April 4, 2019 Memorandum to the File By Lanny J. Davis, Michael Monico, Carly Chocron, attorneys for Michael Cohen Re: Evidence presented by Michael Cohen on Trump crimes presented to congressional committees I. Trump’s involvement in a conspiracy to collude with Russian government intervention in his favor during the 2016 presidential campaign and obstruct justice through lies and cover-up; and II. Other felony crimes committed by Trump before and after he became president. 1 Table of Contents Legal Definitions – circumstantial evidence; criminal conspiracy; criminal obstruction of justice; and overt acts I. Trump’s circumstantial evidence of collusion and obstruction of justice evidence A. Four circumstantial facts – strong inferences of Trump involvement in conspiracy to collude with Russians to tilt the election in his favor and lies and obstruction of justice to cover-up that conspiracy 1. Trump knowledge of June 9, 2016 Trump Tower meeting – on its face, a conspiracy by campaign officials to collude with Russian government to tilt election in Trump’s favor 2. Trump’s Air Force One lie about the June 9 Trump Tower meeting’s true purpose 3. The July 2016 Roger Stone phone call and Trump’s reaction to it 4. Trump and his advisors encouraging Cohen to lie to congress about Moscow Trump Tower contacts through June 2016 after Trump is the putative GOP nominee B. Other acts of obstruction and lies to prevent truth from coming out in collusionconspiracy investigation 1. Witness intimidation and tampering 2. Use of possibility of pardons to “dangle” in front of Cohen and other potential witnesses against Trump to keep them “loyal” and not ready to cooperate with prosecutors II. Trump crimes exposed by Cohen during February 27, 2019 House Oversight Committee (and other congressional testimony) [references are to exhibits to and page numbers from Cohen’s opening statement/testimony before House Oversight Committee] • February 27, 2019 House Oversight Committee testimony 1. Exhibits 1a, 1b, and 1c, p. 11: Trump financial statements used by Trump to inflate and deflate assets to suit his personal and business purposes 2. Exhibit 2, p. 11: Newspaper articles demonstrating fraudulent inflation and deflation of such assets in financial statements 3. Exhibits 3a and 3b, p. 12: Fraudulent use of phony bidder in art auction of Trump portrait – reimbursed by Trump Foundation funds 4. Exhibit 4, p. 13: Record of Cohen’s $130,000 wire transfer to Stephanie Clifford (aka Stormy Daniels) as pay-off of hush money and cover-up to avoid tracing back to Trump or his organization 2 5. Exhibit 5a, p. 13: President Donald Trump-signed personal check from his own account while president to reimburse Cohen for illegal hush money scheme and cover-up, already found to have been crimes by federal prosecutors from SDNY Exhibit 5b, p.14: $35,000 check, also to implement the illegal hush money scheme to silence Ms. Daniels, signed by Donald Trump Jr. and written from the Trump Trust Fund 6. Exhibit 6, p. 15: Copy of sample letter sent to Trump’s high school, college, business school, and SATs threatening civil and criminal sanctions if Trump grades/scores released 7. Exhibit 7, p. 15: Newspaper article quoting Trump in 2011 calling on President Obama to release grades 8. Exhibit 8, p. 19: Tweets from Trump that personally attack Cohen as an attempt to intimidate a witness 9. Exhibit 9, p. 20: Tweet by House Speaker Nancy Pelosi, in effect warning Trump to cease attempting to intimidate or tamper with congressional witnesses. Appendix: Indictment as to United States of America v. Viktor Borisovich Netyksho, et al. (This July 13, 2018 indictment from the Office of Special Counsel against the Russian Intelligence Service and various officials spells out specifically the US crimes that are committed, and specific statutes violated, by a conspiracy to corrupt the US elections through computer hacking and misinformation—crimes that Mr. Cohen’s evidence, per his testimony, strongly suggests that Trump committed through his connection with Russian activities, including the Trump Tower meeting.) 3 Legal definitions: circumstantial evidence; criminal conspiracy; criminal obstruction of justice; and overt acts --circumstantial evidence: Circumstantial evidence, which the law views as the same as evidence, is evidence that leads to a “strong inference” of a fact, and there is no other reasonable alternative inference that is non-criminal or innocent. Example: Before you go to sleep, a jury is informed there was no snow on the ground. When you wake up, a jury is told there is snow all over the neighborhood. The jury could and would likely “convict,” beyond a reasonable doubt, on the “unavoidable inference” that it snowed overnight — even though there is no “direct” evidence by your own eyewitness testimony that it did. --criminal conspiracy: When two or more people decide on a plan to commit one or more criminal acts, and any one of the participants in the plan commits an “overt act” – an act to implement or encourage the criminal plan to occur – then all participants and all who know about the conspiracy are guilty of the underlying crime, even if they commit no acts at all and even if no crime is ever committed. Section 18 U.S.C. 371 defines conspiracy to commit offense or to defraud United States as, “If two or more persons conspire either to commit any offense against the United States, or to defraud the United States, or any agency thereof in any manner or for any purpose, and one or more of such persons do any act to effect the object of the conspiracy, each shall be fined under this title or imprisoned not more than five years, or both.” --criminal obstruction of justice: Any effort to impede or block a proceeding regarding the investigation of a crime, such as an investigation by a prosecutor, grand jury, or law enforcement, by means of lying, suborning of perjury, intimidation of witnesses or other actions to thwart discovery of the facts and evidence, pursuant to 18 U.S.C. 1505, 18 U.SC. 1510, 18 U.S.C. 1512, and 18 U.S.C. 1513. Obstruction of justice is in and of itself a crime – but it also is motivated by an effort to cover-up an underlying crime, such as criminal collusion with a foreign government to interfere with and corrupt a U.S. election. --overt act: An overt act could be a public statement that helps advance the criminal plan. For example, if the alleged conspiracy were to work with the Russian government to illegally hack into US computers to assist Donald Trump and harm Hillary Clinton, an “overt act” criminalizing all conspirators would be if Mr. Trump publicly asked the Russians to “please” hack into Clinton’s emails and publish them; or if a key member of his campaign team met with Russian officials to promise them there would be no sanctions if Trump were elected. Once there is such an overt act, then all participants in, or those knowledgeable about, the conspiracy could be guilty of the crime of conspiracy. 