I didn't have free time earlier to get into specifics, so here goes.
Note: I am a Salt Lake City local that works in Information Security. I've requested a verification path from a mod.
It seems there's questions about digital footprints and tracking. Needless to say, there's a wealth of information to be collected on the internet, even when someone thinks they're being sneaky about who they are. Generally, that info isn't available through just google searches, unless you know how to search and tie details together.
What I will focus on here is information that would be collected by law enforcement in a case like this.
When considering how a website or application is logged into, it's generally username and password. At least on the surface. Many companies are now implementing something called passive authentication. This is essentially a process that happens without the user even being aware. For example, logging into your bank. Have you ever received the "We don't recognize this device" message? That is passive authentication. Your bank website knows what devices you've previously used and when it doesn't recognize the device attempting to log into your account, it sends you into a secondary verification path - like sending you a text or an email to confirm it is you. Passive authentication is a protection against fraudulent activity. However...
It also collects a significant amount of data. IP address, browser type, reputation score of the IP - there's so much information and it all happens in seconds. Login attempts are tracked and stored, even if only for a period of time, and will collect the information I mentioned above. As it pertains to SM accounts - users of those platforms ARE the product, and they have very robust analytics programs. That is, they have data upon data upon data and can help LE visualize the big picture of ML's activity as well as the POI.
I have no knowledge of the warrants in this case, but I expect they involved getting all account login data for ML's accounts for the past 30 days. That way, they will know which IP addresses/devices she used to login to her accounts, and review for any activity after the 17th. This doesn't even have to be done manually - often, companies have software that performs data aggregation and may be able to provide an analytics report plus the raw data to LE.
)
