Case Document 13 Filed 12/20/16 Page 1 of 21 1?5 MC 464 (PKC) . A093 SeizureWarrant . I UNITED STATES DISTRICT COURT for the Southern District of New 170:? in the Matter of the Search of I 8 MAG - (Brie?y describe the properni to be searched or identt? the person by name and address) Case No_ A Laptop Computer, Further Described Below and in Attachment A SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Southern District? Of New York (identh the person or describe the property to be searched andgt?ve its location): I A Laptop Co ter Further Described As a Silver Dell lnspiron 15 7000 Series (7548) Lapto Com Liter Bearing Service Tahontaining a Toshiba One Terabyte Hard Drive Bearing Serial Numbemand That Is Currently oused a he Federal Bureau of investigation, New York Field Of?ce, as deecrib ent A. The person or property to be searched, described above, is believed to conceal (idena?: the person or describe the property to be seized): SeeAttachmentA . . I Ian-1' tail i I133, I ?nd that the af?davi?s), or any recorded testimony, establish probable cause tqsb?arch and Seize tl-?iefp?rs?on or Property:?52 i. 2:21. YOU ARE COMBIANDED to execute this warrant on or before 3 . i .3 \{?cflto '31. i i. El in the daytime 6:00 am. to 10 p.111. [if at any time in the day or night as I find-reticenable?cahs?e has been established. $1.Unless delayed notice is authorized below, you must give a copy of the warrant and a fedeipt?fo?t?e?pr?dperty taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The o?icer executing this warrant, or an of?cer present during the execution of the warrant, roost prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. Initials El 1 find that immediate noti?cation may have an adVerse result listed in 18 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person with orzwhose proPerty, will he searched 01? seized (checkrhe box) Elfor days (not to exceed?i??g i, I, 1.. "r . Duntil, the facts justifying, the later spacith date 015:4? I, .1, ?1 ,1 3.3.. . . ,i a' {0/301" lath/0.x? -1 I .5. - nitrate?? I I: h. City and state: New York. New York Hon?o able-KevinrNathaniei Fox "fr?i?remmesrtl?s?ita- I I. 1.1.11: . r.lltil? Case Document 13 Filed 12/20/16 Page 2 of 21 A0 93 (Rev. 01.309) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seizedt Certi?cation I declare under penalty of perjury that'this inventory is correct and was returned along with the original warrant to the Court. Date: Executing of?cer ?3 signature Printed name and title Case Document 13 Filed 12/20/16 Page 3 of 21 Attachment A I. Device To Be Searched The device to be searched is a siIVer Dell Inspiron 15 7000 Series (7548) laptop computer bearing service ta -:{containing a Toshiba one terabyte hard drive bearing serial numbe (the Subj ect Laptop), and that is currently housed at the Federal Bureau of Investigation, New York Field Of?ce, 26 Federal Plaza, New York, New York 1027 8. . 11. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the mvestigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the 1381 contained on the Subject Laptop for the following evidence, contraband, fruits, and! or other items illegally possessed in violation of Title 18, United States Code, Section 793 and (the Subject Offenses): 1. Data and information associated with the operation, use, maintenance, backup, auditing, and security functions of the Subject Laptop including, but not limited to: a Emails and attachments, in any form; b. I User and system ?les stored on the laptops, including ?le?fragments and items carved from unallocated space; - c. Lo gs, configuration ?les, and backups; d. Executable code and scripts; and 6. Documents, database ?les, and spreadsheets; 2, Data and information electronically stored on the Subject Laptop related to communications with email accounts used by former Secretary of State Hillary Clinton during her tenure as Secretary of State; 3. Data and information on the Subject Laptop that might identify the person or persons who accessed classi?ed information present on the Subject Laptop, including names, addresses, telephone numbers and other identi?ers, email addresses, business information, the length of service (including start date), types of services utilized, means and source of payment ?for services (including any credit card or bank account number), and information about any domain name registration; and 4. Data and information stored on the Subject LaptOp that might identify activity related to a computer intrusion, including, but not limited to evidence of malware or viruses, executable code or scripts, log ?les, audit ?les, system ?les, user and account information, IP addresses, computer hardware addresses, intrusion~detection logs, ?rewall and other network logs, anti?virus logs or anti-malvvare lo gs. Case Document 13 Filed 12/20/16 Page 4 of 21 Seizure for Later Review of Electronically Stored Information A. Seizure of Computer and Media This