4 I. Cohen evidence showing a conspiracy to collude with Russia to interfere in US election and to obstruct justice by lying and attempting to impede investigations of that conspiracy. A. Four circumstantial facts provided and documented by Cohen, with strong inferences supporting collusion and obstruction: 1. Trump knowledge of the June 9, 2016 Trump Tower meeting: Don Jr. statement to Trump at meeting in Trump office days before the meeting.1 Early in June 2016, Cohen testified that he was in Trump’s office. He saw Don Jr. walk around the desk (unusual to do so) to lean over to tell his father quietly: “The meeting is on.” Trump did not ask, “what meeting?” Cohen heard Trump say, “That’s good…let me know.” (see pp. 17-18, Cohen February 27, 2019 testimony before House Oversight Committee). Exhibit (1) – see pp. 17-18, House Oversight Committee (“HOC”) 2-27-19 testimony Strong inferences: Trump knew about the Trump Tower meeting with the Russians and knew its purpose was for the Russian government to help Trump and harm Clinton in the election. Cohen testified that Trump frequently said his son Don Jr. had the “worst judgment of anyone in the world.” It is unlikely such a meeting would have been organized by Jr. without telling his Dad. And why didn’t he ask, “what meeting?” unless he knew about and approved the Trump Tower meeting ahead of time. 2. Trump’s Air Force One lie about the Trump Tower meeting’s true purpose. Cohen testified regarding a meeting with Alan Garten, general counsel of the Trump Organization, when Garten told Cohen about various back-and-forth discussions between Trump and officials on Air Force One concerning what Don Jr. should say about the June 9, 2016 Russian Trump Tower meeting. Note: on its face, this meeting is evidence at least of a conspiracy to collude with the Russian government to help Trump and to harm Hillary Clinton. Senior campaign officials and family members attended: Manafort, Kushner, Don Jr.; one other attendee was a senior official identified in an email as representing the Russian government (and later identified as having ties to Russian intelligence). Additionally, the emails preceding the meeting to Don Jr. and circulated to all who attended stated that the purpose of the meeting was to provide “dirt on Hillary” and that the Russian government favored Trump; Don Jr. replied, “love it” – which is acceptance of a “thing of value” (“dirt on Hillary”) from a foreign government to influence a presidential election, and furthermore is evidence of a crime under US campaign finance laws. The Office of Special Counsel, in its July 13, 2018 indictment against the Russian Intelligence Service and various officials, spelled out specifically the US crimes that are committed, and specific statutes violated, by a conspiracy to corrupt the US elections through computer hacking and misinformation. (See appendix.) https://en.wikisource.org/wiki/U.S._v._Viktor_Borisovich_Netyksho,_et_al. These crimes include Conspiracy to Commit an Offense Against the United States, 18 USC. 371; fraud and related activity in connection with computers, 18 USC 1030(a)(2)(C) and 1030(c)(2)B); et. al. 1 5 Garten told him about the lie decided upon to describe the meeting – that it was just about “adoption.” Cohen said that he and Garten by then knew that was a lie, subsequently confirmed when Don Jr. released the emails and had to admit that the earlier cover story on “adoption” was untrue. Later, Trump spokespersons were forced to admit that not only did Trump know this explanation was a lie, but he “dictated” the lie from Air Force One. Strong inference: Since Trump lied about the purpose of this meeting, there is a strong inference that he had something to hide – and that he knew about the true purpose of the meeting: A plan to “collude” with the Russian government to harm Clinton’s campaign with “dirt” and to help his own. 3. The Roger Stone Call (p. 10). In mid-July 2016, Cohen was in Trump’s office when Trump received a phone call from Roger Stone. Trump took the call with Stone over the speakerphone box in Trump’s office, while Cohen was present. Stone told Trump he had just spoken with Assange, head of “WikiLeaks,” the Russian-controlled intelligence services agency, and that there would be a “massive dump of emails” from the DNC server. Trump did not ask his attorney, Cohen, “Is it legal to hack into emails, and if it is illegal, shouldn’t we call the FBI? I don’t want to win the election as a result of illegal hacking by the Russians using WikiLeaks.” No – instead, what he said to Stone, according to Cohen, was something like, “wouldn’t that be great?” Then afterwards, he asked Cohen whether Stone could be believed. Of course, Trump didn’t tell Stone to call WikiLeaks and tell them not to do this release of DNC emails that came from illegal hacking, engineered through a Russian agency called WikiLeaks. The unavoidable inference: Trump approved of the illegal hacking as helping his campaign and covered up what was clearly a crime. In addition, Trump’s denials of Russian interference in the campaign that worked in his favor to harm Clinton remain lies to this day. 4. Trump encouraged Cohen to lie to congress on Trump Moscow Tower Project (see 18 U.S.C. 1622 Subornation of perjury).2 Note: Cohen pleaded guilty to lying to the Senate and House Intelligence Committees when he stated in written and verbal testimony that he had no contacts with Russians about the Moscow Trump Tower project after January 31, 2016 – the day before the Iowa caucuses, i.e., the official beginning of the 2016 presidential campaign. Cohen testified that he and Trump both knew that Cohen’s contacts with Russia continued for months after that date. Cohen also testified in 2019 that he was given that false “party line” by Mr. Trump and his advisors. Mr. Cohen shared the facts contained in this section with the Senate and House Intelligence Committees but cannot reveal the direct testimony publicly. 2 6 Cohen testimony and facts: • During the campaign, and well after the February 1 Iowa caucuses, Cohen continued to brief Trump on the contacts with Russia. Trump was so blatant in his lies to his core supporters that Cohen testified at times he would hear Trump at campaign rallies telling attendees, “No Russia, no Russian contacts, no Russian deals…” – and then shortly thereafter, he would talk to or call Cohen and ask, “What’s going on in Russia with the Tower Project?” Trump knew that Cohen had exchanged many calls and text messages with a Russian-American named Felix Sater about the project. Trump knew Sater since they had partnered in a hotel project in the SoHo neighborhood of NYC. And Trump gave Sater free office space in the NYC Trump Tower building not too far from Trump’s personal office. Yet Trump subsequently and blatantly lied in a deposition, subsequently made public in the media, when he falsely claimed (under oath during the deposition) not to know Sater, that he wouldn’t know Sater if he “fell over him.” Why lie about what is easily proven to be a lie – that Trump knew who Sater was? And why risk committing perjury in a sworn deposition? • In May 2016, Cohen told Trump he could travel to Russia to assist the building of the project either before or after the GOP Convention in August, and Trump agreed. Obviously this proves that Trump knew that Russian contacts about the Moscow Tower project continued after January 31, 2016. Cohen made inquiries about Trump’s schedule to Trump’s executive assistant about the Russian trip (as further evidence that the trip to Russia was under serious consideration after Trump approved it), but the trip never took place. • When Cohen had to submit testimony to