Dozens of newly released search warrants in the investigation into November’s University of Idaho homicides reveal for the first time how law enforcement pursued and developed evidence that led to the arrest of suspected killer Bryan Kohberger.
Based on an Idaho Statesman analysis, the hundreds of pages of redacted warrants and warrant returns, as well as Latah County prosecutor case filings to keep them all under seal, span some of the biggest companies in social media, shopping, banking and telecommunications.
Filings include Google, Apple, Walmart, Amazon and Meta — parent company of Facebook and Instagram — detailing the path police took in piecing together the four victims’ whereabouts, and learning more about the 28-year-old graduate student allegedly behind the stabbing deaths on Nov. 13.
Four days after discovering the bodies of U of I students Kaylee Goncalves, Madison Mogen, Xana Kernodle and Ethan Chapin at an off-campus rental home on King Road in Moscow, police expanded their hunt with legal demands for phone and area cell tower data, the trove of records showed. Moscow police forensic detective Lawrence Mowery, a four-year member of the force with a dozen years in law enforcement, took the lead on filing nearly 70 warrants over three months — most recently in late January.
Investigators began by serving search warrants to AT&T, Verizon Wireless, T-Mobile and Inland Cellular — a regional carrier that operates in north-central Idaho and southeastern Washington. They sought a history of all the devices that pinged cell towers within a half-mile radius of the Moscow home between 3 a.m. and 5 a.m. on Nov. 13. They received the bulk of the data within just a couple of days and began to pore over the GPS coordinates of cellphones and other devices on the nearby networks in the early morning time frame.
Police would later state, in a probable cause affidavit to obtain a warrant for Kohberger’s arrest, that his cellphone did not use the cell towers near the King Road home during those 2 hours. Investigators alleged that Kohberger did this purposefully “to avoid alerting law enforcement” that his cellphone was near the crime scene.
“Individuals can either leave their cellular telephone at a different location before committing a crime or turn their cellular telephone off prior to going to a location to commit a crime,” read the affidavit signed by Moscow police Cpl. Brett Payne. A national telecommunications expert previously told the Statesman it would be impossible to know whether someone turned off their phone for a period, unless they received a call and records showed it went directly to voicemail.
Law enforcement’s information gathering continued during the homicide investigation’s first week, shifting to the credit card purchase and financial transaction histories over roughly three months for the four victims and three individuals whose names were redacted from the records.
Goncalves, Mogen and Kernodle were roommates in the off-campus house along with two other women who went unharmed in the knife attack, and a sixth roommate who police said no longer lived in the home. Chapin and Kernodle were dating, and he was staying at the house for the night.
Police sent search warrants to Bank of America, Umpqua Bank, PayPal/Venmo and the parent company of point-of-sale service Square, with FBI agent Michael Douglass, a financial specialist, helping to acquire the data, the records showed. Mowery also requested exterior surveillance footage from the Umpqua Bank branch on Washington Street in downtown Moscow, located about a half-mile from where Goncalves and Mogen were out late on the night of their deaths, and about 1,000 feet from a popular food truck parked downtown, where they stopped for a to-go order of macaroni on their way home, according to police.
A week later, police sent more search warrants for the victims’ financial transaction information to several other banks and credit card companies: Wells Fargo, American Express, Discover, Washington’s Banner Bank, and three credit unions. They widened their demand to include two more people whose names were redacted for a total of nine account holders, including the four victims.
While serving warrants for initial financial transaction histories, investigators also sent warrants to Apple, Meta and Snapchat for the four victims’ account information. From Snapchat, police obtained the data from Aug. 1 through a week after their deaths. From Apple, they obtained each victim’s iCloud account information over that same period. From Meta, police received Facebook and Instagram account information from August to November for the four victims, plus three other people whose names were redacted.
Several other search warrants from November to January, including to Apple, Google, AT&T and Verizon, offer no information at all. They were immediately sealed and remain so.
Early search for weapon
In the first week of their investigation, police had already begun trying to discover who might have bought a Ka-Bar brand combat-style knife, with a leather sheath, that they suspected was used to kill the four students.
The Statesman was first to report that police had visited Moscow hardware stores and other local retailers asking about recent sales of Ka-Bar knives, and police later disclosed in the affidavit that a Ka-Bar brand leather sheath with a U.S. Marine Corps insignia was located next to Mogen’s body in the bed where she and Goncalves were found dead.
A single source of male DNA was found on the button snap of the sheath, which police said they later linked to Kohberger. The records posted Friday include a search warrant for the Coeur d’Alene Police Department’s forensics lab that since Dec. 1 has remained under court seal, including all related documents, without release of redacted records at the request of the Latah County Prosecutor’s Office and Latah County Judge Megan Marshall’s order.
Police sent a search warrant to online retailer Amazon for all sales dating to the beginning of the year for a Ka-Bar full-size U.S. Marine Corps fighting knife and the leather sheath. The next week, they served a similar search warrant to Walmart and then to eBay.
The number of records returned from the two retail giants and the online auctioneer are unclear because the publicly released documents are redacted. But a follow-up search warrant sent to eBay showed police had particular interest in 13 user accounts in nine U.S. states and one in Japan related to a Ka-Bar U.S. Marine “straight edge” knife and the model 1217S leather sheath.
Two of the user accounts were connected to Washington state, another to Idaho and one to Pennsylvania, where Kohberger grew up and was arrested, the records showed. Kohberger lived in Pullman, Washington, on the Idaho border, since the summer and attended graduate school at Washington State University.
About two weeks after the investigation began, Mowery sent Ka-Bar Knives Inc., located in Olean, New York, a search warrant for the sales of six models of their knives, plus the leather sheath.
