> On April 14, 2017, at 14: 55: 52, the email address "rlincc@gmail.com" was accessed from IP address 199.38.233.169, an IP address owned by WANSecurity, a Kans

> On April 14, 2017, at 14: 55: 52, the email address "rlincc@gmail.com" was accessed from IP address 199.38.233.169, an IP address owned by WANSecurity, a Kansas VPN service. As discussed above, this Gmail address is directly attributable to Ryan Lin and was used to communicate directly and openly with Smith and her roommates, including when he first responded to the Craigslist advertisement to be their roommate. This type of information couldn't be provided by VPN logs due to gmail using TLS encryption. If they gained physic access to a device that he was currently logged into, they just needed to look at the gmail account activity. Anyone can look at all the IP addresses they have accessed their gmail account from. They could have also just got a warrant. > On April 14, 2017, at 15:06:27, the email address teleportxf@gmail.com, provided by "Ashley Plano" to Rover, was accessed from the same exact WANSecurity IP address, 199.38.233.169 This is more interesting. It doesn't seem likely they caught him logged into this account, or that would be all the evidence they needed. I suspect they issued a warrant to Google for this account and got a list of IP addresses back. I can't imagine that the VPN provider allocated a unique IP addresses for each subscriber. This seems like a really weak correlation unless they are leaving out some important information.