warrant authorizes the seizure of a computer and electronic storage media as Set forth below. In lieu of seizing any particular electronic storage media, this warrant also authorizes the copying of eleCtronically stored information for later review. Electronic storage media which may be seized or copied include without limitation: Computer devices, electronic media and electronic storage devices, including, but not limited to, a computer, disk drives, modems, thumb drives, personal digital assistants, smart . phones, digital cameras, and scanners and the data within the aforesaid objects relating to said materials, which may contain information within the scope of this warrant. Any physical keys, devices, and similar physical items that are necessary to gain access to the computer equipment, storage devices or data mentioned above, or any passwords, password ?les, test keys, codes or other information necessary to access the above?mentioned computer equipment, storage devices or data. B. Review of Electronic Storage Media and Electronically Stored Information Following creation of forensic inaage copies as may be necessary to preserve the integrity of seized electronically stored information, law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the govermnent, attorney support staff, and outside technical experts under government control) are authorized to review the seized information for information and data within the scope of this warrant. In conducting this review, law enforcement personnel may use various techniques to determine which ?les or other 1331 contain evidence, contraband, ?nite and/or other items illegally possessed in violation of the Subject Offenses. Such techniques may include, but shall not be limited to, surveying various ?le directories or folders and the individual ?les they contain; conducting a ?le?by??le review by ?Opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents; ?scanning? storage areas to discover and possibly recover recently deleted data; scanning storage areas for deliberately hidden ?les; and performing electronic ?key word? searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are related to the subject matter of the investigation. Forensically trained law enforcement persOnnel may also search for and attempt to recover ?deleted,? ?hidden,? or data to determine whether the data falls within the list. of items to be seized as set forth in this af?davit. ESI that is responsive to the warrant will be identi?ed andfor copied for further use in the investigation and any resultant prosecution. Case Document 13 Filed 12/20/16 Page 5 of 21 A0 106 (Rev. 05.09) Application for a Search Warrant UNITED STATES DISTRICT COURT 'for the outhern District of New York lathe Matterofthe Search of i . 1 Egg rr'e describe theproperzj; to be searched I (gr igfm? the person by name and address) 6E, . . i" A Laptop Computer. Further Described Below and in Attachment A a APPLICATION FOR A SEARCH I, a federal law enforcement of?cer or an attome}r for the government, request a search-Warrant and state under penalty of perjury that I haVe reason to believe that on the following person or property (idean the person or describe the :go??t?p? egfti??lrl?g As a Silver Del! 15 7000 Series (7548) Laptop Computer Bearing Service Tangontaining a Toshiba One TerabyteHard Drive Bearing Serial Numbe located iathe Southan District of . New York there is now concealed (identi?; the person or describe the property to be seized): PLEASE SEE ATTACHED AND ATTACHMENT A. The basis for the seat-Ch under Fed. R. Grim. P. 41(0) is (classic one or more): [Erevldeooe of a crime; - dcontraband, fruits of crime, or other items illegally possessed; El property designed for use, intended for use, or used in committing a crime; :1 apers (in to be arrested or aperso? who is unlawfully restrained. The search related to a violation of: Code Sec?on . O??ense Descr'qatz?on 18 11.3.0. ?93(e) and Gathering, transmitting or losing defense information The application is based on these facts: PLEASE SEE ATTACHED AFFIDAVIT AND ATTACHMENT A. if Continued on the attached sheet. El Delayed notice of - days (giVe exact ending date if more than 30 days: is requested under 18 U.S.C. 31033, the basis of which is set forth on the attached sheet. Ap?ioqriti? failure - ?i I . . . Agent. FBI "IfSwomto before me and signedinmy presence. 