Mowery also requested information about six companies that distribute Ka-Bar’s products. Only one of the distributors’ names, Blue Ridge Knives in southwest Virginia, was left unredacted. Mowery later sent the wholesaler a search warrant in December about its sales back to the start of last year of USMC insignia leather sheaths, with specific inquiry about 840 “units” bought between March and July 2022.
Moscow police previously maintained they had yet to find the weapon they believe was used in the Moscow killings. Pennsylvania search warrants that were unsealed and released last month from Kohberger’s Dec. 30 arrest showed police took three knives and a handgun from his parents’ eastern Pennsylvania home during his arrest. From Kohberger’s apartment in Pullman, they took more than a dozen items — including bedding with red stains and a Walmart sales receipt — but no weapons, according to the unsealed Washington search warrants released in January.
Dozens of search warrants obtained
By the end of December, about six weeks since the homicides, investigators obtained more than 50 search warrants in the case, Latah County Prosecutor Bill Thompson told the Statesman in a Dec. 28 interview.
On Jan. 3, Marshall issued a gag order that prevents law enforcement and prosecuting and defense attorneys from commenting on the case outside of court filings. Later that month, she added attorneys for witnesses and the victims’ families from speaking publicly, too.
During the first week of December, police also sent search warrants to Tinder, Reddit, Google and Yahoo seeking Goncalves’ account information from each company. They wanted her dating profile and Reddit data, tied to two email addresses and one phone number, dating to Jan. 1, 2021. From Google and Yahoo for her email accounts, police requested all data from Aug. 1, 2022, through a week after she died.
At that point in their investigation, police did not seek the same information through warrants about any of the other three victims, according to the records. Later in December, with the help of a police detective in Post Falls, about 15 minutes from Goncalves’ hometown of Rathdrum, Mowery obtained decrypted access to her laptop through a search warrant sent to Extreme Networks. The following week, he also served a warrant to an offshoot of U.S. Bank for Goncalves’ financial transactions dating to Sept. 1, 2022.
Almost immediately, Moscow police, including Chief James Fry, called the crime targeted and isolated and said that there was no ongoing threat to the community. Officials remained difficult to pin down on whether it was a specific person or the home that was the suspect’s presumed target. Goncalves’ parents, meanwhile, later said in television interviews that they believed their daughter was the killer’s target, based on the severity of the injuries they said she received in the knife attack compared to the other three victims.
A day after receiving Goncalves’ account information from Tinder, police sent the company a follow-up search warrant for information about 19 accounts that were redacted, from Nov. 3 to Dec. 6. At that time, they also sent the dating service a separate search warrant for Mogen’s account history from Jan. 1, 2021 to Dec. 6, 2022. Mowery sent another warrant later that month to Tinder for data for the month of March 2021 for 20 accounts that were redacted.
On Dec. 6, police also sent a search warrant to DoorDash for all deliveries to the King Road home dating to the beginning of the year. It was later revealed in the affidavit that Kernodle received a DoorDash food delivery at the home at approximately 4 a.m. the day of the killings, and police said they cleared the driver of any involvement in the crime.
Cellphone data in sealed warrants
On Dec. 23, for reasons that remain unclear based on the records, Payne obtained a search warrant that he served to AT&T for location data from midnight Nov. 12 to midnight Nov. 14 for a single phone number that is redacted in the documents. In the affidavit, Payne stated that the warrant was connected to Kohberger’s cellphone and detailed the same time frame.
The same day, AT&T provided Payne with the requested information about Kohberger’s cellphone location during that 48-hour window, according to the unsealed warrant. The data showed Kohberger’s phone in the area of his Pullman apartment at 2:42 a.m., then leaving the area 5 minutes later before not reporting to the cellular network again until more than 2 hours later, Payne wrote in the affidavit.
When Kohberger’s phone resurfaced on the network at 4:48 a.m., police alleged in the affidavit, the data showed it was using cell towers along Idaho 95 south of Moscow, and north of Genesee, Idaho, near the community of Blaine. They tracked the phone’s data along a circuitous route back to Pullman at about 5:30 a.m., police said.
In the affidavit, Payne reported sending AT&T a separate search warrant on Dec. 23 for the historical location data for Kohberger’s cellphone since June 23, 2022, when police said the account was opened. The records showed a search warrant for AT&T that since Jan. 6 has remained under seal, including all related documents, without release of redacted records at the request of the Latah County Prosecutor’s Office and Marshall’s order. Moscow police served AT&T no other warrants in the investigation, according to the nearly 70 filings.
The historical data Payne received about Kohberger’s cellphone placed him, based on use of cell towers in the area, in the vicinity of the crime scene “on at least 12 occasions prior to Nov. 13, 2022,” the affidavit read. “All of these occasions, except for one, occurred in the late evening and early morning hours of their respective days.”
Pennsylvania State Police and the FBI arrested Kohberger at about 1:25 a.m. on Dec. 30, according to the unsealed Pennsylvania search warrants. He was flown to Idaho on Jan. 4, and the probable cause affidavit was released the next day when he made his first court appearance in Idaho to face four counts of first-degree murder and one count of felony burglary.
Since then, police in January issued five more search warrants, each appearing related to Kohberger, according to the newly released filings. They include seeking records from WSU’s registrar’s office, which remain under seal without redactions, as well as account information for various lengths of time from Kohberger’s Google email address, Tinder profile and the Yik Yak social media platform.
When the Tinder and Yik Yak search warrants were served Jan. 25, Mowery also sent Dropbox a legal demand for all information connected to a person whose name is redacted, plus three email accounts and one phone number, each also redacted. The Tinder and Yik Yak search warrants are identical in their requests, with the exception of including Kohberger’s name unredacted.
Kohberger remains in Latah County Jail. His preliminary hearing is scheduled to start in Marshall’s county court on June 26.