the House and Senate Intelligence Committees in the fall of 2017, Trump and his WH advisors encouraged Cohen to lie and say all Moscow Tower project contacts ended as of January 31, 2017. Trump did so using “code” language – telling Cohen during various conversations that there was “no collusion, no Russian contacts, nothing about Russia” after the start of the campaign. • In September 2017, Cohen’s criminal defense attorney submitted a public document urging that Cohen receive no prison time. Cohen’s defense counsel, a well-known former senior prosecutor in the Southern District of New York, stated, based on his knowledge of the evidence, that Cohen’s lie to congress about the false January 31, 2016 cut-off date for contacts with Russians regarding the Trump Moscow Tower Project was “in accordance with…[Trump’s] directives.” The word “directive” is a strong word. Note that this expression was used publicly, in a public document filed with the court by Cohen’s defense counsel, and there was no objection by either the prosecutors from the SDNY or the Special Counsel’s office to 7 this use of the telling phrase that Cohen lied to congress “in accordance with… [Trump’s] directives.”3 • Trump knew with certainty that Cohen continued to discuss the Moscow Trump Tower project well beyond January 31, 2016. Yet after the testimony, Cohen received a call from Trump’s attorney, who congratulated him on the testimony – and said his “client” was happy with Cohen’s testimony. • Trump’s family also knew about Cohen’s lie to congress on the January 31, 2016 cutoff date: ▪ ▪ ▪ Cohen testified that he kept Trump’s family briefed during the campaign on his Moscow Trump Tower project contacts with Russians beyond that cut-off date. He testified about receiving an email from Ivanka Trump in the fall of 2015, forwarding an email from the wife of a former Russian weight-lifting champion about Ivanka sponsoring a health spa at the top of the Moscow Trump Tower. Ms. Trump also said she wanted a star architect to build the Moscow Tower. Cohen testified that Ms. Trump knew about his ongoing contacts with Sater beyond that cut-off date as well. Inference: Ms. Trump knew that Cohen had lied to congress about that date and yet did not report him to law enforcement authorities for perjury. Overall strong inferences from Trump and associates’ overall and intense effort to persuade Cohen to commit crime of lying to congress. Cohen explained that he was, in effect, instructed to lie about the January 31, 2016 date through the use of Trump code words that could only be interpreted as an instruction or “directive” (as Cohen’s defense attorney put it, without public objection by the Southern District of New York prosecutors) to cover-up the fact that Cohen had been in contact with Russians during most of the presidential campaign, from the day of the Iowa caucuses, February 1, through all the primaries and caucuses and until June 2016, after Trump had become the putative Republican nominee by assembling a majority of delegates. Why would Trump and top advisors go through such dangerous efforts to encourage Cohen’s lie to congress – knowing that they could expose themselves to criminal charges of suborning perjury – unless they were worried about a Russia connection and a conspiracy to collude being known to American people? This shows a desire to cover up and lie to the American people about Russian contacts and attempted deal-making over Moscow Tower during the campaign. Note, this is not far off the words used by the Buzzfeed reporters – that Trump “directed” Cohen to lie in his congressional testimony vs. Cohen’s false statement to Congress, i.e., there were no Russian contacts after January 31, 2016, the day before the Iowa caucuses. Cohen’s false statement was made “in accordance with … [Trump’s] directives.” 3 8 B. Other acts of obstruction of justice to block investigations and true testimony: 1. Witness intimidation and tampering pursuant to 18 U.S.C. 1512– see Exhibit 8, p. 19, Cohen February 27, 2019 testimony before House Oversight Committee. And Exhibit 9, tweet by House Speaker Nancy Pelosi, in effect warning Trump to cease attempting to intimidate or tamper with congressional witnesses. Also, Rep. Elijah Cummings (D.-Md), chair of the House Oversight Committee, and Rep. Adam Schiff (D.-Cal), chair of the House Permanent Select Committee on Intelligence, issued a similar warning against Trump’s attempted witness intimidation and threat against Mr. Cohen. https://oversight.house.gov/news/pressreleases/cummings-and-schiff-statement-on-intimidation-of-michael-cohen • Prior to Cohen’s voluntary testimony to House Oversight and Reform Committee and House Intelligence Committee, Trump and his lawyer, Giuliani, used Twitter and TV interviews to attack Cohen and his family, such as when Trump called Cohen a “rat” in a tweet while praising those who resisted “flipping.” See Exhibit 8, p. 19 • Trump also attacked Cohen’s wife and father-in-law. (Contrast with quotes from Trump and Giuliani praising Cohen in the past and expressing sympathy for him especially after the FBI’s April 2018 raid on Cohen’s home, law office, safe deposit box and other personal items, such as his children’s cell phones). Inference: Trump and Giuliani trying to keep Cohen from telling the truth because they are afraid of the truth. 2. Use of pardons to “dangle” in front of potential witnesses to encourage them to “stay in the tent” and not tell the truth.4 A. Trump attorney John Dowd was reported by The New York Times as discussing possible pardons with Paul Manafort and Michael Flynn, with inference that the pardons would occur if they didn’t “flip” and volunteer testimony to the Special Counsel.5 B. Various text messages between a New York attorney who claims he is a close friend of Rudy Giuliani, Trump’s attorney, and Cohen, promising that Giuliani and “friends in high places” could be helpful to Cohen and that, at a meeting, this attorney discussed the possibility of Cohen being pardoned.6 Further discussion of the “dangling” of possibility of a pardon for Mr. Cohen when he was still part of the “lying” team to protect Donald Trump cannot be further disclosed here in greater detail, since this subject was included in testimony before the Senate and House Intelligence Committees. 5 https://www.nytimes.com/2018/03/28/us/politics/trump-pardon-michael-flynn-paul-manafort-john-dowd.html 6 Information disclosed in this section cannot be disclosed in greater detail since this matter is under investigation by prosecutors. 4 9 II. Other evidence of crimes presented by Cohen during February 27 House Oversight Committee hearing [references are to exhibits to and page numbers from Michael Cohen’s opening statement/testimony] 1. Exhibits 1a, 1b, and 1c, p. 11 – financial statements dated 2011, 2012, 2013 with invented numbers, at times inflated to suit his ego and business purposes and at times to deflate to underpay taxes. See Washington Post article. https://www.washingtonpost.com/graphics/2019/politics/trump-statements-of-financialcondition/?utm_term=.b8747ad68f53 • Possible crimes: Federal bank fraud pursuant to 18 U.S.C. 1344; commercial fraud; tax evasion pursuant to 26 U.S.C. 7201. 