Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 1 of 18

OR\G\NAL
Approved:
NIEL C. RICHENTHAL

Before:

HONORABLE GABRIEL W. GORENSTEIN-: ( \ ""· ·T
•.r
United States Magistrate Judge . :··
Southern District of New York :--

i (1
/i ,,

C')
.
, '· ( )

U J.vl.tiLT O O

61

x

COMPLAINT
UNITED STATES OF AMERICA
- v.
NATALIE
a/k/a
a/k/a
a/k/a

Violations of
31 u.s.c. § 5322,
18 U.S.C. §§ 371 and 2

-

MAYFLOWER SOURS EDWARDS,
"Natalie Sours,"
"Natalie May Edwards,"
"May Edwards,"
Defendant.

- - - -

x

SOUTHERN DISTRICT OF NEW YORK, ss.:
EMILY P. ECKSTUT, being duly sworn, deposes and says that
she is a Special Agent with the Federal Bureau of Investigation
("FBI"), and charges as follows:
COUNT ONE
(Unauthorized Disclosure of Suspicious Activity Reports)
1.
From at least in or about October 2017, up to and
including in or about October 2018, NATALIE MAYFLOWER SOURS
EDWARDS, a/k/a "Natalie Sours," a/k/a "Natalie May Edwards,"
a/k/a "May Edwards," the defendant, an employee of a federal
government authority, willfully violated subchapter II of Title
31 and a regulation and order prescribed thereunder, namely
Section 1023. 320 ( e) ( 2) of Title 31 of the Code of Federal
Regulations, by disclosing Suspicious Activity Reports ("SARs"),
and information that would reveal the existence of a SAR, which
disclosure was not necessary to fulfill EDWARDS's official
duties, to wit, EDWARDS knowingly disclosed and described SARs,
which she obtained by virtue of her position as a Senior Advisor
at the United States Department of Treasury, Financial Crimes
Enforcement Network ("FinCEN"), including by electronically

..

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 2 of 18

sending images of such SARs to a member of the news media
("Reporter-1") via an encrypted application.
(Title 31, United States Code, Section 5322(a); Title 18, United
States Code, Section 2.)
COUNT TWO
(Conspiracy to Make Unauthorized Disclosures
of Suspicious Activity Reports)
2.
From at least in or about October 2017, up to and
including in or about October 2018, NATALIE MAYFLOWER SOURS
EDWARDS, a/k/a "Natalie Sours," a/k/a "Natalie May Edwards,"
a/k/a "May Edwards," the defendant, and others known and
unknown, willfully and knowingly did combine, conspire,
confederate, and agree together and with another to commit an
offense against the United States, to wit, to make unauthorized
disclosures of SARs and the existence of SARs, in violation of
Title 31, United States Code, Section 5322 and Title 31, Code of
Federal Regulations, Section 1020.320(e) (2).
3.
It was a part and an object of the conspiracy that
NATALIE MAYFLOWER SOURS EDWARDS, a/k/a "Natalie Sours," a/k/a
"Natalie May Edwards," a/k/a "May Edwards," the defendant, and
others known and unknown, would and did knowingly disclose and
describe SARs, which EDWARDS obtained by virtue of her position
as a Senior Advisor at FinCEN.
OVERT ACTS
4.
In furtherance of the conspiracy and to effect the
illegal object thereof, the following overt acts, among others,
were committed and caused to be committed:
a. On or about August 2, 2018, NATALIE MAYFLOWER
SOURS EDWARDS, a/k/a "Natalie Sours," a/k/a "Natalie May
Edwards," a/k/a "May Edwards," the defendant, exchanged
approximately 541 messages with Reporter-1 via a certain
encrypted application (the "Encrypted Application").
b. On various occasions between in or about October
2017 and in or about October 2018, EDWARDS transmitted files
containing or describing SARs to Reporter-1 via the Encrypted
Application.

