I. HLED A0 91 (Rev. 08/09) Criminal Complaint 1?23 4 tian= UNITED STATES DISTRICT COURT SUSAN v. mm for the U. 8. DISTRICT COURT Northern District of California STRICT OF CALIFORNM United States of America V. John C. Fry, Case NoDefendanta) CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best of my knowledge and belief. On or about the date(s) of from May 2018 to June 2018 in the county of San Francisco in the Northern District of California the defendant(s) violated: See attachment. Code Section O?ense Description 31 U.S.C. 5322(a) Unauthorized disclosure of suspicious activity reports. Approved as to form: A AUS?AJi?mberly Hopkins This criminal complaint is based on these facts: See attached AFFIDAVIT in support of criminal complaint. El Continued on the attached sheet. 71? Complainant? .9 Signature Linda Cieslak, Special Aqent Printed name and title Sworn to'bcfore me and signed in my presence. Date: all? ?(9027 I Judge ?S.signature City and state: San Francisco, California Hon. Laurel Beeler, U.S. Magistrate Judge Printed name and title AFFIDAVIT IN SUPPORT OF APPLICATION FOR A CRIMINAL COMPLAINT I, Linda Cieslak, Special Agent of the US. Department of Treasury, Treasury Inspector General for Tax Administration, being duly sWor-n, do declare and state INTRODUCTION 1. I make this affidavit. in support of a criminal complaint for John C. FRY for the unauthorized disclosure of stispicious activity reports, in violation of '31 U.S.C. 5322(a). 2. I am a Special Agent with the US. Department of Treasury, Treasury Inspector General for Tax Administration and have been since May 2018. I am assigned to the Western Field Division in Oakland, California. My duties and responsibilities include- investigations of fraud, waste, and abuse related to the Internal Revenue Service My duties also include investigations of IRS personnel for criminal and administrative violations relating to Internal Revenue Laws (Title 26 of the United States Code) andvarious criminal offenses related to Title 18 of the United States Code. 3. My academic qualifications include a Masters of Accounting degree, with an emphasis in Information Assurance, from the University of New Mexico. I am a Certi?ed Public Accountant in the state of California. My professional training includes completion of the intensive Criminal Investigator Training Program at the Federal Law Enforcement Training Center in Georgia. The CITP included training in the fields of Administrative Law, Federal Criminal Law, Courtroom Testimony, Evidence, Documentation, RepOrt Writing, and Investigative Techniques. Prior to my employment as a Special Agent, I was employed as an Information Technology Auditor with O?ice of Audit for approximately two years. In this position, I was responsible for the oversight of the. information technology systems security. Additionally, I have. completed forensic accounting internships for the United States Securities and Exchange Commission and the United States Attorney?s Of?ce for the District of New Mexico. 4. The facts in this affidavit come from my personal participation in this investigation, my training and experience, and information obtained from other agents and witnesses. Statements. of individuals are set forth as summaries unless otherwise indicated. This af?davit is intended to Show merely that there is suf?cient probable cause for the requested complaint and does not set forth all of my knowledge abOut this matter. 5. Based on my training and experience and the facts set forth in this af?davit, there is prObable cause. to believe that FRY has committed the unauthorized disclosure of suspicious activity reports, in violation of 31 U.SC. 5322(a). LEGAL BACKGROUND 6. The Financial Crimes Enforcement Network is a bureau of the United States Department of Treasury that collects and analyzes information about ?nancial transactions. inCEN?s mission is to ?safeguard the ?nancial system from illicit use and combat money laundering and promote national security through the collection, analysis, and dissemination of ?nancial intelligence and strategic use of ?nancial authorities.?1 Among other things, manages the collection and maintenance of Suspicious Activity Reports- Under the Bank Secrecy Act United States ?nancial institutions and other parties are required by law to generate SARS in order to report potentially suspicious ?nancial transactions, and to deliver SARS to in turn maintains a centralized database of the SAR data, which it makes available to law enforcement pursuant to regulations and procedures that protect the confidentiality of the information. 