2. Exhibit 2, p. 11: Two newspaper articles demonstrating Trump’s fraudulent over-inflation of assets to try to be ranked higher on the Forbes “wealthiest” list; and understating his assets in order to reduce property taxes owed. • Possible crimes: Fraud on state / local law for underpayment of property taxes. 3. Exhibits 3a and 3b, p. 12: Fraudulent use of phony bidder at an art auction to bid $60,000 for his own portrait and then reimbursed the phony bidder from Foundation funds. • Possible crimes: commercial fraud at art auction; possible state crimes for misuse of charitable foundation funds for improper purposes. 4. Exhibit 4, p. 13: The record of Michael Cohen’s wire transfer of $130,000 to Stephanie Clifford to illegally buy her silence so she would not disclose Mr. Trump’s affair with the adult film star in early November 2016, a few days before the election. There is no factual dispute that this is a felony – since the hush money payment was “directed” by Trump, according to federal prosecutors. And there was also an obstruction of justice and cover-up since Trump invented the reason for the $35,000/month “reimbursement” schedule (a word used by his attorney Rudy Giuliani) for a legal retainer, when in fact, as prosecutors found and Mr. Cohen testified, there never was any legal retainer agreement; that was an invention to cover-up the payments to Ms. Daniels. Mr. Trump was also found to have participated in an illegal hush money-campaign finance felony, along with Mr. Cohen, regarding buying the silence of Karen McDougal, with whom he had also had an affair. • Possible crimes: Violation of campaign finance laws pursuant to 52 U.S.C. 30116(a)(1)(A), 52 U.S.C. 30116(a)(7), 52 U.S.C. 30109(d)(1)(A); and 52 U.S.C. 30118(a); violation of laws regarding disclosure of campaign finance expenditures; conspiracy to obstruct justice by cover-up and use of invented legal retainer agreement to “reimburse” Mr. Cohen. 5. Exhibit 5a, p. 13 – a copy of a $35,000 check signed by Donald Trump from his personal account in August 1, 2017, seven months into his presidency, made out to Michael Cohen, one of 12 installments to “reimburse” Cohen for his hush money payments (implementing the criminal conspiracy that the federal prosecutors in the US SDNY found Trump had “directed”). 10 • Possible crimes: There is no question – none – that Donald Trump as president of the United States, while president, committed a felony when he signed that $35,000 installment check to Michael Cohen to continue the criminal conspiracy violating campaign finance laws through the payment of hush money and also to obstruct justice by inventing a cover story about a non-existent legal retainer. Exhibit 5b, p. 14— A $35,000 check dated March 17, 2017 and signed by Donald Trump Jr. and the Trump Organization Chief Financial Officer, Allen Weisselberg, made out to Michael Cohen. Exhibits 5A and 5B constitute two $35,000 installments implementing the criminal conspiracy. Except this check was written from the Trump Trust Fund, specifically set up to prevent Trump Organization funds and business activities from benefitting Donald Trump once he became president. • Possible crimes: There is no doubt that this check also is a crime and leaves Donald Jr. open to immediate indictment for conspiracy to violate campaign finance laws as well as Mr. Weisselberg (who may or may not have won immunity for such a charge, even though paid months after the immunity agreement with prosecutors was apparently reached). Also, Messers. Trump Jr. and Weisselberg may have violated NY State Trust laws by misusing the Trump Trust Fund for Trump’s personal purposes. 6. Exhibit 6, p. 15: A copy of a letter sent to the high schools, college, graduate school, and SAT/College Board threatening each with civil and criminal sanctions if they released Trump’s grades (and SAT scores.) 7. Exhibit 7, p. 15: In 2011, in contrast to Trump requiring Michael Cohen to write those threatening letters so no one would learn about his grades and SAT scores, Trump called President Obama “dumb” and a “terrible student” and called on him to release his grades: “Let him show his records,” he said. Possible crimes: While hypocrisy by a politician is not a crime, it is possible that Mr. Trump’s own supporters will find this example of his lying and hypocrisy – and boasts about how smart he is – troubling. 8. Exhibit 8, p. 19: Tweets from Trump that personally attack Cohen as an attempt to intimidate a witness. 9. Exhibit 9, p. 20: Tweet by House Speaker Nancy Pelosi, in effect warning Trump to cease attempting to intimidate or tamper with congressional witnesses. CONCLUSION: Michael Cohen’s congressional testimony contains evidence of at least 10 or more federal and state crimes. Michael’s testimony led to the subpoenaing of 80 individuals by the House Judiciary Committee and dozens of new congressional and state investigations. 11 His disclosure of a signed check by President Trump in August 2017 to reimburse Cohen for illegal hush money payments is more than just evidence: It is a fact that President Trump committed a felony while president when he signed these $35,000 checks to reimburse Michael Cohen. If he were not president, he would have been indicted and convicted of this crime. There is also no doubt that his son Don Jr. could now be indicted and probably almost certainly would be convicted for signing similar hush money checks from the Trump Trust Organization. Michael Cohen also knows and has shared additional evidence of crimes with the New York State Attorney General and tax authorities. He continues to cooperate with prosecutors at the Southern District of New York. He knows additional information of possible crimes relating to fraudulent insurance claims, the mishandling or misappropriation of tens of millions of dollars contributed to the Presidential Inaugural Committee, and possible federal campaign finance violations by the Republican National Committee, including possibly illegal conduiting of illegal substantial donations to the RNC by foreign nationals, including from China. 12 TESTIMONY OF MICHAEL D. COHEN COMMITTEE ON OVERSIGHT AND REFORM U.S. HOUSE OF REPRESENTATIVES FEBRUARY 27, 2019 Chairman Cummings, Ranking Member Jordan, and Members of the Committee, thank you for inviting me here today. I have asked this Committee to ensure that my family be protected from Presidential threats, and that the Committee be sensitive to the questions pertaining to ongoing investigations. Thank you for your help and for your understanding. I am here under oath to correct the record, to answer the Committee’s questions truthfully, and to offer the American people what I know about President Trump. I recognize that some of you may doubt and attack me on my credibility. It is for this reason that I have incorporated into this opening statement documents that are irrefutable, and demonstrate that the information you will hear is accurate and truthful. Never in a million years did I imagine, when I accepted a job in 2007 to work for Donald Trump, that he would one day run for President, launch a 1 campaign on a platform of hate and intolerance, and actually win. I regret the day I said “yes” to Mr. Trump. I regret all the help and support I gave him along the way. I am ashamed of my own failings, and I publicly accepted responsibility for them by pleading guilty in the Southern District of New York. I am ashamed of my weakness and misplaced loyalty – of the things I did for Mr. Trump in an effort to protect and promote him. I am ashamed that I chose to take part in concealing Mr. Trump’s illicit acts rather than listening to my own conscience. I am ashamed because I know what Mr. Trump is. He is a racist. He is a conman. He is a cheat. He was a presidential candidate who knew that Roger Stone was talking with Julian Assange about a WikiLeaks drop of Democratic National Committee emails. 