2

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 3 of 18

c. Between on or about August 24, 2018 and October
2, 2018, a co-conspirator not named as a defendant herein ("CC1") exchanged approximately 301 messages with Reporter-1 via the
Encrypted Application.
d. On or about October 16, 2018, in an interview in
the Eastern District of Virginia with federal law enforcement
agents (the "Interviewing Agents"), EDWARDS initially concealed
her relationship with Reporter-1 and denied having any contacts
with the news media.
(Title 18, United States Code, Section 371.)
The bases for my knowledge and the foregoing charges
are, in part, as follows:
5.
I am a Special Agent with the FBI and have been so
employed for approximately four years. Within the FBI, I am
assigned to a squad focused on public corruption crimes
committed by government officials and others.
6.
I have been personally involved in the investigation
of this matter.
This Affidavit is based upon my personal
participation in the investigation, my review of law enforcement
records, and my conversations with other law enforcement agents.
Because this Affidavit is being submitted for the limited
purpose of demonstrating probable cause, it does not include all
the facts I have learned during the course of my investigation.
Where the contents of documents and the actions, statements, and
conversations of others are reported herein, they are reported
in substance and in part, except where otherwise indicated.
FinCENr Suspicious Activity Reportsr and Relevant Statutes

7.
The mission of FinCEN is to "safeguard the financial
system from illicit use and combat money laundering and promote
national security through the collection, analysis, and
dissemination of financial intelligence and strategic use of
financial authorities." 1
Among other things, FinCEN manages the
collection and maintenance of suspicious activity reports (more
commonly known as "SARs").
Under the Bank Secrecy Act of 1970
("BSA"), United States financial institutions and other parties
are required by law to generate SARs in order to report
potentially suspicious financial transactions, and to deliver
the SARs to FinCEN.
FinCEN in turn maintains a centralized
https://www.fincen.gov/about/mission.
3

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 4 of 18

database of the SAR data, which it makes available to law
enforcement pursuant to regulations and procedures that protect
the confidentiality of the information.
8.
Under the BSA and its implementing regulations,
disclosure of a SAR or its contents is unlawful.
Specifically,
31 C.F.R. § 1020.320(e) provides that "[a] SAR, and any
information that would reveal the existence of a SAR, are
confidential and shall not be disclosed except as authorized [by
law] . " Subsection 1020. 32 0 ( e) ( 2) prohibits employees or agents
of government authorities from "disclos[ing] a SAR, or any
information that would reveal the existence of a SAR, except as
necessary to fulfill official duties consistent with Title II of
the Bank Secrecy Act." Title 31, United States Code, Section
5322(a) imposes criminal penalties for willful violations of the
BSA and its implementing regulations, including the disclosure
of a SAR.

Unauthorized SAR Disclosures
9.
Together, the FBI and the United States Department of
Treasury-Office of Inspector General ("Treasury-OIG") have been
investigating a series of unauthorized disclosures of SARs and
SAR information occurring between in or about October 2017 and
continuing into at least mid-October 2018.
10.
From my participation in the investigation and my
conversations with other law enforcement agents involved in the
investigation, I have learned the following, in substance and in
part:
a. Treasury-OIG agents have identified a pattern of
unauthorized disclosures of SAR information appearing in the media
starting in or about October 2017 and continuing until in or about
the present (collectively, the "SARs Disclosures") .
Each of the
SARs Disclosures related to matters relevant to investigations
being conducted by the Office of the Special Counsel, the United
States Attorney's Office for the Southern District of New York,
and/or the National Security Division of the United States
Department of Justice, such as suspicious transactions relating to
Paul Manafort, Richard W. Gates, Russian diplomatic accounts, and
other matters.
b. The SARs Disclosures included the following:
i.
Between October 2017 and March 2018, a news
organization (the "News Organization"), headquartered in New York,
4

