Case Document 6 Filed 04/04/18 Page 1 of 11 A0 l06 (Rev. 04/10) Application for a Search Warrant STATLS CUURI for the District ot?Columbia ln the Mattcrofthe Search of (Brie [y describe the property to be searched or emf/j? the person by name and address) Case 1 12"?my880 Assigned To Magistrate Judge Alan Kay ASSign. Date 11/15/2012 1 . Ema? Account Description: Search And Seizure Warrant that is stored at premises controlled by AOL, Inc. APPLICATION FOR A SEARCH WARRANT l, a federal law enforcement officer or an attomc for the government, request a search warrant and state under (penalty ofpegury that have reason to believe that on the followmg person or property arterial"): person or desa-n'be the property to be searched an give its location) email account identified by user account that is stored by AOL, Inc., located at 22000 AOL Way, Dulles, Virginia and more fuliy described in ATTACHMENT A to this application located in the Eastern__ District of . Virginia m? there is now concealed (identify the person or describe the property to be seized): certain property, the disclosure of which is governed by Title 18, United States Code, Sections 2/01 through 2711, namely contents of electronic e~mails and other electronic data more fully described in ATTACHMENT A to this application The basis for the search under Fed. R. Cl'iln P. 4] (C) is (check one or more): I evidence ofa crime; contraband, fruits ot?crime, or other items illegally possessed; property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section Offense Description 18 U.S.C. 793 Unauthorized Disclosure of National Defense Information The application is based on these facts: see attached affidavit herein incorporated by reference as if fully restated Continued on the attached sheet. Delayed notice of 90 days (give exact ending date if more than 30 days: 3/15/2013 . is requested under 18 U.S.C. 310341, the basis of which is set forth on the attached sheet. M-J?ri i, i W. ,xri 2,123; J?s/ii. Applied/1T3 . Craig A. ringiello: Special Agent inted name itle Sworn to before me and Signed in my presence. Dzitc: .. - Alan Kay, United tates Magistrate City and state: Washington, D-C- Judge Printed name and title Case Document 6 Filed 04/04/18 Page 2 of 11 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH Case: 1 12?rth?85?30 THAT IS To . Magistrate Judge Alan Kay STORED AT PREMISES CONTROLLED BY #681ng Date 11/15/2012 AOL, INC. Description Search And Seizure Warrant AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT 1, Craig A. Moringiello, being first duly sworn, hereby depose and state as follows: I. INTRODUCTION AND AGENT BACKGROUND 1. I am a Speciai Agent with the Federal Bureau of Investigation (FBI), and have been since June, 2002. I have been assigned to the Counterinteiligence Division of the Washington Field Of?ce since December, 201 i. In the course of my duties as a Special Agent, i am responsible for investigating offenses involving espionage, illegaI agents of foreign powers, United States trade sanctions, unauthorized retention and disclosure ofclassified and national defense information, and media leaks in furtherance of national security offenses. As a result of this experience, I am familiar with the tactics, methods, and techniques of particular United States persons who possess, or have possessed a United States government security clearance and may choose to harm the United States by misusing their access to classi?ed information. 2. As a federal agent, I am authorized to investigate violations of laws ofthe United States and to execute warrants issued under the authority ofthe United States. The statements in this affidavit are based in part on information provided by the investigation to date and on my experience and background as a Special Agent ofthe FBI. The information set forth in this affidavit concerning the investigation at issue is known to me as a result of my own involvement in the investigation or has been provided to me by other law enforcement professionals. Because Case Document 6 Filed 04/04/18 Page 3 of 11 this affidavit is being submitted for the limited purpose of securing a search warrant, I have not included each and every fact known to me concerning this investigation. 