Case Document 13 Filed 12/20/16 Page 1 of 21 155 MC 464 (PKC) A093 . . . .. . . . . If Ii 1 UNITED STATES DISTRICT COURT for the Southern District of New Yer in the Matter of the Search of (Brie?y describe the prepare: to be searched or ideas)? the person by name and address) Case, NO. 3 A Laptop Computer, Further Described Below and in AttachmentA SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or preperty located in the Southern District Of New York the person or describe the property to be searched its (caution): A Laptop Further Described As a Silver Dell lnspircn 15 7000 Series (7548) Lapto Com Liter Bearing Service Ta ontaining a Toshiba One Terabyte Hard Drive Bearing Serial Numbemand That Is Currently oused a he Federal Bureau of investigation New York Field Of?ce, as describ ent A. The person or property to be searched, described above, is believed to conceal (idena?: the person or describe the property to be seized): See Attachment A I find that the or any recorded testimony, establish probable cause to sea .1 ch Seize person or property. YOU ARE COMBIANDED to execute this warrant on or before XV 3 f6 \(ncfto exceedlM daysI . ?3 El in the daytime 6:any time in the day or night as I fde reascnablecause has heed establishedUnless delayed notice is authorized below, you must give a copy of the warrant and a redeipt?I fpi Itti?e property taken to the pelson from whom, or from Whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The o?icer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required bylaw and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. I WMJIni?ais El I. ?nd that immediate noti?cation may have an adVerse result listed' in 18 U. S. C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the pets c?rl orzwhose preperty, will be searched 01? seized (checkrhe box) Elfor days (not to exceed IIEtdgiI. i I I Duntil, the facts justifying, the 'laterI speci?c date 'of?iIf [2132' i "i I . Dateandtirneissued: {0/3011'6 I 1 Jigdge City and state: New York. New York HoInIoraele- KevmiNathaInei {sex Pri?fedneme en's? r.lilir'iul (Ila Case Document 13 Filed 12/20/16 Page 2 of 21 A0 93 (Rev. 01.309) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized; Certi?cation I declare under penalty of perjury that'this inventory is correct and was returned along with the ori ginai warrant to the Court. Date: Executing of?cer ?3 signature Print?d name and title Case Document 13 Filed 12/20/16 Page 3 of 21 Attachment A I. Device To Be Searched The device to be searched is a silver Dell Inspiron 15 7000 Series (7548) laptop computer bearing service ta -:{containing a Toshiba one terabyte hard drive bearing serial numbe (the Subj ect Laptop), and that is currently housed at the Federal Bureau of Investigation, New York Field Of?ce, 26 Federal Plaza, New York, New York 1027 8. . 11. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the EST and the status of the mvestigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the BSI contained on the Subject Laptop for the following evidence, contraband, fruits, and! or other items illegally possessed in violation of Title 18, United States Code, Section 793 and (the Subject Offenses): 1. Data and information associated with the operation, use, maintenance, backup, auditing, and security functions of the Subject Laptop including, but not limited to: a Emails and attachments, in any form; b. I User and system ?les stored on the laptops, including ?le?fragments and items carved from unallocated space; - c. Logs, con?guration ?les, and backups; d. Executable code and scripts; and 6. Documents, database ?les, and spreadsheets; 2, Data and information electronically stored on the Subject Laptop related to communications with email accounts used by former Secretary of State Hillary Clinton during her tenure as Secretary of State; 3. Data and information on the Subject Laptop that might identify the person or persons who accessed classi?ed information present on the Subject Laptop, including names, addresses, telephone numbers and other identi?ers, email addresses, business information, the length of service (including start date), types of services utilized, means and source of payment ?for services (including any credit card or bank account number), and information about any domain name registration; and 4. Data and information stored on the Subject LaptOp that might identify activity related to a computer intrusion, including, but not limited to evidence of malware or viruses, executable code or scripts, log ?les, audit ?les, system ?les, user and account information, IP addresses, computer hardware addresses, intrusion~detection logs, ?rewall and other network logs, anti?virus logs or anti-malvvare logs. Case Document 13 Filed 12/20/16 Page 4 of 21 Seizure for Later Review of Electronically Stored Information A. Seizure of Computer and Media This warrant authorizes the seizure of a computer and electronic