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 5 of 18

New York, published approximately twelve news articles containing
detailed information that appeared to track the contents of SARs
protected by
the
BSA
(collectively,
the
"SARs
Disclosure
Articles").
ii.
The articles were published on or about
October 29, 2017 (the "October 2017 Article"); November 14, 2017
(the "November 2017 Article"); January 17, 2018 (the "January 2018
Article"); February 19, 2018 (the "February 2018 Article"); and
March 16, 2018 (the "March 2018 Article"); July 31, 2018 (the "July
2018 Article"); August 10, 2018 (the "First August 2018 Article");
August 29, 2018 (the "Second August 2018 Article"); September 12,
2018 (the "First September 2018 Article"); September 21, 2018 (the
"September 21, 2018 Article"); and October 15, 2018 (the "October
2018 Article") .
Reporter-1 was listed as an author (though not
always the only author) of all of the SARs Disclosure Articles.
iii.
The October 2017 Article claimed that the News
Organization "has learned specific details about 13 [] wire
transfers" related to Paul Manafort "all of which took place
between 2012 and 2013," and described that "[t]he transfers were
first flagged by US financial institutions, which are required by
law to tell an office within the Treasury Department about any
transactions they deem suspicious" in the form of "suspicious
activity reports."
iv.
The November 2017 Article was entitled "Secret
Finding: 60 Russian Payments To Finance Election Campaign Of 2016,"
and also referenced "suspicious activity reports" and their
findings.
v.
Similarly, the January 2018 Article referred
to detailed financial "[r]ecords reviewed exclusively by [the News
Organization]" related to financial transactions involving the
Russian Embassy, stating that "[t] he Treasury Department turned
over the suspicious activity reports to the FBI" after "[e]ach of
these transactions sparked a 'suspicious activity report' sent to
the US Treasury's financial crimes unit [that is, FinCEN] by
Citibank, which handles accounts of the Russian Embassy," and
citing to a "US official with knowledge of the inquiry."
vi.
likewise

The February 2018 Article and March 2018
Article
specifically referenced "suspicious activity
reports" ~ssociated with Paul Manafort in detail, and the March
2018 article specifically discussed actions taken by FinCEN with
respect to the reports.

5

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 6 of 18

vii.
The July 2018 Article was entitled "Russian
'Agent' And a GOP Operator Left a Trail of Cash, Documents Reveal."
The July 2018 Article described in extensive detail a series of
financial
transactions derived from bank records allegedly
involving a political consultant and Mariia Butina, who was
indicted on or about July 17, 2018 in the United States District
Court for the District of Columbia for acting as an unregistered
foreign agent and conspiracy to commit the same.
The July 2018
Article described "suspicious transactions cited by the bank and
federal investigators," "none of which have been made public."
Based upon my training, experience, and my conversations with other
law enforcement agents involved in the investigation, I believe
that these references indicate that the data in the July 2018
Article was obtained from SARs.
viii.
The First August 2018 Article was entitled
"GOP Operative Made 'Suspicious' Cash Withdrawals During Pursuit
of Clinton Emails."
The First August 2018 Article discussed
specific financial
transactions made by an individual who
purportedly launched an independent effort in 2016 to obtain emails
belonging to Hillary Clinton from Russian hackers.
For example,
the First August 2018 Article claimed that "[a]fter scouring nine
accounts that [the individual] controlled, Northern Trust turned
over documents showing 8 8 suspicious cash withdrawals totaling
about $140,000 between January 2016 and April 2017, including a
$3,000 withdrawal six days after the election" and noted that "the
bank sent a report to Treasury's financial crimes unit, which
shared its findings with the FBI, special counsel Robert Mueller,
and Senate Intelligence Committee investigators." Based upon my
training,
experience,
and my conversations with other law
enforcement agents involved in the investigation, I believe that
the data in the First August 2018 Article was obtained from SARs.
ix.
The Second August 2018 Article was entitled
"Here's Why the FBI and Mueller Are Investigating 'Suspicious'
Transactions by Russian Diplomats." The article, which discussed
suspicious transactions by, among others, a previous Russian
ambassador to the United States, noted that "Citibank sent
information that it compiled about [the ambassador's] and the
[Russian] embassy's accounts to the US Treasury Department's
financial crimes unit [that is, FinCEN] and the FBI in early 2017,"
and discussed the details of two specific financial transactions
- one approximately 10 days after the U.S. presidential election,
and another five days after the U.S. presidential inauguration.
The article cited "three federal law enforcement sources with
direct knowledge of the matter" as its sources.
Based upon my
training,
experience,
and my conversations with other law
6