7. Under the BSA and its implementing regulations, the disclosure of a SAR or its contents is unlawful. Speci?cally, 31 C.F.R ?1020.320(e) provides that SAR, and any information that would reveal the existence of a SAR, are con?dential and shall not be disclosed except as authorized [by law].? Subsection prohibits employees or agents of. government authorities from a SAR, or any information that would reveal the existence of a SAR, except as necessary to. ful?ll of?cial duties consistent with Title II of the Bank Secrecy Act.? Title 31, United States Code, Section 5322(a) imposes criminal penalties fOr 1 willful violations of the BSA and its implementing regulations, including the disclosure of a STATEMENT OF PROBABLE CAUSE A. Introduction 8. TIGTA is investigating a series of unauthorized disclosures of SARs and SAR information that appeared in the media in May of 2018. Speci?cally, SAR information regarding Michael Cohen appeared in the Washington Post on May 7, 2018 and in the New Yorker described in more detail below, there is probable cause to believe that the unauthorized disclosure of SARS and SAR information were made by John FRY, an Investigative Analyst for the law enforcement arm, the Criminal Investigation Division FRY has worked for the IRS since 2008 and currently works in the San Francisco of?ce. His current responsibilities include supporting IRS Agents in the Northern District of California area and reviewing SARs for activity that could potentially lead to a criminal investigation. In this position, he has access to various law enforcement databases, including Palantir, which is an analytic software used by C1 to integrate investigative data from multiple internal and. external data sources, and the Integrated Data Retrieval System which is a database containing tax information. B. Overview of Access to and Unlawful Disclosure of SARs 10. On May 4, 2018, John FRY logged onto the Palantir database from his work computer and conducted numerous searches related to Michael Cohen, the then?personal attorney of Donald Trump. At approximately 2:54 FRY accessed and downloaded five SARS, according to ?le data from a Palantir download found on work computer. I reviewed the five SARs and learned the following: 2 I confirmed that the SAR information set forth below appeared in media reports in May of 201 8. a. SAR Identi?cation Number 1234?): First Republic Bank ?led SAR 1234. The SAR pertained to continuing suspicious activity involving a bank account opened for Essential Consultants LLC. The SAR revealed. that Michael Cohen completed the paperwork to Open the account and noted Cohen as the listed owner of Essential Consultants, a real estate consulting company. Cohen stated that the primary source of funds would be from United States or United States based companies, there would be no outgoing Wire transfers, and that he expected no more than 20 credits totaling $10,000 a month. The SAR revealed numerous suspicious credits to the bank account, including a payment from'Korea Aerospace Industries for $150,000, four payments from totaling $200,000, four payments ?orn Novaitis Investments totaling $399,920, and eight/payments ?cm Columbus Nova totaling $500,000. The SAR noted that Columbus Nova is a company af?liated witha Russian Oligarch that donated money to President Trump?s inauguration fund in January 2017. During the course of the investigation, I learned that the SAR was a continuation of two SARs previously ?led by First Republic Bank about Essential Consultants, SAR Identi?cation Number 8133?) and another SAR with an unmentioned SAR number. I learned this additional SAR to be number 9426?). The suspicious activity across the three SARs which occurred from October 2016 to January 2018, totaled $4,425,033.46. b. SAR Identi?cation Number 0026?): City National Bank ?led SAR. 0026. The SAR discussed an account maintained by K.D. The SAR noted that on October 27, 2016, K.D. received an incoming Wire from?Essential Consultants totaling $130,000. The SAR also discussed four additional wire transfers K.D. received from EB. totaling $3 87,500. 0. SAR Identi?cation Number 9342?): JP Morgan Chase Bank ?led SAR 9342. The SAR noted the October 27, 2016 Wire for $130,000 ?om EsSential Consultants to City National Bank account. d. Identi?cation Number 3016?): Morgan Stanley Smith Barney, LLC, ?led SAR 3016. The SAR discussed two accounts maintained by Cohen. The SAR noted that ?om July 13, 2017 through September 8, 2017, Cohen deposited three checks in the amounts of $505,000, $250,000, and. $250,000 into. his accounts. The checks were remitted from an account held at First Republic Bank in the name of Essential Consultants, LLC. e. SAR Identi?cation Number **1841 1841?): Standard Chartered Bank ?led SAR 1841. The SAR discussed possible fraudulent and illegal ?nancial transactions by ?Michael Cohen, during 2016 and 201.7, in Singapore, Hungary, Malaysia, Canada, Taiwan, Kenya, and Israel. 11. Immediately after downloading the ?ve SARs, John FRY placed two outgoing calls from his personal cellphone to The ?rst phone call at 3:11 pm. lasted approximately four minutes. The second phone call at 3:15 pm. lasted approximately seven and a half minutes. A records check revealed that the phone number was associated with Michael Avenatti, an attorney based in Newport Beach, California. 