storage media as Set forth below. In lieu of seizing any particular electronic storage media, this warrant also authorizes the copying of eleCtronically stored information for later review. Electronic storage media which may be seized or copied include without limitation: Computer devices, electronic media and electronic storage devices, including, but not limited to, a computer, disk drives, modems, thumb drives, personal digital assistants, smart . phones, digital cameras, and scanners and the data within the aforesaid objects relating to said materials, which may contain information within the scope of this warrant. Any physical keys, devices, and similar physical items that are necessary to gain access to the computer equipment, storage devices or data mentioned above, or any passwords, password files, test keys, codes or other information necessary to access the above?mentioned computer equipment, storage devices or data. B. Review of Electronic Storage Media and Electronically Stored Information Following creation of forensic inaage copies as may be necessary to preserve the integrity of seized electronically stored information, law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the govermnent, attorney support staff, and outside technical experts under government control) are authorized to review the seized information for information and data within the scope of this warrant. In conducting this review, law enforcement personnel may use various techniques to determine which ?les or other 1331 contain evidence, contraband, fruits and/or other items illegally possessed in violation of the Subject Offenses. Such techniques may include, but shall not be limited to, surveying various ?le directories or folders and the individual ?les they contain; conducting a ?le?by??le review by ?Opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents; ?scanning? storage areas to discover and possibly recover recently deleted data; scanning storage areas for deliberately hidden ?les; and performing electronic ?key word? searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are related to the subject matter of the investigation. Forensically trained law enforcement may also search for and attempt to recover ?deleted,? ?hidden,? or data to determine whether the data falls within the list. of items to be seized as set forth in this af?davit. ESI that is responsive to the warrant will be identi?ed andfor copied for further use in the investigation and any resultant prosecution. Case Document 13 Filed 12/20/16 Page 5 of 21 A0 106 (Rev. 05.09) Application for a Search Warrant UNITED STATES DISTRICT COURT 'for the outhern District of New York Inthe Matterofthe Search of i . s? i rte describe theproperzj; to be sear chad I ?g I ?6 (gr icigiiti?! the person by name and address) 63 . . i A Laptop Computer. Further Described Below and in Attachment A APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement of?cer or an attorneyr for the government, request a searchIWarrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the he Lathigp'?y c?g?gh? BreasIIcIiihed As a Silver Dell Inspiron 15 7000 Series (7548) Laptop Computer Bearing Service TagHContaining a Toshiba One Terabyte .Hard Drive Bearing Serial Numbe located inthe Southern District of . New York I there is now concealed (identi?; the person or describe the property to be screed): . PLEASE SEE ATTACHED AND ATTACHMENT A. The basis for the search under Fed. Crian. P. 41(0) 13 {check one or more): [Efevidence of a crime; Ercontraband, fruits of crime, or other items illegally possessed; El property designed for use, intended for use, or us ed in committing a crime; :1 apers on to be arrested or aperson who is unlawfully restrained. The search is related to a violation of: Code Section . O??erzse Descr'nan?on 18 11.3.0. ?93(e) and Gathering, transmitting or losing defense information The application is based on these facts: PLEASE SEE ATTACHED AFFIDAVIT AND ATTACHMENT A. if Continued on the attached sheet. El Delayed notice of - days (give exact ending date if more than 3 0 days: is requested under 18 U.S.C. 31033, the basis of which is set forth on the attached sheet. Appfir?rqriti?s signaling sdpervieq ?enema! Agent I2.I I?Ht?dindmeI Sworn to before me and signed in rain; presence. :?jiI I I g" ?h/Kevrn Nathaniel For; it?. . i it." -.. ..- Date: 1013012016 r? . Ygg. I ?13233)? Cit)r and state: New York, New York Honorable Kevin ii'dith? Inie] Fox if: timed- rian? '?mqli ttfieI ?Case Document 13 Filed 12/20/16 Page 6 of 21 UNITED STATES DISTRICT COURT 3 OUTHERN DISTRICT on NEW YORK Investigation, New York Field Of?ce, 26 Federal In the Matter cf the Application of the United TO BE FILED UNDER SEAL States Of America for a Search Warrant for a - Laptop Computer, Further Described As a Silver Agent Af?davit in Support of Dell Inspiron 15 7000 Series (7548 Lapto Application for Search Warrant Computer Bearing Service Tag - Containing a Toshiba One Terabyte Hard Drive Bearing Serial Nmnbermnd That is Currently Housed at the Federal Bureau of Plaza, New York, New York 10278. SOUTHERN DISTRICT on NEW YORK) ss.: being duly sworn, deposes and says: INTRODUCTION AND AGENT BACKGROUND I 2. This af?davit relates to a crhninal investigation concerning the improper transmission and storage of classi?ed information on unclassi?ed email systems and servers. 