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 7 of 18

enforcement agents involved in the investigation, I believe that
these references indicate that the data in the Second August 2018
Article was obtained from SARs.
x.
The First September 2018 Article was entitled
"A Series of Suspicious Money Transfers Followed the Trump Tower
Meeting."
The article discussed "secret documents reviewed by
[the News Organization]," and specifically referenced "two bursts
of transactions that bank examiners deemed suspicious" involving
a weal thy Russian family-one of whom had allegedly arranged a
meeting
at
Trump
Tower
between
a
Russian
national
and
representatives of the Trump campaign during the 2016 presidential
campaign (the "Trump Tower Meeting")-and their business associates
in the aftermath of the Trump Tower Meeting. The article revealed
the dates, amounts, and parties involved in the transactions in
extensive detail, specifically stating that the transactions were
identified after "bankers filed 'suspicious activity reports' to
the Treasury Department's Financial Crimes Enforcement Network
[that is, FinCEN], which in turn shared them with the FBI, the
IRS, congressional committees investigating Russian interference,
and members of special counsel Robert Mueller's team." The article
cited "four federal law enforcement officials" as its sources.
Based upon my training, experience, and my conversations with other
law enforcement agents involved in the investigation, I believe
that these references indicate that the data in the First September
2018 Article was obtained from SARs.
xi.
The September 21, 2018 Article was entitled
"The Planners Of The Trump Tower Meeting Moved Millions, And
Mueller Is Now Investigating."
Referring to "[d] ocuments reviewed
by [the News Organization]," the September 21, 2018 Article
described "suspicious transactions" of approximately $3.3 million
relating to "a billionaire real estate developer close to both
Vladimir Putin and President Donald Trump," among others,
occurring in or around June 2016, close in time to the Trump Tower
Meeting. The September 21, 2018 Article specifically noted "[t]he
details unearthed by bankers were compiled in "suspicious activity
reports" sent to the Treasury Department's Financial Crimes
Enforcement Network [that is, FinCEN], which shared them with other
law enforcement agencies investigating Russian interference."
Based upon my training, experience, and my conversations with other
law enforcement agents involved in the investigation, I believe
that these references indicate that the data in the September 21,
2018 Article was obtained from SARs.

How

a

xii.
The October 2018 Article was entitled "Here's
Major Western Bank Enabled A Suspected Russian Money
7

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 8 of 18

Launderer." The October 2018 Article related to Prevezon Alexander
( "Prevezon") , an entity charged in a previous civil forfeiture
case in the Southern District of New York relating to an alleged
Russian money laundering scheme in which an investment company
(the "Investment Company") was among the victims, among other
things.
The October 2018 Article discussed a loan made by a
particular banking institution to a Prevezon subsidiary, and noted
that "[t] he records of this transaction, which have never been
publicly reported, were unearthed by the US Treasury Department's
financial crimes unit [that is, FinCEN] during investigations by
Congress and special counsel Robert Mueller, both of whom are
digging into Russia's interference in the 2016 election." Based
upon my training, experience, and my conversations with other law
enforcement agents involved in the investigation, I believe that
these references indicate that the data in the October 2018 Article
was obtained from SARs.
11. Based upon my conversations with other law enforcement
agents who have reviewed the SARs Disclosure Articles described
above, I have learned that several of the SARs Disclosure
Articles described various transactions occurring in or through
New York, New York, and ref er to reports made by financial
institutions with offices in New York, New York.
Overview of EDWARDs' Access to and Unlawful Disclosure of SARs

12.
As described in more detail below, there is probable
cause to believe that NATALIE MAYFLOWER SOURS EDWARDS, a/k/a
"Natalie Sours," a/k/a "Natalie May Edwards," a/k/a "May
Edwards," the defendant, without authorization, provided some or
all of the SARs Disclosures to Reporter-1 for publication, and
was aware that a purpose of at least certain of such SARs
Disclosures was for publication by the News Organization.
Specifically, for the reasons set forth below, I believe that:
a.
EDWARDS began communicating with Reporter-1 in or
about July 2017.
b.
EDWARDS had access to all of the SARs implicated
by the SARs Disclosures.
Between in or about October 2017 - the
month when the SARs Disclosures began - and January 2018,
EDWARDS saved thousands of FinCEN files, including all of the
SARs implicated by the SARs Disclosures, to a flash drive
provided to her by FinCEN.
c.
Throughout the course of 2018, EDWARDS engaged in
hundreds of electronic communications with Reporter-1, many via
8

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 9 of 18

an encrypted application. A review to date, pursuant to a
judicially-authorized search warrant executed today, of
EDWARDS's personal cellphone has revealed that that cellphone
contains the substance of many of these communications,
including, as described in greater detail below, communications
in which EDWARDS transmitted or described SARs or other BSAprotected information to Reporter-1.
d.
When questioned by law enforcement officials
earlier today, EDWARDS confessed that she had provided SARs to
Reporter-1 via an encrypted application, though falsely denied
knowing that Reporter-1 intended to or did publish that
information through the News Organization. At the time she was
questioned, EDWARDS was also in possession of a flash drive that
appeared to be the same drive on which she saved the SARs
related to the SARs Disclosures, among other files.
EDWARDS's Access to SARs