2 I will explain each in a few moments. I am providing the Committee today with several documents. These include: • A copy of a check Mr. Trump wrote from his personal bank account – after he became president - to reimburse me for the hush money payments I made to cover up his affair with an adult film star and prevent damage to his campaign; • Copies of financial statements for 2011 – 2013 that he gave to such institutions as Deutsche Bank; • A copy of an article with Mr. Trump’s handwriting on it that reported on the auction of a portrait of himself – he arranged for the bidder ahead of time and then reimbursed the bidder from the account of his non-profit charitable foundation, with the picture now hanging in one of his country clubs; and • Copies of letters I wrote at Mr. Trump’s direction that threatened his high school, colleges, and the College Board not to release his grades or SAT scores. 3 I hope my appearance here today, my guilty plea, and my work with law enforcement agencies are steps along a path of redemption that will restore faith in me and help this country understand our president better. *** Before going further, I want to apologize to each of you and to Congress as a whole. The last time I appeared before Congress, I came to protect Mr. Trump. Today, I’m here to tell the truth about Mr. Trump. I lied to Congress about when Mr. Trump stopped negotiating the Moscow Tower project in Russia. I stated that we stopped negotiating in January 2016. That was false – our negotiations continued for months later during the campaign. Mr. Trump did not directly tell me to lie to Congress. That’s not how he operates. In conversations we had during the campaign, at the same time I was actively negotiating in Russia for him, he would look me in the eye and tell 4 me there’s no business in Russia and then go out and lie to the American people by saying the same thing. In his way, he was telling me to lie. There were at least a half-dozen times between the Iowa Caucus in January 2016 and the end of June when he would ask me “How’s it going in Russia?” – referring to the Moscow Tower project. You need to know that Mr. Trump’s personal lawyers reviewed and edited my statement to Congress about the timing of the Moscow Tower negotiations before I gave it. To be clear: Mr. Trump knew of and directed the Trump Moscow negotiations throughout the campaign and lied about it. He lied about it because he never expected to win the election. He also lied about it because he stood to make hundreds of millions of dollars on the Moscow real estate project. And so I lied about it, too – because Mr. Trump had made clear to me, through his personal statements to me that we both knew were false and through his lies to the country, that he wanted me to lie. And he made it 5 clear to me because his personal attorneys reviewed my statement before I gave it to Congress. **** Over the past two years, I have been smeared as “a rat” by the President of the United States. The truth is much different, and let me take a brief moment to introduce myself. My name is Michael Dean Cohen. I am a blessed husband of 24 years and a father to an incredible daughter and son. When I married my wife, I promised her that I would love her, cherish her, and protect her. As my father said countless times throughout my childhood, “you my wife, and you my children, are the air that I breathe.” To my Laura, my Sami, and my Jake, there is nothing I wouldn’t do to protect you. I have always tried to live a life of loyalty, friendship, generosity, and compassion – qualities my parents ingrained in my siblings and me since childhood. My father survived the Holocaust thanks to the compassion and selfless acts of others. He was helped by many who put themselves in harm’s way to do what they knew was right. 6 That is why my first instinct has always been to help those in need. Mom and Dad…I am sorry that I let you down. As many people that know me best would say, I am the person they would call at 3AM if they needed help. I proudly remember being the emergency contact for many of my children’s friends when they were growing up because their parents knew that I would drop everything and care for them as if they were my own. Yet, last fall I pled guilty in federal court to felonies for the benefit of, at the direction of, and in coordination with Individual #1. For the record: Individual #1 is President Donald J. Trump. It is painful to admit that I was motivated by ambition at times. It is even more painful to admit that many times I ignored my conscience and acted loyal to a man when I should not have. Sitting here today, it seems unbelievable that I was so mesmerized by Donald Trump that I was willing to do things for him that I knew were absolutely wrong. For that reason, I have come here to apologize to my family, to the government, and to the American people. *** 7 Accordingly, let me now tell you about Mr. Trump. I got to know him very well, working very closely with him for more than 10 years, as his Executive Vice President and Special Counsel and then personal attorney when he became President. When I first met Mr. Trump, he was a successful entrepreneur, a real estate giant, and an icon. Being around Mr. Trump was intoxicating. When you were in his presence, you felt like you were involved in something greater than yourself -- that you were somehow changing the world. I wound up touting the Trump narrative for over a decade. That was my job. Always stay on message. Always defend. It monopolized my life. At first, I worked mostly on real estate developments and other business transactions. Shortly thereafter, Mr. Trump brought me into his personal life and private dealings. Over time, I saw his true character revealed. Mr. Trump is an enigma. He is complicated, as am I. He has both good and bad, as do we all. But the bad far outweighs the good, and since taking office, he has become the worst version of himself. He is capable of behaving kindly, but he is not kind. He is capable of committing acts of generosity, but he is not generous. He is capable of being loyal, but he is fundamentally disloyal. 