'I'heinvestigation began as a result of a review of emails undertaken by the U.S. Department of State (State Department) in connection with Freedom of Information Act (F 01A) litigation. . a -- Case Document 13 Filed 12/20/16 Page 7 of 21 During this FOIA review, it was determined that certain emails containing classi?ed infonnation were sent and received on systems unauthorized for the transmission or storage of such information. On or about July 6, 2015, the InSpector General for the Intelligence Community noti?ed the FBI of a potential compromise of classi?ed information involving the emails discovered through the 01A review. After an initial review of the matter, the FBI opened a criminal investigation to, among other things, identify any unauthorized systems which the emails in question have transited, identify any person(s) who may have introduced classi?ed information onto unauthorized systems and all circumstances surrounding such introduction, identify any person(s) who may have transmitted such information over any such systems, and identify whether classi?ed information has been compromised through computer intrusions or unauthorized access into these systems. 3. The mves?gation has established that emails containing classi?ed information were transmitted and stored on multiple forms of electronic media. One of the items identi?ed as having contained such emails is a server which was used by former Secretary of State Hillary Rodham Clinton (Clinton) during her tenure at the State Department to transmit, receive, and store email for a personal email account or accounts she maintained (the Clinton Server). One domain on the Clinton Server?was @clintonemail.com. 4. In recent months, the FBI and the Department of Justice have made public statements concerning the conclusion of the investigation. However, as with any case, if new, pertinent information comes to light after an investigation is completed, the FBI will take appropriate investigative steps to determine the signi?cance of that information. Case Document 13 Filed 12/20/16 Page 8 of 21 6. In executing the search of the laptop computer (the Subject Laptop) FBI agents sorted the emails on the Subject es the FBI reviewed non-content header information for emails on the Subject Laptop to facilitate its search. In so doing, the FBI observed non?content header information indicating that thousands of emails of __?Tesided on the Subject Laptop. Becaus?ma?s were outside of the scope the FBI did not review the content of those emails. 7. The non?content header information that FBI agents reviewed on the ect Laptop indicates that the emails on the Subject Laptop include emails sent and/or received in ?ad at a - ?mail account appearing to belong tqh] as well as correspondence between one ?or both of theseyaccounts and State Department email accounts during and ?j'he investigation of the ?improper transmission and storage of classi?ed information on unclassi?ed email systems and servers has established that emails containing classi?ed informationvvere transmitted?throngh maltiple email accounts used by accounts. 3. The Subject Laptop, which is a silver Dell Inspiron 15 7000. Series (7543) laptop computer bearing service ta?containing a Toshiba one terabyte hard drive bearing 3 Case Document 13 Filed 12/20/16 Page 9 of 21 serial numbeE?jis currently housed at the Federal Bureau of Investigation, New York Field Of?ce, 26 Federal Plaza, New York, New York 10278, within the Southern District of New York, as described in Attachment A to this af?davit. There is probable cause to believe that the Subject Laptop contains evidence, centraband, ?'uits, andfor other items illegally possessed in violation of 18 793 and 9. I make this af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for awarrant to search the Subject Laptop for the items and - information described in Attachment A. The facts set forth in this af?davit are based on my personal knowledge, knowledge obtained during my participation in this investigation, and - information horn other FBI and U. S. Govenunent personnel. Because this af?datdt is submitted for the limited purpose of establishing probable cause in support of the application for a search vvarrant, it does not?set forth each and every fact that I or others have learned during the course of this investigation. Where the contents of documents and the actions, statements, and conVersations of others are reported herein, they are reported in substance and part, except Where otherwise indicated. STATUTORY AUTHORITY AND DEFINITIONS 1 0. For the reasons set forth below, I believe that there IS probable cause to believe that the Suhj ect LaptOp contains evidence, contraband, fruits, and! or other items illegally possessed in violation of Title 18, United States Code, Section 793 and (the Subject Offenses). 