch, CO. Century
Link provided IP addresses assigned to the computers at the residence of HENTHORN, 9205 S.
Sand Hill St. Highlands Ranch, CO, between June 30, 2012 and June 30, 2013.
98.
I know through training and experience, when a user logs onto a computer and
then accesses the internet, the Internet Service Provider (ISP) such as Century Link, provides that
computer with an Internet Protocol (IP) Address. An Internet Protocol (IP) address is a
numerical identification (logical address) that is assigned to devices participating in a computer
network utilizing the Internet Protocol for communication between its nodes. A node can be a
computer or some other device such as a printer. The Internet Protocol also has the task of
routing data packets between networks, and IP addresses specify the locations of the source and
destination nodes in the topology of the routing system, i.e.: it is the address for information to
be delivered to, or sourced from, similarly like a physical address on a house allows a mailman
to deliver a package to the correct location.
99.
Your affiant knows that an IP address can help identify the originating source on
the internet or the destination source on the internet based on the "address" or the numerical
notations of the IP address. Century Link maintains and assigns IP addresses to its users, so that
data on a network knows the address it came from and needs to go to. These IP addresses are
dynamic and can change every time a user logs onto the web. Century Link maintains a log of
these IP addresses and where and when they were assigned. The information provided by
Century Link pursuant to the subpoena served on it, specifies the IP addresses assigned to the
residence 9205 S. Sand Hill St. Highlands Ranch, CO during the requested date range. With the
IP address information, Google, Inc., can access its own records that would show if any Google
searches were run from that IP address during those specific dates and times. The IP addresses
provided by Century Link does not provide which computer the IP address was assigned to; it
provides the IP address for the residence itself.
100.
Through my training and experience I know users can remove traces of internet
history from their computers using third party applications, or through deleting data files used by
the internet browser, such as Internet Explorer, manually.
101.
I know Google is one of the most popular internet search engines in the United
102.
Through research I know that even if a user is not signed in, Google still keeps
States.
track of data from its products. Google, Inc notes what IP address the user is using when they
connect to Google, and uses that information to generate the users location. Although most IP
addresses dont identify a particular location, they can get a general area.. Users cannot turn off
Googles efforts to assess their location by IP address.
103.
Google will also store search strings, note what search results and advertisements
the user clicks, and keep track of what videos the user watches, even if the user is not logged in;
the information is stored with an anonymous cookie instead of an account. If the user then logs in
to a Google account while that anonymous cookie is on the users browser, Google can then tie
the two together.
104.
A browser cookie is a small piece of data sent from a website and stored in a
user's web browser while the user is browsing that website. Every time the user loads the
website, the browser sends the cookie back to the server to notify the website of the user's
previous activity
105.
within National Parks on the internet using a web browser for various reasons.
106.
Through training and experience I know individuals will utilize the internet to
research crimes and even how to avoid getting caught conducting those crimes.
107.
Through training and experience I know Google, Inc. may have search history for
HENTHORN conducted on their web browser GOOGLE, and that search history, while it may
be wiped from his home computer, may still exist with Google, and may be verified through the
IP addresses issued by Century Link.
108.
On April 10, 2013, I received a warrant to seize and review computers recovered
from HENTHORNs residence at 9205 South Sand Hill St, Highlands Ranch, CO. On October
30, 2013, I observed three of the four computers had an internet use history, and two of the three
computers had an internet start page of Google.
109.
During the April 10, 2013, search warrant, a printed page from a website showing
HENTHORNs reservation at the Stanley Hotel for the weekend of September 28, 2012, was
recovered.
110.
I conducted a keyword search of the word Stanley on the internet histories of all
three computers. None of them showed any history of the Stanley Hotel reservation.
111.
One computer, a Lenovo, did not have any internet use history prior to January
27, 2013.
CONCLUSION
112.
Based on the forgoing, I request that the Court issue the proposed search warrant.
Because the warrant will be served on Google, Inc. who will then compile the requested records
at a time convenient to it, there exists good cause to permit the execution of the requested
warrant at any time in the day or night.
113.
I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation that is neither public nor known to the
target of the investigation. Accordingly, there is good cause to seal these documents because
their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
s/Elizabeth A. Shott
Elizabeth A. Shott
Special Agent
National Park Service
January 14, 2014
____________________________,
2014.
Subscribed and sworn to before me on ______
_
_________________________________________
_____________________________________
UNITED STATES MAGISTRATE JUDGE
Application for search warrant was reviewed and is submitted by Valeria Spencer,
Assistant United States Attorney.