8 Donald Trump is a man who ran for office to make his brand great, not to make our country great. He had no desire or intention to lead this nation – only to market himself and to build his wealth and power. Mr. Trump would often say, this campaign was going to be the “greatest infomercial in political history.” He never expected to win the primary. He never expected to win the general election. The campaign – for him – was always a marketing opportunity. I knew early on in my work for Mr. Trump that he would direct me to lie to further his business interests. I am ashamed to say, that when it was for a real estate mogul in the private sector, I considered it trivial. As the President, I consider it significant and dangerous. But in the mix, lying for Mr. Trump was normalized, and no one around him questioned it. In fairness, no one around him today questions it, either. A lot of people have asked me about whether Mr. Trump knew about the release of the hacked Democratic National Committee emails ahead of time. The answer is yes. 9 As I earlier stated, Mr. Trump knew from Roger Stone in advance about the WikiLeaks drop of emails. In July 2016, days before the Democratic convention, I was in Mr. Trump’s office when his secretary announced that Roger Stone was on the phone. Mr. Trump put Mr. Stone on the speakerphone. Mr. Stone told Mr. Trump that he had just gotten off the phone with Julian Assange and that Mr. Assange told Mr. Stone that, within a couple of days, there would be a massive dump of emails that would damage Hillary Clinton’s campaign. Mr. Trump responded by stating to the effect of “wouldn’t that be great.” Mr. Trump is a racist. The country has seen Mr. Trump court white supremacists and bigots. You have heard him call poorer countries “shitholes.” In private, he is even worse. He once asked me if I could name a country run by a black person that wasn’t a “shithole.” This was when Barack Obama was President of the United States. 10 While we were once driving through a struggling neighborhood in Chicago, he commented that only black people could live that way. And, he told me that black people would never vote for him because they were too stupid. And yet I continued to work for him. Mr. Trump is a cheat. As previously stated, I’m giving the Committee today three years of President Trump’s financial statements, from 2011-2013, which he gave to Deutsche Bank to inquire about a loan to buy the Buffalo Bills and to Forbes. These are Exhibits 1a, 1b, and 1c to my testimony. It was my experience that Mr. Trump inflated his total assets when it served his purposes, such as trying to be listed among the wealthiest people in Forbes, and deflated his assets to reduce his real estate taxes. I am sharing with you two newspaper articles, side by side, that are examples of Mr. Trump inflating and deflating his assets, as I said, to suit his financial interests. These are Exhibit 2 to my testimony. 11 As I noted, I’m giving the Committee today an article he wrote on, and sent me, that reported on an auction of a portrait of Mr. Trump. This is Exhibit 3A to my testimony. Mr. Trump directed me to find a straw bidder to purchase a portrait of him that was being auctioned at an Art Hamptons Event. The objective was to ensure that his portrait, which was going to be auctioned last, would go for the highest price of any portrait that afternoon. The portrait was purchased by the fake bidder for $60,000. Mr. Trump directed the Trump Foundation, which is supposed to be a charitable organization, to repay the fake bidder, despite keeping the art for himself. Please see Exhibit 3B to my testimony. And it should come as no surprise that one of my more common responsibilities was that Mr. Trump directed me to call business owners, many of whom were small businesses, that were owed money for their services and told them no payment or a reduced payment would be coming. When I advised Mr. Trump of my success, he actually reveled in it. And yet, I continued to work for him. 12 Mr. Trump is a conman. He asked me to pay off an adult film star with whom he had an affair, and to lie to his wife about it, which I did. Lying to the First Lady is one of my biggest regrets. She is a kind, good person. I respect her greatly – and she did not deserve that. I am giving the Committee today a copy of the $130,000 wire transfer from me to Ms. Clifford’s attorney during the closing days of the presidential campaign that was demanded by Ms. Clifford to maintain her silence about her affair with Mr. Trump. This is Exhibit 4 to my testimony. Mr. Trump directed me to use my own personal funds from a Home Equity Line of Credit to avoid any money being traced back to him that could negatively impact his campaign. I did that, too – without bothering to consider whether that was improper, much less whether it was the right thing to do or how it would impact me, my family, or the public. I am going to jail in part because of my decision to help Mr. Trump hide that payment from the American people before they voted a few days later. As Exhibit 5A to my testimony shows, I am providing a copy of a $35,000 check that President Trump personally signed from his personal bank 13 account on August 1, 2017 – when he was President of the United States – pursuant to the cover-up, which was the basis of my guilty plea, to reimburse me – the word used by Mr. Trump’s TV lawyer -- for the illegal hush money I paid on his behalf. This $35,000 check was one of 11 check installments that was paid throughout the year – while he was President. Other checks to reimburse me for the hush money payments were signed by Don Jr. and Allen Weisselberg. See, for example, Exhibit 5B. The President of the United States thus wrote a personal check for the payment of hush money as part of a criminal scheme to violate campaign finance laws. You can find the details of that scheme, directed by Mr. Trump, in the pleadings in the U.S. District Court for the Southern District of New York. So picture this scene – in February 2017, one month into his presidency, I’m visiting President Trump in the Oval Office for the first time. It’s truly awe-inspiring, he’s showing me around and pointing to different paintings, and he says to me something to the effect of…Don’t worry, Michael, your January and February reimbursement checks are coming. They were FedExed from New York and it takes a while for that to get through the White 14 House system. As he promised, I received the first check for the reimbursement of $70,000 not long thereafter. When I say conman, I’m talking about a man who declares himself brilliant but directed me to threaten his high school, his colleges, and the College Board to never release his grades or SAT scores. As I mentioned, I’m giving the Committee today copies of a letter I sent at Mr. Trump’s direction threatening these schools with civil and criminal actions if Mr. Trump’s grades or SAT scores were ever disclosed without his permission. These are Exhibit 6. The irony wasn’t lost on me at the time that Mr. Trump in 2011 had strongly criticized President Obama for not releasing his grades. As you can see in Exhibit 7, Mr. Trump declared “Let him show his records” after calling President Obama “a terrible student.” The sad fact is that I never heard Mr. Trump say anything in private that led me to believe he loved our nation or wanted to make it better. In fact, he did the opposite. When telling me in 2008 that he was cutting employees’ salaries in half – including mine – he showed me what he claimed was a $10 million IRS tax 15 refund, and he said that he could not believe how stupid the government was for giving “someone like him” that much money back. During the campaign, Mr. Trump said he did not consider Vietnam Veteran, and Prisoner of War, Senator John McCain to be “a hero” because he likes people who weren’t captured. At the same time, Mr. Trump tasked me to handle the negative press surrounding his medical deferment from the Vietnam draft. Mr. Trump claimed it was because of a bone spur, but when I asked for medical records, he gave me none and