11. Under 18 U.S.C. 793 ?[vv]hoever having unauthorized possession of, access to, or control over any document . . . or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States 4 Case Document 13 Filed 12/20/16 Page 10 of 21 or to the advantage of any foreign nation, W?l?illy delivers, transmits or causes to be communicated, delivered, or transmitted? or attempts to do or causes the same ?to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the of?cer or employee of the United States entitled to receive it? shall be ?ned or imprisoned not more than ten years, or both. 12. Under 18 U.S.C. 793(1), being entrusted with or having law?il possession or control of any document . . . or information, relating to the national defense? either through gross negligence permits the same to be removed ??orn its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed,? or having knowledge that the same has been illegally removed ?om its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his} superior of?cer? shall be ?ned or imprisoned not more than ten years, or both. 13. Under Executive Order 13526, information in any form may be classi?ed if it: (1) is owed by, produced by or for, or is under the control of the United States Government; (2) falls within one or more of the categories set forth in the Executive Order [Top Secret, Secret, and Con?dential]; and (3) is classi?ed by an original classi?cation authority who determines that its unauthorized disclosure reasonably could be expected to result in damage to the national security. i 14. Where such unauthorized disclosure could reasonably result in damage to the national security, the information maybe classi?ed as ?Con?dential? and must be properly safegUarded. Where such unauthorized disclosure could reasonably result in ?serious? damage to the national security, the intonnation may be classi?ed as ?Secret? and must be properly 5 Case Document 13 Filed 12/20/16 Page 11 of 21 safeguarded. Where such unauthorized disclosure could reaSonably result in ?exceptionally grave? damage to the national security, the information may be classi?ed as ?Top Secret? and 5 must be properly safeguarded 15. Classi?ed information, of any designation, may be shared only with persons determined by an. United States Government of?cial to be eligible for access, and who possess a ?need to know.? Among other requirements, in order for a person to obtain a security clearance allowing thatpersonaccess to classi?ed United States Government information, that person is required to and must agree to properly protect classi?ed information by not disclosing such information to persons not entitled to receive it, by not I removing classi?ed information ?om authorized storage facilities, and by not storing classi?ed information in unauthorized locations. lfa person is not eligible to receive classi?ed information, classi?ed information may not be disclosed to that person. In order for a foreign I government to receive access to classi?ed information, the originating United States agency must determine that such release is appropriate. 16. Pursuant to Executive Order 135 26, classi?ed information contained on automated infonnation systems, including networks and telecommunications systems, that collect, create, communicate, compute, disseminate, process, or store classi?ed information must be maintained in a manner that: (1) prevents access by unauthorized persons; and (2) ensures the integrity of the information. 17. 32 C.F.R. Parts 2001 and 2003 regulate the handling of classi?ed information. Speci?cally, 32 C.F.R. 2001.43, titled ?Storage,? regulates the physical protection of classi?ed information. This section prescribes that Secret and Top Secret information ?shall be stored in a GSAaapproved security container, a vault built to Federal Standard (FED STD) 8,32, or an open 6 Case Document 13 Filed 12/20/16 Page 12 of 21 . storage area constructed in accordance with 2001.53.? It also requires periodic inspection of the container and the use of an Intrusion Detection System, among other things. 18. As used herein, the following terms have the following meaning: a. ?Computer? means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage ??mctions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device. See 18 U.S.C. l03 b. ?Directory? or ?folder? means a simulated electronic ?le folder or container used to organize ?les and directories in a hierarchical or tree?like structure. 