13. Based on my conversations with other law enforcement
agents who have reviewed emails obtained from a government email
address assigned to NATALIE MAYFLOWER SOURS EDWARDS, a/k/a
"Natalie Sours," a/k/a "Natalie May Edwards," a/k/a "May
Edwards," the defendant (the "EDWARDS Work Account") and
electronic files maintained by FinCEN, I have learned that
EDWARDS has access to certain electronic folders maintained on
FinCEN's network that contain many, if not all, of the SARs at
issue in the SARs Disclosures.
14. Based upon my conversations with other law enforcement
agents who have consulted with Treasury analysts who conducted a
forensic review of government computer usage by NATALIE
MAYFLOWER SOURS EDWARDS, a/k/a "Natalie Sours," a/k/a "Natalie
May Edwards," a/k/a "May Edwards," the defendant, and certain
records from Treasury's networks, and Treasury staff regarding
the electronic equipment issued by FinCEN to EDWARDS, I have
learned the following, among other things:
a.
Prior to in or about January 2017, at least one
government-issued external flash drive (the "Flash Drive") was
provided to EDWARDS for work purposes.
b.
Through forensic analysis to date, FinCEN has been
able to identify records reflecting that more than 24,000 files
were saved to the Flash Drive between approximately January 2017
and approximately January 2018 (the "Flash Drive Files").
The
majority of the files were saved to a folder on the Flash Drive
9

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 10 of 18

entitled "Debacle - Operation-CF," and subfolders bearing names
such as "Debacle \Emails \As shat."
EDWARDS is not known to be
involved in any official FinCEN project or task bearing these file
titles or code names.
c.
Based upon my
conversations
with
other
law
enforcement agents who have spoken with FinCEN analysts, who have
in turn, reviewed the names of the Flash Drive Files, and conducted
a comparison of those file names/sizes to records contained on
FinCEN's network, the Flash Drive Files appear to contain thousands
of SARs, along with other highly sensitive material relating to
Russia, Iran, and the terrorist group known as the Islamic State
of Iraq and the Levant (more commonly known as "ISIL" or "ISIS"),
among other things.
Multiple files also bear labels referencing
Paul Manafort and Reporter-l's name.
d.
Based upon the same, it appears that the Flash Drive
Files include all of the SARs implicated by the SAR Disclosures
published by the News Organization. Available data indicates that
these SARs were first saved to the Flash Drive by at least on or
about October 18, 2017
approximately 11 days prior to the
publication of the first SAR Disclosure, that is, the October 2017
Article. Additional files relating to SARs were saved to the Flash
Drive again on or about January 8, 2018.
15. Through my conversations with other law enforcement
agents who have spoken with EinCEN staff, I have been informed
that there is no known legitimate business purpose for NATALIE
MAYFLOWER SOURS EDWARDS, a/k/a "Natalie Sours," a/k/a "Natalie
May Edwards," a/k/a "May Edwards," the defendant, to save the
large quantity of Flash Drive Files, and particularly, the SARs
related to the SARs Disclosures, to the Flash Drive.
EDWARDS's Communications with Reporter-]

16. Based on my conversations with other law enforcement
agents who have reviewed emails obtained pursuant to a
judicially-authorized search warrant on a web-based personal
email account believed to be used by NATALIE MAYFLOWER SOURS
EDWARDS, a/k/a "Natalie Sours," a/k/a "Natalie May Edwards,"
a/k/a "May Edwards," the defendant (the "EDWARDS Personal