3. This affidavit is made in support of an application for a warrant pursuant to 18 U.S.C. 2703 to compel AOL Inc, which functions as an electronic communications service and remove computing service, and is a provider to electronic communication and remove computing services (hereinafter or the located at 22000 AOL Way, Dulles, Virginia, to provide subscriber information, records, and the contents of wire and electronic communications pertaining to the accounts identi?ed as @aol.com hereinafter referred to as the SUBJECT ACCOUNT.I 4. For the reasons set forth below, I believe there is probable cause to conclude that the contents ofthe wire and electronic communications pertaining to the SUBJECT ACCOUNT, are evidence, fruits and instrumentalities of criminal violations of 18 U.S.C. 793 (Unauthorized Disclosure ofNational Defense Information). 5. Based on my training and experience, and discussions with the United States Department ofJustice, have learned that 18 U.S.C. 793(d) makes punishable, by up to ten years imprisonment, the willful communication, delivery or transmission of documents and information related to the national defense to someone not entitled to receive them by One with lawful access or possession ofthe same and with reason to believe that such information could be used to the injury ofthe United States or to the advantage of any foreign nation. Because this Court hasjurisdiction over the offense under investigation, it may issue the warrant to compel the PROVIDER pursuant to 18 U.S.C. 2703(a). See 18 U.S.C. 2703(a) governmental entity may require disclosure by a provider. . . pursuant to a warrant issued usmg the procedures described in the Federal Rules of Criminal Procedure by a court With jurisdiction over the offense under investigation . . 2 Case Document 6 Filed 04/04/18 Page 4 of 11 affiant that he had given the statement he is quoted as making to Reporter A. provided affiant with what Reporter A had given him as his (Reporter A?s) email address ([Reporter?s A first two letters of his ?rst name followed by the first four letters ofhis last name@[name of national newspaperlcom) and a telephone number. 16. I reviewed email records provided from another US. Government Agency (hereinafter ?Agency which contained corr65pondence between a national security public affairs officer with Agency (hereinafter ?Official and . in June 20l2, on the same day that the June 2012 article A was published, sent an email to Official Bl with the subject line ?On the record." ln the body of the email wrote ?What said on the record was that I would not talk about it. [Reporter clearly states that I would not talk about what happened while I was in government and I frankly didn?t know_(LJn_til_ Logay of course) what happened after I left. Of?cial Bl then forwarded the email to senior US. Govemment officials at Agency B. A senior U.S. Government official also at Agency (hereinafter ?Senior Official 82?) stated in reply, ?That?s not what [Reporter told me.? Senior Of?cial 132 had repeated contact with Reporter A prior to this email exchange. 17. have reviewed a document from Agency A?s Public Affairs Of?ce which contains telephone numbers and email addresses for Reporter BZ, and which were listed as follows: email address for Reporter Bl ([last name, first initial of Reporter ]@[domain name of national Reporter 82 ([last name, first initial OfReporter name ofnational newspaperjcom); and Reporter ([first namelast of national 18. have reviewed records from a different US. Government Agency (hereinafter Agency which had correspondence between Reporter A and U.S. Government of?cials. Case 1:12-mj-00880-AK Document 6 Filed 04/04/18 Page 5 of 11 Reporter A used email address ([Reporter A last name followed by the initials for National Newspaper 19. On or about August 10, 2012, the PROVIDER advised the FBI that the subscriber for the SUBJECT ACCOUNT was and that the SUBJECT ACCOUNT was created on December 12, 1995. 20. in October, 2012, on application from the United States Attorney for the District of Maryland, this Court issued an order pursuant to 18 U.S.C. ?2703(d) to AOL for the SUBJECT ACCOUNT. 21. On October 17, 2012, pursuant to that order, the PROVIDER produced transactional email information from the SUBJECT ACCOUNT. The data shows the following contact between the SUBJECT ACCOUNT and Reporter A?s national newspaper email and gmail account: DATE NUMBER 1 OF CONTACTS August 11, 2011 1 time August 14,2011 1 time 4 November 12, 2011 1 time November 14, 201 1 1 time November 15,2011 2 times November 17,2011 2 times February 7, 2012 1 time July 13. 