0. ?Electronically Stored Information? or ?1381? includes, consistent with Federal Rule of Criminal Procedure 41 and the Advisory Committee Comments to the 2009 amendments, writings, drawings, graphs, charts, photographs, sound. recordings, images, and other data or data compilations stored in any medium ?om which information can he obtained, including all types of computer~based information as may be developed over time. ?Computer data? as used herein is synonymous with ESL d. ?File? means a collection of related data or information stored as a unit I under a speci?ed name on storage medium. Not all ESI is stored'in ?les. PROBABLE CAUSE FOR SEARCH 19. At all times relevant to this af?davit, Clinton an i??lad security clearances, . as described inparagraph 15 above. 20. its a result of a records request ?om the State Department, Clinton produced to the State Department approximately 30,490 email communications sent to or from Clinton at the @clintoriemailcom domain that resided on Clinton?s Server. As a result of a FOIA request, the . 7 Case Document 13 Filed 12/20/16 Page 13 of 21 State Department ultimately reviewed these 30,490 emails. The FOIA process implemented by the State Department required that these emails be reviewed by government agencies for classi?ed information prior to public release. In February 2016, the State Department completed I its review and determined that 2,115 of the 30,490 emails contain information that is presently classi?ed Out of these 2,115 emails, the State Department determined that 2, 028 emails contain information classi?ed at the Con?dential level; 65 contain information classi?ed at the Secret level; and 22 contain information classi?ed at the Top Secret level. The State Department did not make a determination as to whether the information in these emails was classi?ed at the time that the emails were sent. 21. The US. Government?s determination that 2,028 emails contain classi?ed at the Con?dential level is_signi?cant because it means that'the unauthorized disclosure of those emails could result in damage to national security. The US Government?s determination that 65 emails contain information classi?ed'at the Secret level is signi?cant because it means that the unauthorized disclosure of those emails could result in serious damage to national security. The Government?s determination that 22 emails contain information classi?ed at the Top Secret level is signi?cant because it means that the unauthorized disclosure of those emails could result in exceptionally grave damage to national security. 22. In conjunction with this investigation, the FBI sought a detennination by the relevant original classi?cation authorities as to Whether certain .of the 30,490 emails contained classi?ed information at the time they were sent. In response to the requests for classi?cation determinations, the relevant original classi?cation authorities determined that 81 Case Document 13 Filed 12/20/16 Page 14 of 21 email?chains,1 which the FBI investigation determined Were transmitted and stored on the Clinton Server, contained classi?ed information ranging ?om the Con?dential to Top Secret( Special Access Program levels at the time they were sent between 2009 and 2013. The releirant original classi?cation authorities determined that information in 68 of these email chains remains classi?ed24. The investigation, determined tha?usm??arious email accounts, typically communicated with Clinton?s @clintonemail.com email account on a daily basis. Analysis of emails in the possession revealed more than 4,000 work?related emails I For the purpose of the FBI investigation, an email chain is de?ned as a set of emails having the same initial email. The subj ect line may be edited in these chains to re?ect the purpose of the forward or reply. 9 Case Document 13 Filed 12/20/16 Page 15 of 21 betweeBE-jaud Clinton from 2009 to 2013 25. The FBl?s investigation established that 27 email chains containing classi?ed information, as detennined by the relevant original classi?cation authorities, have been transmitted throung/orib}cconnts. Out of the 27 email chains, six email chains contained information that was classi?ed at the Secret level at the time the emails were sent, and information in four of those email chains remains classi?ed at that I level now, while We email chains contain information that is currently classi?ed at the Con?dential level. Information in the remaining 21 email chains was classified at the Con?dential level at the time the emails were sent, and of those. 21 email chains, information in 16 ofthem'remains classi?ed as Con?dential. 26. Given the information indicating that there are thousands cmma?s located on the Subject Laptop? ?including emails, during and around:? ?Alexei?account as well as ?account appearing to belong t? and the regular email correspondence betweermnd Clinton, there is probable cause to believe that the Subject Laptop contains correspondence between? and Clintorf? Because it has been determined by relevant original classi?cation authorities that many emails were exchanged usinMd/o?ccounts, and Clinton that contain classi?ed information, there is also probable cause to believe that the correspondence between them located on the Subject Laptop contains classi?ed information which Was produced by and is owned by the U.S. IGOVernment. The Subject Laptop was never authorized for the? storage?or transmission of classi?ed or national defense information. 