31-13;. .. s" ,EIZ'Kevm?Natliani?el?Fox 1; Date: 1013012016 City and state: New York, New York Honora?ieKeyn?n?ath?nge] Fox :3le i Case Document 13 Filed 12/20/16 Page 6 of 21 UNITED STATES Drsmer COURT 3 OUTHERN DISTRICT OF NEW YORK hivestigation, New York Field Of?ce, 26 Federal In the Matter 'of the Application of the United TO BE FILED UNDER SEAL States Of America for a Search Warrant for a - Laptop Computer, Further Described As a Silver Agent Af?davit in Support of Dell Inspiron 15 7000 Series (7548 Lapto Application for Search Warrant Computer Bearing Service Tag - Containing a Toshiba One Terabyte Hard Drive Bearing Serial Number?land That is Currently Housed at the Federal Bureau of Plaza, New York, New York 10278. SOUTHERN DISTRICT or NEW YORK) ss.: being duly sworn, deposes and says: INTRODUCTION AND AGENT BACKGROUND I 2. This af?davit relates to a crhninal investigation concerning the improper transmission and storage of classi?ed information on unclassi?ed email systems and servers. Theinvestigation began as a result of a review of emails undertaken by the U.S. Department of State (State Deparnnent) in connection with Freedom of Information Act (F 01A) litigation. . a -- Case Document 13 Filed 12/20/16 Page 7 of 21 During this FOIA review, it was determined that certain emails containing classi?ed information were sent and received on systems unauthorized for the transmission or storage of such information. On or about July 6, 2015, the InSpector General for the Intelligence Community noti?ed the FBI of a potential compromise of classi?ed information involving the emails discovered through the 01A review. After an initial review of the matter, the FBI opened a criminal investigation to, among other things, identify any unauthorized systems which the emails in question have transited, identify any person(s) who may have introduced classi?ed information onto unauthorized systems and all circumstances surrounding such introdiiction, identify any person(s) who may have transmitted such information over any such systems, and identify Whether classi?ed information has been compromised through computer intrusions or unauthorized access into these systems. 3. The hivestigation has established that emails containing classi?ed information vvere transmitted and stored on multiple forms of electronic media. One of the items identi?ed as having contained such emails is a server which was used by former Secretary of State Hillary Rodham Clinton (Clinton) during her tenure at the State Department to transmit, receive, and store email for a personal email account or accounts she maintained (the Clinton Server). One domain on the Clinton Server?was @clintonemail.com. 4. In recent months, the FBI and the Department of Justice have made public statements concerning the conclusion of the investigation. However, as with any case, if new, pertinent information comes to light after an investigation is completed, the FBI will take appropriate investigative steps to determine the signi?cance of that information. Case Document 13 Filed 12/20/16 Page 8 of 21 6. In executing the search of the laptop computer (the Subject Laptop) FBI agents sorted the emails on the Subject emele?. es the FBI reviewed non-content header information for emails on the Subject Laptop to facilitate its search. In so doing, the FBI observed non?content header information indicating that thousands of emails of __?Tesided on the Subject Laptop. BecauseMmails were outside ofthe scope the FBI did not review the content of those emails. 7. ?j The non?content header information that FBI agents reviewed on the Sub} ect Laptop indicates that the emails on the Subject Laptop include emails sent and/or received in ?i1nd at a - ?mail account appearing to belong 1?.th as well as correspondence between one ?or both of theseyaccounts and State Department email accounts during and arounc[? ?j'he investigation of the ?improper transmission and storage of classi?ed information on unclassi?ed email systems and servers has established that emails containing classi?ed informationvvere transmitted?throngh multiple email accounts used by accounts. 3. The Subject Laptop, which is a silver Dell Inspiron 15 7000. Series (7543) laptop computer bearing service ta?containing a Toshiba one terabyte hard drive bearing 3 Case Document 13 Filed 12/20/16 Page 9 of 21 serial numbeE?jis currently housed at the Federal Bureau of Investigation, New York Field Of?ce, 26 Federal Plaza, New York, New York 10278, within the Southem District of New York, as described in Attachment A to this af?davit. There is probable cause to believe that the Subject Laptop contains evidence, centraband, ?'uits, andfor other items illegally possessed in violation of 18 793 and 9. I make this af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for awarrant to search the Subject Laptop for the items and - information described in Attachment A. The facts set forth in this af?davit are based on my personal knowledge, knowledge obtained during my participation in this investigation, and - information horn other FBI and US. Govenunent personnel. Because this af?datdt is submitted for the limited purpose of establishing probable cause in support of the application for a search vvarrant, it does not?set forth each and every fact that I or others have learned during the course of this investigation. Where the contents of documents and the actions, statements, and conVersations of others are reported herein, they are reported in substance and part, except Where otherwise indicated. STATUTORY AUTHORITY. AND DEFINITIONS 10. For the reasons set forth below, I believo thatthere is probable cause to believe that the Subject Laptop contains evidence, contraband, fruits, and! or other items illegally possessed in violation of Title 18, United States Code, Section 793 and (the Subject Offenses). 