said there was no surgery. He told me not to answer the specific questions by reporters but rather offer simply the fact that he received a medical deferment. He finished the conversation with the following comment. “You think I’m stupid, I wasn’t going to Vietnam.” I find it ironic, President Trump, that you are in Vietnam right now. And yet, I continued to work for him. *** 16 Questions have been raised about whether I know of direct evidence that Mr. Trump or his campaign colluded with Russia. I do not. I want to be clear. But, I have my suspicions. Sometime in the summer of 2017, I read all over the media that there had been a meeting in Trump Tower in June 2016 involving Don Jr. and others from the campaign with Russians, including a representative of the Russian government, and an email setting up the meeting with the subject line, “Dirt on Hillary Clinton.” Something clicked in my mind. I remember being in the room with Mr. Trump, probably in early June 2016, when something peculiar happened. Don Jr. came into the room and walked behind his father’s desk – which in itself was unusual. People didn’t just walk behind Mr. Trump’s desk to talk to him. I recalled Don Jr. leaning over to his father and speaking in a low voice, which I could clearly hear, and saying: “The meeting is all set.” I remember Mr. Trump saying, “Ok good…let me know.” What struck me as I looked back and thought about that exchange between Don Jr. and his father was, first, that Mr. Trump had frequently told me and others that his son Don Jr. had the worst judgment of anyone in the world. And also, that Don Jr. would never set up any meeting of any significance alone – and certainly not without checking with his father. 17 I also knew that nothing went on in Trump world, especially the campaign, without Mr. Trump’s knowledge and approval. So, I concluded that Don Jr. was referring to that June 2016 Trump Tower meeting about dirt on Hillary with the Russian representative when he walked behind his dad’s desk that day -- and that Mr. Trump knew that was the meeting Don Jr. was talking about when he said, “That’s good…let me know.” *** Over the past year or so, I have done some real soul searching. I see now that my ambition and the intoxication of Trump power had much to do with the bad decisions I made. To you, Chairman Cummings, Ranking Member Jordan, the other members of this Committee, and the other members of the House and Senate, I am sorry for my lies and for lying to Congress. To our nation, I am sorry for actively working to hide from you the truth about Mr. Trump when you needed it most. For those who question my motives for being here today, I understand. I have lied, but I am not a liar. I have done bad things, but I am not a bad man. I have fixed things, but I am no longer your “fixer,” Mr. Trump. 18 I am going to prison and have shattered the safety and security that I tried so hard to provide for my family. My testimony certainly does not diminish the pain I caused my family and friends – nothing can do that. And I have never asked for, nor would I accept, a pardon from President Trump. And, by coming today, I have caused my family to be the target of personal, scurrilous attacks by the President and his lawyer – trying to intimidate me from appearing before this panel. Mr. Trump called me a “rat” for choosing to tell the truth – much like a mobster would do when one of his men decides to cooperate with the government. As Exhibit 8 shows, I have provided the Committee with copies of Tweets that Mr. Trump posted, attacking me and my family – only someone burying his head in the sand would not recognize them for what they are: encouragement to someone to do harm to me and my family. I never imagined that he would engage in vicious, false attacks on my family – and unleash his TV-lawyer to do the same. I hope this committee and all members of Congress on both sides of the aisle will make it clear: As a nation, we should not tolerate attempts to intimidate witnesses before congress and attacks on family are out of bounds and not acceptable. 19 I wish to especially thank Speaker Pelosi for her statements in Exhibit 9 to protect this institution and me, and the Chairman of the House Permanent Select Committee on Intelligence Adam Schiff and Chairman Cummings for likewise defending this institution and my family against the attacks by Mr. Trump, and also the many Republicans who have admonished the President as well. I am not a perfect man. I have done things I am not proud of, and I will live with the consequences of my actions for the rest of my life. But today, I get to decide the example I set for my children and how I attempt to change how history will remember me. I may not be able to change the past, but I can do right by the American people here today. Thank you for your attention. I am happy to answer the Committee’s questions. ##### 20 Exhibit 1a Exhibit 1b Exhibit 1c Exhibit 2 2/24/2019 How Trump’s $50m golf club became $1.4m when it came time to pay tax US news The Guardian 2/24/2019 Trump Exaggerating His Net Worth (By 100%) In Presidential Bid 186,591 views Jun 16, 2015, 01:14pm NY: Donald Trump Announces Presidential Run // Credit: Anthony Behar/Sipa USA/Newscom Trump Exaggerating His Net Worth (By 100%) In Presidential Bid How Trump’s $50m golf club became $1.4m when it came time to pay tax Erin Carlyle Forbes Staff Same Donald Trump-owned golf club is separately accused of causing floods that led to $240,000 worth of damage to New York village of Briarcliff Manor Real estate: markets, luxury homes, and cities. Jon Swaine in Briarcliff Manor, New York Sat 12 Mar 2016 09.25 EST Campaign exaggerations are as much a part of politics as kissing babies. In An attempt by Donald Trump to slash the property tax bill on a golf club outside New York City may be undermined by records indicating that he previously said the property was worth 35 times more than the value he is now trying to convince a judge to approve. announcing his bid for the Republican presidential nomination this morning, The Republican presidential frontrunner is suing the town of Ossining in Westchester County to reduce the taxes on Trump National Golf Club, a 147-acre property with a lavish clubhouse and 18hole course whose managers are separately accused of causing floods that led to $240,000 worth of damage to local public facilities. be exact. Donald Trump started with what Forbes believes is a whopper. He claimed his net worth was nearly $9 billion. We figure it’s closer to $4 billion -- $4.1 billion to This discrepancy is noteworthy, since Trump’s financial success – he put his fortune at exactly $8,737,540,000 -- is core to his candidacy. "I’m proud of my net worth. I’ve done an amazing job," said Trump at his circus-like announcement, https://www.theguardian.com/us-news/2016/mar/12/donald-trump-briarcliff-manor-golf-course-tax 1/6 https://www.forbes.com/sites/erincarlyle/2015/06/16/trump-exaggerating-his-net-worth-by-100-in-presidential-bid/#76a3f9f2a974 1/7 Exhibit 3a Exhibit 3b Exhibit 4 Exhibit 5a Exhibit 5b Exhibit 6 Exhibit 7 2/24/2019 1.00 Local Trump: Obama a "Terrible Student" Not Good Enough for Harvard - NBC New York LIVE TV HomeU.S. News Weather Investigations Entertainment & World Health Weird Weather Tech Sports Top Video 46° Connect Trump: Obama a "Terrible Student" Not