10

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 11 of 18

Account"), 2 I have learned that Reporter-1 first contacted
EDWARDS in or about July 2017 seeking information regarding an
issue that did not implicate the SARs Disclosures.
17. Based upon my conversations with other law enforcement
agents who have reviewed phone records for a personal cellphone
subscribed to by NATALIE MAYFLOWER SOURS EDWARDS, a/k/a "Natalie
Sours," a/k/a "Natalie May Edwards," a/k/a "May Edwards," the
defendant (respectively, the "EDWARDS Phone Records" and the
"EDWARDS Cellphone"), I have learned, in part, that:
a. On or about February 14, 2018, approximately five
days prior to the publication of the February 2018 Article, the
EDWARDS Phone sent approximately four text messages to a cellphone
associated with Reporter-1 (the "Reporter-1 Cellphone").
b. On or about July 27,
2018,
days before the
publication of the July 2018 Article, the EDWARDS Cellphone placed
a
phone
call
to
the
Reporter-1
Cellphone,
beginning
at
approximately 3:43 p.m. and lasting approximately 15 minutes.
c. On or about August 2, 2018, approximately two days
after the publication of the July 2018 Article and approximately
one week before the publication of the First August 2018 Article,
the EDWARDS Cellphone placed a phone call to the Reporter-1
Cellphone, beginning at approximately 9:08 p.m. and lasting more
than 23 minutes.
d. On or about August 3, 2018--approximately seven
days before the publication of the First August 2018 Article-several short calls, each lasting less than one minute, were
exchanged between the EDWARDS Cellphone and the Reporter-1
Cellphone, beginning at approximately 9:54 a.m. At approximately
10:11 a.m., the EDWARDS Cellphone received a phone call lasting
more than five minutes from the Reporter-1 Cellphone.
e. On or about August 17, 2018, approximately one week
after the publication of the First August 2018 Article and
approximately 12 days before the publication of the Second August
2018 Article (discussed further below), the EDWARDS Cellphone
Among other things, subscriber information relating to the
EDWARDS Personal Account identifies the subscriber as "May E,"
and search warrant results have revealed that the user of the
EDWARDS Personal Account routinely introduces herself as "Dr.
May Edwards," and describes herself as a FinCEN employee with a
professional background matching that of EDWARDS.

2

11

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 12 of 18

placed a phone call to the Reporter-1 Cellphone, which began at
approximately 11:43 p.m. and lasted nearly 40 minutes.
f. On or about September 7, 2018, approximately five
days prior to the publication of the First September 2018 Article,
the EDWARDS Cellphone placed a phone call to the Reporter-1
Cellphone, which began at approximately 1:25 p.m. and lasted for
nearly three minutes.
18. Based upon my training, experience, my conversations
with other law enforcement agents with training and experience
in cyber technology, and my conversations with law enforcement
agents who have reviewed records received in response to a
judicially-authorized pen register and trap and trace order for
the EDWARDS Cellphone (the "EDWARDS Pen"), I have learned, among
other things, that:
a. The EDWARDS Cellphone utilized a mobile messaging
service that utilizes end-to-end encryption
(the "Encrypted
Application"), that is, a method of secure communication that
prevents
third-parties
from
accessing
data,
including
the
companies that host the end-to-end encrypted services, and law
enforcement.

six hours
the July
exchanged
with the
time span

b. On or about August 1, 2018, within approximately
of the EDWARDS Pen becoming operative--and the day after
2018 Article was published--the EDWARDS Cellphone
approximately 70 messages via the Encrypted Application
Reporter-1 Cellphone during an approximately 20-minute
between 12:33 a.m. and 12:54 a.m.

c. Between on or about July 31, 2018 and August 2,
2018, the EDWARDS Cellphone and the personal cellphone of CC-1
exchanged dozens of messages via the Encrypted Application.
d. On or about August 2, 2018, approximately one week
prior to the publication of the First August 2018 Article, the
EDWARDS Cellphone exchanged approximately 541 messages with the
Reporter-1 Cellphone via the Encrypted Application.
e. On or about August 10, 2018, the day of the
publication of the First August 2018 Article, the EDWARDS Cellphone
and the Reporter~l Cellphone exchanged approximately 11 messages
via the Encrypted Application.

12

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 13 of 18

f. On or about August 15, 2018, the EDWARDS Cellphone
exchanged approximately 14 messages with the Reporter-1 Cellphone
via the Encrypted Application.
CC-l's Communications with Reporter-1