11. Under 18 U.S.C. 793 ?[vv]hcever having unauthorized possession of, access to, or control over any document . . . or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States 4 Case Document 13 Filed 12/20/16 Page 10 of 21 or to the advantage of any foreign nation, Will?illy delivers, transmits or causes to be communicated, delivered, or transmitted? or attempts to do or causes the same ?to any person not entitled to receive it, or willftu retains the same and fails to deliver it to the of?cer or employee of the United States entitled to receive it? shall be ?ned or imprisoned not more than ten years, or both. 12. Under 18 U.S.C. 793(1), being entrusted with or having law?ll possession or control of any document . . . or information, relating to the national defense? either through gross negligence permits the same to be removed ??om its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed,? or having that the same has been illegally removed here its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction; or destruction to his} superior of?cer? shall be ?ned or imprisoned not more than ten years, or both. 13. Under Executive Order 13526, information in any form may be classi?ed if it: (1) is owned by, produced by or for, or is under the control of the United States Government; (2) falls within one or more of the categories set forth in the Executive Order [Top Secret, Secret, and Con?dential]; and (3) is classi?ed by an original classi?cation authority who determines that its unauthorized disclosure reasonably could be expected to result in damage to the national security. i 14. Where such unauthorized disclosure could reasonably result in damage to the national security, the information may be classi?ed ?Con?dential? and must be properly safegUarded. Where such unauthorized disclosure could reasonably result in ?serious? damage to the national security, the infonnation may be classi?ed as ?Secret? and must be properly 5 Case Document 13 Filed 12/20/16 Page 11 of 21 safeguarded. Where such unauthorized disclosure could reaSonably result in ?exceptionally grave? damage to the national security, the information may be classi?ed as ?Top Secret? and 5 must be properly safeguarded 15. Classi?ed information, of any designation, may be shared only with persons determined by an. apprOpriate United States Government of?cial to be eligible for access, and who possess a ?need to know.? Among other requirements, in order for a person to obtain a security clearance allowing thatpersonaccess to classi?ed United States Government information, that person is required to and must agree to properly protect classi?ed information by not disclosing such information to persons not entitled to receive it, by not I removing classi?ed information ?om authorized storage facilities, and by not storing classi?ed information in unauthorized locations. lfa person is not eligible to receive classi?ed information, classi?ed information may not be disclosed to that person. In order for a foreign I government to receive access to classi?ed information, the originating United States agency must determine that such release is appropriate. 16. Pursuant to Executive Order 135 26, classi?ed information contained on automated information systems, including networks and telecommunications systems, that collect, create, communicate, compute, disseminate, process, or store classi?ed information must be maintained in a manner that: (1) prevents access by unauthorized persons; and (2) ensures the integrity of the information. 17. 32 C.F.R. Parts 2001 and 2003 regulate the handling of classi?ed information. Speci?cally, 32 C.F.R. 2001.43, titled ?Storage,? regulates the physical protection of classi?ed information. This section prescribes that Secret and Top Secret information ?shall be stored in a GSA-uapproved security container, a vault built to Federal Standard (FED STD) 8,32, or an open 6 Case Document 13 Filed 12/20/16 Page 12 of 21 . storage area constructed in accordance with 2001.53.? It also requires periodic inspection of the container and the use of an hltrusicn Detection System, among other things. 18. As used herein, the following terms have the following meaning: a. ?Computer? means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage ??mctions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device. See 18 U.S.C. 103 b. ?Directory? or ?folder? means a simulated electronic ?le folder or container used to organize ?les and directories in a hierarchical or tree?like structure. 