2012 1 time Case 1:12-mj-00880-AK Document 6 Filed 04/04/18 Page 6 of 11 initial and last and Reporter D?s work email address ([Reporter D?s ?rst namelast news WONTH NUMBER OF CONTACTS December, 2010 3 times May, 20] 4 times June, 201 I 4 times July, 2011 time November, 20l 2 times March, 20l2 6 times 26. From my review of US. Government records pertaining to Reporter A?s email communications with US. Government officials, have learned that Reporter A sent email to US. Government of?cials asking them to con?rm quotes that he intended to use in his articles and books. Speci?cally, I reviewed several email messages Reporter A sent to US. Government of?cials seeking to con?rm speci?c quotes Reporter A intended to include in the June 2012 book. Additionally, Reporter A also sent emails to US. Government of?cials seeking to arrange meetings and interviews with those government of?cials, discussing information other government of?cials had already provided to him, and thanking US. Government of?cials for meeting with him. 27. In October, 2012, the FBI sent a preservation letter to AOL to preserve the SUBJECT ACCOUNT. In general, an e?mail that is sent to an AOL subscriber is stored in the subscriber?s ?mail box? on AOL servers until the subscriber deletes the e-mail. lfthe subscriber does not delete the message, the message can remain on servers inde?nitely. Even ifthe l0 Case Document 6 Filed 04/04/18 Page 7 of 11 subscriber deletes the e?mail, it may continue to be available on servers for a certain period oftime. BACKGROUND CONCERNING AOL 28. In my training and experience, 1 have learned that AOL provides a variety of on- line services, including e?mail access, to the public. AOL allows subscribers to obtain e?mail accounts at the domain name gmailcom, like the SUBJECT ACCOUNT. Subscribers obtain an account by registering with AOL. During the registration process, AOL asks subscribers to provide basic personal information. Therefore, the computers of AOL, Inc. are likely to contain stored electronic communications (including retrieved and unretrieved e?mail for AOL subscribers) and information concerning subscribers and their use of AOL services, such as account access information, e-mail transaction information, and account application information. In my training and experience, such information may constitute evidence ofthe crimes under investigation because the information can be used to identify the account?s user or users. IV. STORED WIRE AND ELECTRONIC COMMUNICATIONS: 29. 18 U.S.C 2701-27? is called the ?Electronic Communications Privacy Act." a. 18 U.S.C. Section 2703(a) provides, in part: i. A government entity may require the disclosure by a provider of electronic communication service ofthe contents of an electronic communication that is in electronic storage in an electronic communications systems for one hundred and eighty days or less, only pursuant to a warrant issued under the Federal Rules of Criminal Procedure or equivalent State Warrant. A government entity may require the disclosure by a provider of electronic communication that has been in electronic storage in an electronic communications systems for more than one hundred eighty days by the means available under subsection ofthis section. b. 18 U.S.C Section 2703(b) provides, in part: 11 Case 1:12-mj-00880-AK Document 6 Filed 04/04/18 Page government entity may require a provider of remote computing service to disclose the contents of any wire or electronic communication to which this paragraph is made applicable by paragraph (2) ofthis subsection- Without required notice to the subscriber or customer, ifthe government entity obtains a warrant issued using the procedures described in the Federal Rules of Criminal Procedure by a court with jurisdiction over the offense under investigation or equivalent State warrant; or . . . 2. Paragraph (1) is applicable with respect to any wire or electronic communication that is held or maintained on that service- a. On behalfof, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such remote computing service; and b. Solely for the purpose of providing storage or computer processing services to such subscriber or customer, ifthe provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing The Government may also obtain records and other information pertaining to a subscriber or customer of an electronic communication service or remote computing service by way ofa search warrant. [8 U.S.C. Section 2703(c)(l No notice to the subscriber or customer is required. 18 U.S.C. Section 2703(c)(2). l8 U.S.C. Section 27]] provides, in part: As used in this chapter-(l) the terms defined in section 2510 ofthis title have, respectively, the definitions given such terms in that section; and (2) the term ?remote computing service? means the provision to the public of computer storage or processing services by means of an electronic communication system. 