12. Shortly thereafter, at approximately 3 :38 FRY logged onto the database from his work computer and conducted additional searches related to Michael Cohen. I reviewed system logs ?om May 4, 2018. The system logs showed the SAR information FRY accessed, the search terms he used to access the information, and the dates and times of access. I learned that FRY ?rst conducted a ?quick search? for SAR 8133, and that the SAR was listed as unavailable in the system. During the course of the investigation, I learned that SAR 8133 ?led on October 4, 2017, and SAR 9426 ?led on June 16, 2017, were giVen ?restricted access? on the System in October and August 2017, respectively, because they were related to a sensitive Open investigation. I also learned that ?restricted access,? means that a S-AR is not available for viewing by registered users in the system. Instead, a use-r must already know of a existence and contact with a justi?cation to view the SAR information. While the quick search did not produce SAR 8133, the search produced a related SAR, SAR 1234, which FRY accessed. FRY also appeared to use personal identifying information contained in SAR 1234 to conduct additional targeted searches on including searches using Cohen?s driver?s license and personal bank account numbers, and bank account numbers for Korea Aerospace, Essential Consultants, and Real Estate Attorneys. 13. On May 7, 2018, FRY logged onto the database from his work computer and conducted another ?quick search? for SAR 8133. Again, FRY was unable to access SAR 8133 because it was restricted. FRY then conducted a general search related to Cohen and Essential Consultants. FRY appeared to browse the search results, but did not view a particular SAR at that time. Minutes later, FRY searched speci?cally for SARs ?led by First Republic Bank on October 4, 2017. From this search, FRY viewed a SAR ?led by First Republic Bank on October 4, 2017, that was unrelated to Essential Consultants. FRY then conducted searches using First Republic Bank?s tax employee identi?cation number, Essential Consultants? tax employee identi?cation number, the term Essential Consultants, Cohen?s social security number, and variations of the term First Republic. FRY also searched for SARs ?led by First Republic Bankbetween October 4 and October 6, 2.017. 14. Later that afternoon, according to telephone records I reviewed, FRY placed an outgoing phone call from his personal cellphone to Michael Avenatti. The call lasted more than six minutes. 1.5. On May 8, 2018, Michael Avenatti used his public Twitter account to circulate a dossier releasing con?dential banking information related to Cohen and his company Essential Consultants. The Tweet read, ?The Executive Summary from our ?rst Preliminary Report on Findings may be accessed via the link below. Mr. Trump and M. Cohen have a lot of explaining to do.? After reviewing the dossier, I learned that it discussed the same suspicious activity detailed in the ?ve SARs accessed and downloaded by FRY on May 4, 2018. For instance, the dossier reported that on October 27, 2016, Cohen wired $130,000 from the Essential Consultant?s bank account at First Republic Bank to BID. The dossier also noted the complex. set of transactions involving Essential Consultant?s bank account, including credits to Essential Consultants? bank account from Korea Aerospace, Novartis Investments, and Columbus Nova, and detailed payments from Essential Consultants? bank account to Cohen?s personal bank account at Morgan Stanley. 16. On May 8, 2018, the Washington Post published an article titled ?How Much lowed Through Michael Cohen?s Multi?Purpose Shell Company.? The article discussed in detail the claims about Cohen?s banking history made public in .Avenatti?s dossier. The: article noted that Avenatti declined to reveal the source of his information, stating: ?The source or sources of our information is our work product, and nobody ?8 business. . . .They can investigate all they want, but what they should. be doing is releasing to the American public the three Suspicious Activity Reports filed on Michael Cohen?s account. . . .Why are they hiding this information?? 17. On May 12, 2018, FRY placed an outgoing phone call from his personal cellphone to telephone number 750. The call began at 1:30 p.111. and lasted approximately 42 minutes. A records check revealed that the phone number is associated with Reporter~1. 18. Between May 12, 2018 and June 8, 2018, FRY and Reporter?1 exchanged 57 WhatsApp messages. Based on my training and experience, I know WhatsApp is a messaging and Voice over Internet Protocol (V 011?) service that allows users to create an account associated with their phone number. The service provides end?to?end for users to send text I messages, voice calls, video calls, images and other media, documents, and user location. On May 14, 2018, Reporter-1 sent FRY the following WhatsApp messages3: 3 On November 27, 2018, I obtained a federal search warrant for cellphone. See CR (N .D. Cal). A forensic image of cellphone revealed a phOne number listed in the contacts section under the name of Reporter-l. The forensic image also revealed communications between FRY and Reporter?l via WhatsApp. I learned that both FRY and Reporter-1 appeared to be using WhatsApp IDs that corresponded to their telephone numbers. 5/14/18, 8 :37 AM Reporter 1: ?Let?s all keep talking about the full reveal of your story, and I will keep you updated on the more immediate story about the missing SARS where I?m quoting you anonymously in the mean time.? 5/14/18, 8:38 AM Reporter 1: ?(This is a .few days old but I assume you noticed - . the Inspector General said they?re looking into how 57 the info got. out, so maybe another point in the ?pro column for coming out guns blazing to get ahead of this)? 