0. ?Electronically Stored Information? or ?1381? includes, consistent with Federal Rule of Criminal Procedure 41 and the Advisory Committee Comments to the 2009 amendments, writings, drawings, graphs, charts, photographs, sound. recordings, images, and other data or data compilations stored in any medium ?cm which information can he obtained, including all types of computer~based information as may be developed over time. ?Computer data? as used herein is synonymous with ESL d. ?Tile? means a collection of related data or information stored as a unit I under a speci?ed name on storage medium. Not all ESI is stored'in ?les. PROBABLE CAUSE FOR SEARCH 19. At all times relevant to this af?davit, Clinton an i??lad security clearances, . as described inparagraph 15 above. 20. its a result of a records request ?om the State Department, Clinton produced to the State Department approximately 30,490 email communications sent to or from Clinton at the @clintoriemailcom domain that resided on Clinton?s Server. As a result of a FOIA request, the I 7 Case Document 13 Filed 12/20/16 Page 13 of 21 State Department ultimately reviewed these 30,490 emails. The FOIA process implemented by the State Department required that these emails be reviewed by government agencies for classi?ed information prior to public release. February 2016, the State Department completed I its review and determined that 2,115 of the 30,490 emails contain information that is presently classi?ed Out of these 2,115 emails, the State Department determined that 2, 028 emails contain information classi?ed at the Con?dential level; 65 contain information classi?ed at the Secret level; and 22 contain information classi?ed at the Top Secret level. The State Department did not make a determination as to whether the information in these emails was classi?ed at the time that the emails were sent. 21. The US. Government?s determination that 2,028 emails contain infer-[nation classi?ed at the Con?dential level is_signi?cant because it means that'the unauthorized disclosure of those emails could result in damage to national security. The US Government?s determination that 65 emails contain information classi?ed'at the Secret level is signi?cant because it means that the unauthorized disclosure of those emails could result in serious damage to national security. The Government?s determination that 22 emails contain information classi?ed at the Top Secret level is signi?cant because it means that the unauthorized disclosure of these emails could result in exceptionally grave damage to national security. 22. In conjunction with this investigation, the FBI sought a determination by the relevant original classi?cation authorities as to Whether certain of the 30,490 emails contained classi?ed information at the time they were sent. In response to the requests for classi?cation determinations, the relevant original classi?cation authorities determined that 81 Case Document 13 Filed 12/20/16 Page 14 of 21 email?chains,1 which the FBI irivestiga?oh determined Were transmitted and stored on the Clintori Server, contained classi?ed information ranging ?om the Con?dential to Top Secret( Special Access Program levels at the time they were sent betweezi 2009 and 2013. The releirant original classi?cation authorities determined that information in 68 of these email chains remairrs classi?ed24. The investigation, determined tha?usm??arious email accounts, typically communicated with Clinton?s @clintonemail.com email account on a daily basis. Analysis of emails in the possession revealed more than 4,000 work?related emails I For the purp qse of the FBI investigation, an email chain is de?ned as a set of emails having the same initial eniail. The subj ect line may be edited in these chains to re?ect the purpose of the forward or reply. 9 Case Document 13 Filed 12/20/16 Page 15 of 21 betweeDE-jand Clinton from 2009 to 2013. 25. The investigation established that 27 email chains containing classi?ed information, as detennined by the relevant original classi?cation authorities, have been transmitted wroung/orib}cconnts Out of the 27 email chains, six email chains contained information that was classi?ed at the Secret level at the time the emails were sent, and information in four of those email chains remains classi?ed at that I level now, While two email chains contain information that is currently classi?ed at the Con?dential level. Information in the remaining 21 email chains was classi?ed at the Con?dential level at the time the emails were sent, and of those. 21 email chains, information in 16 of them'remains classi?ed as Con?dential. 