19.
Based on my participation in the investigation and my
conversations with other law enforcement agents who have
reviewed documents obtained in the investigation to date, I have
learned that CC-1 is an Associate Director of FinCEN to whom
NATALIE MAYFLOWER SOURS EDWARDS, a/k/a "Natalie Sours," a/k/a
"Natalie May Edwards," a/k/a "May Edwards," the defendant,
reports.
20.
Based on my conversations with other law enforcement
agents who have reviewed phone records for a cellphone
documented in FinCEN records as the personal cellphone number
for CC-1 (the "CC-1 Cellphone"), I have learned that in or about
October 2017 - i.e., the month of the October 2017 Article
containing SARs Disclosures - the CC-1 Cellphone exchanged
approximately 325 text messages with the Reporter-1 Cellphone.
21.
Based upon my conversations with other law enforcement
agents who have reviewed records to date in response to a
judicially-authorized pen register and trap and trace order for
the CC-1 Cellphone, I have learned, in part, that:
a. On or about August 15, 2018, the CC-1 Cellphone
exchanged approximately 10 messages with the Reporter-1 Cellphone
via the Encrypted Application.
b. Between on or about August 24, 2018 and October 2,
2018, the CC-1 Cellphone exchanged approximately 301 messages with
the Reporter-1 Cellphone via the Encrypted Application.
The Interview and Search of EDWARDS

22.
Based upon my conversations with the Interviewing
Agents, I have learned that today, after the Interviewing Agents
identified themselves, and stated, in sum, that they wished to
speak with NATALIE MAYFLOWER SOURS EDWARDS, a/k/a "Natalie
Sours," a/k/a "Natalie May Edwards," a/k/a "May Edwards," the
defendant, the following conversation took place, in substance
and in part:

13

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 14 of 18

a.
Initially, EDWARDS denied having any contact
with any member the news media, but indicated that she was aware
that CC-1 and another FinCEN employee ("Employee-1") were in
contact with the news media.
b.
Upon direct questioning regarding Reporter1, EDWARDS changed her account, and admitted that, on numerous
occasions, she accessed SARs on her computer, photographed them,
and sent those photographs to Reporter-1 using the Encrypted
Application.
c.
EDWARDS further admitted to meeting
Reporter-1 in person on at least two occasions.
d.
EDWARDS claimed not to have read the SARs
Disclosure Articles published by Reporter-1, and claimed no
knowledge that the SAR information she disclosed to Reporter-1
was published. As set forth below, information relating to
EDWARDS's Internet usage demonstrates that this statement is
false. 3
23.
Based upon my conversations with the Interviewing
Agents, I have further learned that, in connection with the
above-described interview and pursuant to a judiciallyauthorized search warrant, law enforcement agents conducted a
search of NATALIE MAYFLOWER SOURS EDWARDS, a/k/a "Natalie
Sours," a/k/a "Natalie May Edwards," a/k/a "May Edwards," the
defendant, and recovered an electronic storage media item
believed to be the Flash Drive as well as at least one
cellphone, believed to the EDWARDS Cellphone.
24.
Based upon my conversations with other law enforcement
agents who have reviewed to date results from the judiciallyauthorized search of the cellphone seized today from NATALIE
MAYFLOWER SOURS EDWARDS, a/k/a "Natalie Sours," a/k/a "Natalie
May Edwards," the defendant, I have learned the following, among
other things:
3

During the interview described herein, EDWARDS told the
Interviewing Agents, in sum and substance, that she is a
"whistleblower" who provided the SARs to Reporter-1 for "record
keeping." Based on my participation in this investigation and
my conversations with other law enforcement agents, I am aware
that, prior to the SARs Disclosures, EDWARDS had previously
filed a whistleblower complaint unrelated to the SARs
Disclosures, and that EDWARDS had also reached out to
congressional staffers regarding, among other things, her
unrelated whistleblower complaint.
14

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 15 of 18

a. On various occasions between in or about October
2017, up to and including in or about October 2018, EDWARDS
transmitted the following items and information, among others,
via the Encrypted Application, to Reporter-1:
i.
SARs, including but not limited to SARs
related to the SARs Disclosures published by the News
Organization;

ii.
Files and spreadsheets reflecting SAR data,
including data relating to the existence of SARs;
iii. The results of searches by EDWARDS for
whether SARs had been filed with respect to certain people or
entities, in which Reporter-1 appeared interested;
iv.
FinCEN internal emails appearing to relate
to SARs or other information protected by the BSA; and
v.
FinCEN non-public memoranda, including
Investigative Memos and Intelligence Assessments published by
the FinCEN Intelligence Division, which contained confidential
personal, business, and/or security threat assessments,
including those marked "Law Enforcement Sensitive" and that
contained BSA-protected information.
b. For example, in one exchange, EDWARDS appeared to
send Reporter-1 a series of approximately five spreadsheet
files, all containing SAR identifying numbers in the file
titles.
EDWARDS then appeared to send a 465-page file labeled
"Paul Manafort [] request from Senate Select Committee on
Intelligence.pdf" (the "Manafort File"). As sent by EDWARDS,
the Manaf ort File appeared to display an image of an actual SAR
on the face of the message to Reporter-1.
c. As noted above, the October 2018 Article
regarded, among other things, Prevezon and the Investment
Company. As recently as September 2018, EDWARDS and Reporter-1
engaged in the following conversation, via the Encrypted
Application, in relevant part:

15

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 16 of 18

EDWARDS:

I am not getting any hits on [the CEO
of the Investment Company]
do you have any idea what the
association is
if I had more information i could
search in different areas

Reporter-1:

If not on his name it would be [the
Investment Company]. That's the only
other one
[The CEO] is associated with Prevezon
Well not associated
His company is [the Investment Company]

d. Based upon my training and experience, my
participation in the investigation, and my conversations with
other law enforcement agents familiar with the investigation, I
believe that in the above conversation, EDWARDS was explaining
that she had performed searches of FinCEN records relating to
Prevezon, at Reporter-l's request, in order to supply SAR
information for the October 2018 Article.
e. In addition, in multiple communications, EDWARDS
and Reporter-1 referenced CC-1, and Reporter-1 expressed that
Reporter-1 was also in contact with CC-1.
25.
Subsequent to the interview and search described
above, NATALIE MAYFLOWER SOURS EDWARDS, a/k/a "Natalie Sours,"
a/k/a "Natalie May Edwards," a/k/a "May Edwards," the defendant,
was placed under arrest.
EDWARDS's Personal Email Account

26.
Based on my conversations with other law enforcement
agents who have reviewed to date the contents and other
information of the EDWARDS Personal Account, the data described
above, and publicly-available information, I have learned that:

16

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 17 of 18

a. On or about August 3, 2018, NATALIE MAYFLOWER
SOURS EDWARDS, a/k/a "Natalie Sours," a/k/a "Natalie May
Edwards," a/k/a "May Edwards," the defendant, sent an email from
the EDWARDS Personal Account to another web-based email account
bearing the name of Reporter-1, stating in the Subject line:
"Can you add," followed by, in the text of the email, "The
others if there are others to this file . . . " The email
attached a document listing the titles and Internet links for
the October 2017 Article, the November 2017 Article, and the
January 2018 Article, among other things.
b. Internet search history records relating to the
EDWARDS Personal Account reflect, among other things, that:
i.
On or about October 30, 2017, approximately
one day after the October 2017 Article was published, the user
of the EDWARDS Personal Account ran an Internet search for
"these 13 wire transfers are a focus of the fbi probe into
paul," and seconds later, visited the News Organization website
to view the October 2017 Article.
The title of the October 2017
Article was "These 13 Wire Transfers Are A Focus of the FBI
Probe Into Paul Manafort."
ii.
On or about February 20, 2018, approximately
one day after the February 2018 Article was published, the user
of the EDWARDS Personal Account ran an Internet search for
"manafort under scrutiny," and seconds later, visited the News
Organization website to view the February 2018 Article. The
February 2018 Article was entitled "Manafort Under Scrutiny for
$40 Million in 'Suspicious Transactions.'"
iii. On or about August 31, 2018, approximately
two days after the publication of the Second August 2018
Article, the user of the EDWARDS Personal Account ran an
Internet search for "[Reporter-1] articles."

17

 Case 1:18-mj-08861-UA Document 1 Filed 10/16/18 Page 18 of 18

WHEREFORE, deponent prays that an arrest warrant for
NATALIE MAYFLOWER SOURS EDWARDS, a/k/a "Natalie Sours," a/k/a
"Natalie May Edwards," a/k/a "May Edwards," the defendant, be
issued and that EDWARDS be arrested and imprisoned, or bailed,
as the case may be.
...,

~

/tMJ:LY P. ECKSTUT
Vspecial Agent
Federal Bureau of Investigation

October,

ORABLE GABRIEL W.

NSTEIN
JUDGE
SOUTHERN DISTRICT OF NEW YORK

f uvJ ;,c,._.f-f.. ~

18

I...

Ca..k

I'. Cf. /