19. Later that day, Reporter?1 and FRY exchanged the following WhatsApp messages: 5/14/18, 4:01 PM 4 Reporter-1: ?Hi there do you have a- few minutes for a call in the next few hours? Want to run this article by you so you know exactly what?s going on at every step of this.? 5/14/18, 4:02 PM John Fry: ?Getting to leave the office in about 10 minutes. I can give you a call when I am in a more secure location, if that works. for you.? 20.- On May 16, 2018, the New Yorker published an article written by Reporter?1 titled, ?Missing Files Motivated the Leak of Michael Cohen?s Financial Records.? The article addressed the speculation about who leaked Cohen?s con?dential banking documents. The article reported that the source, identi?ed only as a law enforcement of?cer, spoke to Reporter?1 to explain his/her motivation for the leak. The source claimed to have grown alarmed after being unable to ?nd two important SARs regarding Cohen?s financial activity in a government database. The source reportedly conducted an ?exhaustive search? for the unavailable records and said, ?This is ,a permanent record. They should be there, and there is nothing there.? During the course of the investigation, I learned that the ?two important that FRY was referring to (SARs 8133 and 9426), had been granted restricted access. As such, the SARs were not available for viewing by FRY and/ or other registered users in the system. In order to view the SAR, FRY would have to contact with a justi?cation to view the SAR information. 21. On May 16, 2018 at 4:03 pm, Reporter?l sent FRY a WhatsApp message containing a link to the New Yorker article. FRY later responded: 5/16/18, 4:15, PM - John Fry: ?Thank you Thank you Thank you? 5/16/18, 4: 1 6 PM John Fry: ?Beautifully written, as I suspected it would be? 22. On or about October 4, 2018, I interviewed supervisor and learned that FRY should not be handling SARs from other geographic regions, such as New York, and would have no official reason in his capacity as an Investigative Analyst in San Francisco to view SAR records related to Cohen or Essential Consultants. I also learned that when FRY (or any analyst) researches SARs for an official purpose, that search would occur in conjunction with a search for information regarding the subjects in the Integrated Data Retrieval System IDRS logs shows what, if any, tax information FRY accessed, the search terms he used to access the information, and the dates and times that he accessed the tax information. I reviewed IDRS system logs and leanied that he neVer searched the database for Cohen, Clifford, or Essential Consultants. 23. supervisor also stated that FRY first mentioned that he observed ?interesting? SARS related to Cohen in August of 2018. His supervisor instructed FRY to send the SAR information to the IRS CI Office in New York, which he did. 24. On November 26, 2018, Assistant Special Agent in Charge Jason Pritchard and I met with FRY at the IRS CI office in San Francisco. FRY was advised of his rights, and he agreed to waive his rights and make a verbal and written statement. FRY confessed to verbally providing SAR information to Avenatti. FRY also admitted, that he sent Avenatti a screenshot of the narrative. FRY stated that Reporter-1 contacted him to verify the information supplied to Reporter?1 by Avenatti. CONCLUSION 25. Based on the above facts and based on my training and experience, I believe there is probable cause that John FRY, an employee of a federal government authority, violated 31 U.S.C. 5322(a) and (unauthorized disclosure of suspicious activity reports). 26. I respectfully request that this Complaint, any warrant issued pursuant thereto, and any related records, be ?led under seal until further order of the Court as the investigation is ongoing. An application and proposed sealing order is submitted herewith. CIESLAK Special Agent US. Department of Treasury, Treasury Inspector General for Tax Administration Sworn to and subscribed before me on ?1 2 2019. LAUREL BEELER United States Magistrate Judge ??10 A0 83 (Rev. 06/09) Sumino'ns in a Criminal Case UNITED STATES DISTRICTECOURT v? 9' 5% 2,7" "Vi-4 for the Northern District of California {4 United States of America 3 19 eerae John 0. Fry, A . Defendant SUMMONS IN A CRIMINAL CASE YOU ARE SUMMONED to appear before the United States district court at the time, date, and place set forth below to answer to one or more offenses or Violations based on the following document ?led with the court: Indictment Superseding Indictment Cl Information t3 Superseding Information MComplaint Cl Probation Violation Petition CI Supervised Release Violation Petition Cl Violation Notice l3 Order of Court United States District Courthouse Place. 450 Golden Gate Avenue San Francisco, CA 94102 Courtroom No.: C, 15th Floor Date and Time: 02/15/2019 9:30 am This offense is briefly described as follows: 31 U.S.C. 5322(a) Unauthorized disclosure of suspicious activity reports. . 4/ Date; Zia?iiol I Issumg o?icer ?5 Signature Hon. Laurel Beeler, U.S. Magistrate Judge Printed name and title I declare under penalty of perjury that I have: El Executed and returned this summons El Returned this summons unexecuted Date: Server ?5 Signature Printed name and title