26. Given the information indicating that there are thousands cmma?s located on the Subject Laptop including emails, during and aroum_ ?Alexei?account as well as ?account appearing to belong t? and the regular email correspondence betWeermnd Clinton, there is probable cause to believe that the Subject Laptop contains correspondence between? and Because it has been determined by relevant original classi?cation authorities that many emails were exchanged between[:- usinMd/o?cconnts, and Clinton that contain classi?ed information, there is also probable cause to believe that the correspondence between them located on the Subject Laptop contains classi?ed information which Was produced by and is owned by the U.S. IGOVernment. The Subject Laptop was never authorized for the? storage. or transmission of classi?ed or national defense information. 27. A complete forensic analysis. and review of the Subject Laptop will also allow the 1.0 Case Document 13 Filed 12/20/16 Page 16 of 21 if there is any evidence of computer intrusions into the Subject Laptop, and to determine if classi?ed information was accessed by unauthorized users or transferred to any -. other unauthorized systems. non snanonnve 1331 Review of E81 28. Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E31 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) will - review the ESI contained on the Subject Laptop for information responsive to the Warrant. 29. In conducting this review, law enforcement may use various iechniques to determine which ?les or other ESI contain evidence, contraband, ?nits, and/or other items illegally possessed in violation of the Subject Offenses. Such techniques may include, for example: - surveying directories or folders and the individual ?les they to? looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); I conducting a ?le?by-?le review by ?opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents (analogous to performing a curs ory examination of each document in a ?le cabinet to determine its relevance); - ?scanning? storage areas to discover and possibly recover recently deleted data; scanning storage areas for deliberately hidden ?les; and I performing electronic keyword searches through all electronic storage areas to determine the existence and location of search terms related to the subject matter of the investigation. (Keyword searches alone are typically inadequate to detect all information subj eot to seizure. For one thing, keyword searches work only for text - data, yet many types of ?les, such as images and videos, do not store data as searchable text. Moreover, even as to text data, there may be information properly - 11' Case Document 13 Filed 12/20/16 Page 17 of 21 subject to seizure but that is not captured by a keyword search because the information does not contain the keywords being searched.) - 30. Law enforcement personnel will make reasonable efforts to restrict their search to data falling within the categories of evidence speci?ed in the warrant. Return of the Subiect Lantgn 31. Ifthe Government determines that the Subject Laptop is no longer necessary to retrieve and preserve the data on the device, and that the Subject Laptop is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(c), the Government will return the Subject . Laptop. Computer data that is or unreadable will not be returned unless law enforcement personnel have. determined that the data is not an instrumentality of the offense, (ii) a ?uid of the criminal-activity, contraband, (iv) otherwise unlaw?rlly possessed, or evidence of the subject o?enses. CONCLUSION 32. Based on the foregoing, I respectfully request the Court to issue awarrant to seize the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure Warrant. i 12. Case Document 13 Filed 12/20/16 Page 18 of 21 33 . In light of the con?dentiul nature of this investigation, the full scope of which is not knownt dot the public, as Well as the con?dential nature of the underlying investigation in which the Subject Laptop was initially obtained by the Government, I resp eetfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise. I Supervisory Speelal Agent Federal Bureau of Investigation Swornteabefgerernxegorn thegethedaret Qt?plg?n?m?. :11?upgilt-3w? they]: Nethamel Fox . In J. .u . moremrn IUDGE .43} I jg}: a. ?fa-ntn?n? 13 Case Document 13 Filed 12/20/16 Page 19 of 21 Attachment A I. Device To Be Searched The device to be se ched is a silver Dell Inspiron 15 7000 Series (7548) laptop computer bearin ervice ta goontaining a Toshiba one terabyte hard driVe bearing serial numbe the ubject Laptop): and that is currently housed at the Federal Bureau of Investiga New York Field Office, 26 Federal Plaza, New York, New York 10278. - II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E31 and the status of the investigation and related proceedings, attorneys for the government, attorney support sta?', agency personnel assisting the government in this investigation, and outside technical experts under govemment control) are authorized to review the E31 contained on the Subject Laptop for the following evidence, contraband, fruits, and/or other items illegally possessed in violation of Title 18, United States Code, Section 793 and (the Subject