27. A complete forensic analysis. and review of the Subject Laptop will also allow the 1.0 Case Document 13 Filed 12/20/16 Page 16 of 21 detennine if there is any evidence of computer intrusions into the Subject Laptop, and to determine if classi?ed information was accessed by unauthorized users or transferred to any -. other unauthorized systems. canvass non ESI Review of 3381 28. Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E31 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this hivestigation, and outside technical experts under government control) will - review the ESI contained on the Subject Laptop for responsive to the Warrant. 29. In conducting this review, law enforcement may use various techniqries to determine which ?les or other ESI contain evidence, contraband, ?uits, and/or other items illegally possessed in violation of the Subject Offenses. Such techniques may include; for example: - surveying directories or folders and the individual ?les they id? looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); I conducting a ?le?by-?le review by ?opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents (analogous to performing a cursory examination of each document in a ?le cabinet to determine its relevance); - ?scanning? storage areas to discover and possibly recover recently deleted data; scanning storage areas for deliberately hidden ?les; and I performing electronic keyword searches through all electronic storage areas to determine the existence and location of search terms related to the subject matter of the investigation. (Keyword searches alone are typically inadequate to detect all information subject to seizure. For one thing, keyword searches work only for text - data, yet many types of ?les, such as images and videos, do not store data as searchable text. Moreover, even as to text data, there may be information properly - 11' Case Document 13 Filed 12/20/16 Page 17 of 21 subject to seizure but that is not captured by a keyword search because the information does not contain the keywords being searched.) - 30. Law enforcement personnel will make reasonable efforts to restrict their search to data falling within the categories of evidence speci?ed in the warrant. Return of the Subiect Lapttm 31. Ifthe Government determines that the Subject Laptop is no longer necessary to retrieve and preserve the data on the device, and that the Subject Laptop is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(c), the Government will return the Subject . Laptop. Computer data that is or unreadable will not be returned unless law enforcement personnel have. determined that the data is not an instrumentality of the offense, (ii) a ?air of the criminal-activity, contraband, (iv) otherwise unlaw?illy possessed, or evidence of the subject o?enses. CONCLUSION 32. Based on the foregoing, I respectfully request the Court to issue awarrant to seize the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure Warrant. i 12. Case Document 13 Filed 12/20/16 Page 18 of 21 33 . In light of the con?dential nature of this investigation, the full scope of which is not knownt dot the public, as Well as the con?dential nature of the underlying investigation in which the Subject Laptop was initially obtained by the Government, I resp ectfully request that this a?idavit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Sworn toabeffeteme on the 3Gt?fdeiy'11i0et9ber, 2016 3- ?13::an NAMNIEL FOX ?fr-E, m/Kevin Nathaniel Fox I Supervisory Special Agent Federal Bureau of Investigation on? TED. srm?n?s? MAGISTRATE IUDGE -I a . . It?: ll; {a ix?. Her?! 13 Case Document 13 Filed 12/20/16 Page 19 of 21 Attachment A I. Device To Be Searched The device to be so ched is a silver Dell Inspiron 15 7000 Series (7548) laptop computer bearin ervice ta goontaining a Toshiba one terabyte hard driVe bearing serial numbe the ubject Laptop): and that is currently housed at the Federal Bureau of Investiga New York Field Office, 26 Federal Plaza, New York, New York 10278. - II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E31 and the status of the investigation and related proceedings, attorneys for the government, attorney support sta?', agency personnel assisting the government in this investigation, and outside technical experts under govemment control) are authorized to review the E31 contained on the Subject Laptop for the following evidence, contraband, fruits, and/or other items illegally possessed in violation of Title 18, United States Code, Section 793 