18 U.S.C. Section 25l0 provides, in part: (8) ?Contents,? when used with respect to any wire, oral or electronic communication, includes any information concerning the substance, purport, or meaning of that communication; 4) ?electronic communication system? means any wire, radio, electromagnetic, photocptical, or photoelectronic facilities for the transmission of electronic communications, and any computer facilities or related electronic equipment for the electronic storage of such communications; (15) service? means any service which provides to users thereofthe ability to send or receive wire or electronic 12 Case Document 6 Filed 04/04/18 Page 9 of 11 communications; 7) ?electronic storage? means any temporary, intermediate storage ofa wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication. f. 18 U.S.C. Section 2703 provides in part: i. Notwithstanding section 3105 ofthis title, the presence ofan officer shall not be required for service or execution ofa search warrant issued in accordance with this chapter requiring disclosure by a provider of electronic communications service or remote computing service ofthe contents of communications or records or other information pertaining to a subscriber or customer of such service. V. ITEMS TO BE SEIZED: 30. Based on my training and experience, and the training and experience of other counterespionage agents, I believe that the information requested in Attachment A for the SUBJECT ACCOUNT will provide valuable information regarding the investigation ofthe June 2012 unauthorized disclosure of national defense information. The contents ofthe e-mails may help to establish further links between and Reporters A, Bl, BZ and as well as other members ofthe media to whom disclosure ofnational defense information is illegal. 3 l. Based on the foregoing, I request that the Court issue a search warrant with rCSpect to the PROVIDER in accordance with 18 U.S.C. Section 2703 using the procedures set forth in Attachment A to this search warrant. The will copy all ofthe files, records, and other documents for the SUBJECT ACCOUNT. Government agents will then review the copied material to search for evidence, fruits and instrumentalities of criminal violations of [8 U.S.C. Section 793. The original production from the PROVIDER will then be sealed. Case Document 6 Filed 04/04/18 Page 10 of 11 VI. REQUEST FOR BY PROVIDER: 32. Pursuant to 18 U.S.C. Section 27059(b), request that the Court enter an order commanding the PROVIDER not to notify any other person, including the subscriber ofthe SUBJECT ACCOUNT, ofthe existence ofthe warrant because there is reason to believe that noti?cation ofthe existence ofthe warrant will result in: (I) destruction ot?or tampering of evidence; (2) attempts to influence potential witnesses; or (5) otherwise seriously jeopardize the investigation. The involvement ofthe SUBECT ACCOUNT, as set forth above, is not public and I know, based on my training and experience, that subjects of criminal investigations will often destroy digital evidence ifthe subject learns of an investigation. Additionally, ifthe PROVIDER or other persons notify anyone that a warrant has been issued on the SUBJECT ACCOUNTS, the targets ofthis investigation and other persons may further mask their identity and activity and seriouslyjeopardize the investigation. VII. REQUEST FOR SEALING: 33. Because this investigation is continuing and disclosure of some ofthe details in this af?davit may compromise subsequent investigative measures to be taken in this case may cause the subject to ?ee, may cause the suspect to destroy evidence and/or may otherwise jeopardize this investigation, I respectfully request this affidavit, and association material seeking this search warrant be sealed until further order ofthis Court. Finally, I specifically request that the sealing order not prohibit information obtained from this warrant from being shared with other law enforcement and intelligence agencies. Case 1:12-mj-00880-AK Document 6 Filed 04/04/18 Page 11 of 11 CONCLUSION 34. Based on the foregoing, there is probable cause to believe that on the computer systems owned, maintained, and/or operated by AOL, Inc. there exists in, and related to, the SUBJECT ACCOUNT, evidence, fruits, and instrumentalities ofviolations of 18 U.S.C. Section 793 (Unauthorized Disclosure ofNational Defense Information). By this affidavit and application, I request that the Court issue a search warrant directed to AOL, Inc. allowing agents to seize the content of the SUBJECT ACCOUNT and other related information stored on the AOL, lnc. servers as detailed in Attachment A and following the search procedure also described in Attachment A. Respectfully submitted, Specia Agent Federal Bureau oflnvestigation Subscribeda .mz . (J .- 7 ALAN KAY UNITED STATES MAGISTRATE JUDGE