Offenses): 1. Data and information associated with the operation, use, maintenance, backup, auditing, and security functions of the Subject Laptop including, but not limited to: a. Emails and attachments, in any form; b. User and system ?les stored on the laptops, including ?le ?agments and items carved from unallocated space; i c. Logs, con?guration ?les, and backups; . Executable code and scripts; and 6. Documents, database ?les, and spreadsheets; Data and information electronically stored on the Subject Laptop related to communications with email accounts used by former Secretary of State Hillary Clinton during her tenure as Secretary of State; 3 . Data and information on the Subject Laptop that might identify the person or persons who accessed classi?ed information present on the Subject Laptop, including names, addresses, telephone numbers and other identi?ers, email addresses, business information, the length of service (including start date), types of services utilized, means and source ofpajment for services (including any credit card or bank account number), and information about any domain name registration; and 4. Data and information stored on the Subject Laptop that might identify activity related to a computer intrusion, including, but not limited to evidence of malware or viruses, executable code or scripts, log ?les, audit ?les, system ?les, user and account information, IP addresses, computer hardware addresses, intrusion?detection lo gs, ?rewall and other network logs, anti~virus Io gs or antiumalware logs. . Case Document 13 Filed 12/20/16 Page 20 of 21 Iii. Seizure for Later Review of Electronically Stored Information A. Seizure of Computer and Media This warrant authorizes the seizure of a computer and electronic storage media as set forth below. In lieu of seizing any particular electronic storage media, this warrant also. authorizes the copying of electronically stored information for later review. Electronic storage media which may be seized or copied include without limitation: Computer devices, electronic media and electronic storage devices, including, but not limited to, a computer, disk driVes, modems, thumb drives, personal digital assistants, smart phones, digital cameras, and scanners and the data vidthin the aforesaid objects relating to said materials, which may contain information within the scope of this warrant. .- Any physical keys, devices, and similar physical items that are necessary to gain access to the computer equipment, stdrage devices or data mentioned above, or any passwords, password ?les, test keys, codes or other information necessary to access the above?mentioned computer equipment, storage devices or data. B. Review of Electronic Storage Media and Electronically Stored Information Following creation of forensic image cepies as may be necessary to preserve the integrity of seized electronically stored information, law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff and outside technical experts under government control) are authorized to review the seized information for information and data within the scope of this warrant. In conducting this review, law enforcement personnel may use various techniques to detennine which ?les or other ESI contain evidence, contraband, ?'uits and/or other items illegally possessed in violation of the Subject Offenses. Such techniques may include, but shall not be limited to, surveying various ?le directories or folders and the individual ?les they contain; conducting a- ?le?by??le review by ?opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents; ?scanning? storage areas to discover and possibly recover recently deleted data; seaming storage areas for deliberately hidden ?les; and performing electronic ?key word? searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are related to the subj ect matter of the investigation. Forensically trained law enforcement personnel may also search for and attempt to recover ?deleted,? ?hidden,? or data to determine whether the data falls within the list of items to be seized as set forth in this af?davit. ESI that is responsive to the warrant will be identi?ed and! or copied for ?irther use in the investigation and any resultant prosecution. Case Document 13 Filed 12/20/16 Page 21 of 21 3 A0 ?93 (Rev. 011?09) Search my! Seizure Wman?hgv 2) Return Case Nos Date and time Warrant executed: Copy of Warrant and 'inVentery left with: . 16 MAG 7003 10/30/2010 1:57 pm Invanfoty made in the presence of: Inventonr of?le property taken and name of any person(s) seized: . Forensieimage 0f ilver bearing" servi ta serial number lnspiron i 5 7000 Series (7548) laptop computer entaining 'a Toshiba one terabyte hard drive bearing Certi?cation I declare under penalty of perjury that'this inventory is correct and was returned along with the original warrant to the Court. . Erecuring o?cerwignamre FBI Printed name and title Date: 10/30/2016 0: . .