and (the Subject Offenses): 1. Data and information associated with the operation, use, maintenance, backup, auditing, and security ?mctions of the Subject Laptop including, but not limited to: a. Emails and attachments, in any form; b. User and system ?les stored on the laptops, including ?le ?agments and items carved from unallocated space; i c. Logs, don?guration ?les, and backups; . Executable code and scripts; and 6. Documents, database ?les, and spreadsheets; Data and information electronically stored on the Subject Laptop related to communications with email accounts used by former Secretary of State Hillary Clinton during her tenure as Secretary of State; 3 . Data and information on the Subject Laptop that might identify the person or persons who accessed classi?ed information present on the Subject Laptop, including names, addresses, telephone numbers and other identi?ers, email addresses, business information, the length of service (including start date), types of services utilized, means and source ofpayment for services (including any credit card or bank account nUmber), and information about any domain name registration; and 4. Data and information stored on the Subject Laptop that might identify activity related to a computer intrusion, including, but not limited to evidence of malware or viruses, executable code or scripts, log ?les, audit ?les, system ?les, user and account information, IP addresses, computer hardware addresses, intrusion?detection logs, ?rewall and other network logs, anti~virus Io gs or antiumalware lo gs. . Case Document 13 Filed 12/20/16 Page 20 of 21 Ill. Seizure for Later Review of Electronically Stored Information A. Seizure of Computer and Media This warrant authorizes the seizure of a computer and electronic storage media as set forth below. In lieu of seizing any particular electronic storage media, this warrant also. authorizes the copying of electronically stored information for later review. Electronic storage media which may be seized or copied include without limitation: Computer devices, electronic media and electronic storage devices, including, but not limited to, a computer, disk driVes, modems, thumb drives, personal digital assistants, smart phones, digital cameras, and scanners and the data the aforesaid objects relating to said materials, which may contain information within the scope of this warrant. .- Any physical keys, devices, and similar physical items that are necessary to gain access to the computer equipment, stdrage devices or data mentioned above, or any passwords, password ?les, test keys, codes or other information necessary to access the above?mentioned computer equipment, storage devices or data. B. Review of Electronic Storage Media and Electronically Stored Information Following creation of forensic image cepies as may be necessary to preserve the integrity of seized electronically stored information, law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff and outside technical experts under government control) are authorized to review the seized information for information and data vidthin the scope of this warrant. In conducting this review, law enfor?ement personnel may use various techniques to detennine which ?les or other ESI contain evidence, contraband, ?nite and/or other items illegally possessed in violation of the Subject Offenses. Such techniques may include, but shall not be limited to, surveying various ?le directories or folders and the individual ?les they contain; conducting a- ?le?by??le review by ?opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents; ?scanning? storage areas to discover and possibly recover recently deleted data; scanning storage areas for deliberately hidden ?les; and performing electronic ?key word? searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are related to the subj ect matter of the investigation. Forensically trained law enforcement personnel may also search for and attempt to recover ?deleted,? ?hidden,? or data to determine whether the data falls within the list of items to be seized as set forth in this af?davit. ESI that is responsive to the warrant will be identi?ed and! or copied for ?nther use in the investigation and any resultant prosecution. Case Document 13 Filed 12/20/16 Page 21 of 21 A0 ?93 (Rev. 011?09) Search 011:! Seizum WarranHP?go 2) Return Case Nos Date and time Warrant executed: Copy of Warrant and 'invent?wry left with: . 10 MAG 7003 10/30/2010 1:57 pm . made in the presence of: Inventonr ofthe property taken and name of any person(s) seized: . Forensicimage of ilver bearing" servi ta serial number lnspiron 15 7000 Series (7548) laptop computer entaining 'a Toshiba one terabyte hard drive bearing Certi?cation I declare under penalty of perjury that'this inventory is correct and was returned along with the original warrant to the Court. . Date; Erecurfng o?ceris'sfgnamre FBI Printed name and title .u . .