Good Enough for Harvard Mogul questions how Obama was accepted to Harvard and Columbia By Beth Fouhy Published Apr 25, 2011 at 5:32 PM Updated at 6:39 AM EDT on Apr 26, 2011 Manhattan real estate mogul Donald Trump suggested in an interview Monday that President Barack Obama had been a poor student who did not deserve to be admitted to the Ivy League universities he attended. Trump, who is mulling a bid for the Republican presidential nomination, offered no proof for his claim but said he would continue to press the matter as he has the legitimacy of the president's birth certificate. "I heard he was a terrible student, terrible. How does a bad student go to Columbia and then to Harvard?" Trump said in an interview with The Associated Press. "I'm thinking about it, I'm certainly looking into it. Let him show his records." TRENDING STORIES Obama graduated from Columbia University in New York in 1983 with a degree in 1 VIDEO Dangerous Wind Gusts Could Reach 60 MPH political science after transferring from Occidental College in California. He went on to Harvard Law School, where he graduated magna cum laude 1991 and was the first black president of the Harvard Law Review. 2 3 WATCH LIVE VIDEO Man Stabbed, Slashed on Upper West Side: Police Woman Killed in Taxi Hit-andRun: Police Ellen's Game of Games Contestants play Ellen's action-packed games for a... https://www.nbcnewyork.com/news/local/Trump-Obama-Wasnt-Good-Enough-to-Get-into-Ivy-Schools-120657869.html 1/4 2/24/2019 Local Trump: Obama a "Terrible Student" Not Good Enough for Harvard - NBC New York NJ Man Forces 3 Captive 4 Home News Weather Investigations Entertainment Top Video U.S. & World Health Weird Weather Tech Sports Women LIVE TV Into Prostitution, 46° Connect Police Say Man Arrested for Shooting Drone As it Searched for Dog: Cops 5 Supermodels: Then and Now WEATHER FORECAST Obama's 2008 campaign did not release his college transcripts, and in his best­ WEATHER ALERTS selling memoir, "Dreams From My Father," Obama indicated he hadn't always View all Trainsmeadow, NY Change been an academic star. Trump told the AP that Obama's refusal to release his college grades were part of a pattern of concealing information about himself. 46° "I have friends who have smart sons with great marks, great boards, great Scattered Clouds Feels Like 39 ° everything and they can't get into Harvard," Trump said. "We don't know a thing about this guy. There are a lot of questions that are unanswered about our president." Radar Forecast Maps Katie Hogan, a spokeswoman for Obama's re­election campaign, declined to comment.  WHAT DO YOU THINK? Trump, a wealthy businessman and reality TV host on NBC, has risen to the top of Do you think Mueller's report will exonerate President Trump? many polls in part by his outspoken call for Obama to release his long form birth certificate. Yes No No opinion NEXT Powered by CivicScience Privacy Policy Famous Feuds: Gwyneth vs. Martha The state of Hawaii has released a certificate of live birth indicating Obama was born there on August 4, 1961, but that has not quelled critics who believe Obama was born outside the United States and is therefore not qualified to be president. NEWSLETTERS Receive the latest local updates in your inbox The so­called "birther" controversy has dominated the early stage of the 2012 GOP nominating contest, with Trump leading the charge. Email Sign up Privacy policy More Newsletters "I have more people that are excited about the fact that I reinvigorated this whole issue," Trump said, adding "the last guy (Obama) wants to run against is Donald Trump." Trump is scheduled to travel to the early primary states of New Hampshire and Nevada this week and said he will make a final decision about a presidential bid by June. Also in the AP interview, Trump: WATCH LIVE Ellen's Game of Games Contestants play Ellen's action-packed games for a... https://www.nbcnewyork.com/news/local/Trump-Obama-Wasnt-Good-Enough-to-Get-into-Ivy-Schools-120657869.html 2/4 2/24/2019 Local Trump: Obama a "Terrible Student" Not Good Enough for Harvard - NBC New York — Said Republicans had made a mistake by embracing a budget proposal crafted Home News Weather Investigations Entertainment Top Video U.S. & World Health Weird Weather Tech Sports by Wisconsin GOP Rep. Paul Ryan that included deep cuts in Medicare. "The LIVE TV 46° Connect seniors are afraid. The plan Paul Ryan put forth has made the Democrats so happy," Trump said. — Declined to disclose his net worth, saying he'll do so if he decides to run. "You'll see what it is, possibly, very likely, in the next 4 weeks. I don't want to say because I don't want to ruin the press conference," he said. — Expressed surprise that the 2008 GOP nominee, John McCain, had suggested Trump's effort was a publicity stunt. "I congratulate him for getting the attention he's getting," McCain told NBC's "Meet the Press" Sunday. Trump said he had been a big supporter of McCain. "I would find it hard to believe he would say anything bad because I raised a fantastic amount of money for him," Trump said.    Copyright Associated Press You May Like Promoted Links by Taboola Feeling Old? Do This Once A Day And Watch What Happens LCR Health 3 Signs And Symptoms That Your Dog Is In Pain Dr. Marty Shop Wilkie Free Shipping - warbyparker.com Huge, Affectionate Bulldog Knocks Over US Rep. Alexandria Ocasio-Cortez as She Takes a Conference Call Manhattan Woman Throws Hot Coffee in Rapist's Face: Police Spanish Woman Dies After Meal at Michelin-Starred Restaurant SPONSORED LINKS MORE FROM NBC New York If Your Cat Vomits (Do This Every Day) (Ultimate Pet Nutrition) The dead giveaway that tells you when Amazon's giving you a better pri… (Wikibuy) Before You Spend Another Cent on Amazon, Read This (Honey) U.S. Cardiologist: It's Like a Pressure Wash for Y… (Gundry MD Total Restore Supplement) Constant Fatigue Is A Warning Sign – See The Simple Fix (Gundry MD) Federal Judge Wants to Climb Statue of Liberty Before Sentencing Protester W… 15-Year-Old Boy Shot While Heading to Ellen's Game of Games WATCH LIVE Contestants play Ellen's action-packed games for a... Grocery Store: Family https://www.nbcnewyork.com/news/local/Trump-Obama-Wasnt-Good-Enough-to-Get-into-Ivy-Schools-120657869.html 3/4 Exhibit 8 Exhibit 9 Statutes Allegedly Violated in Indictment as to United States of America vs. Viktor Borisovich Netyksho, et. al https://www.justice.gov/file/1080281/download Count 1: Conspiracy to Commit an Offense Against the United States, 18 U.S.C. § 371 • Fraud and related activity in connection with computers: 18 U.S.C. § 1030(a)(2)(C) and 1030(c)(2)(B) • Fraud and related activity in connection with computers: 18 U.S.C. § 1030(a)(5)(A) and 1030(c)(4)(B) Counts 2–9: Aggravated Identity Theft, 18 U.S.C. § 1028A Count 10: Conspiracy to Launder Money, 18 U.S.C. § 1956(h) Count 11: Conspiracy to Commit an Offense Against the United States., 18 U.S.C. § 371 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 1 of 29 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA UNITED STATES OF AMERICA * * CRIMINAL NO. v. * * (18 U.S.C. §§ 2, 371, 1030, 1028A, 1956, VIKTOR BORISOVICH NETYKSHO, * and 3551 et seq.) BORIS ALEKSEYEVICH ANTONOV, * DMITRIY SERGEYEVICH BADIN, * IVAN SERGEYEVICH YERMAKOV, * ALEKSEY VIKTOROVICH * LUKASHEV, * SERGEY ALEKSANDROVICH * MORGACHEV, * NIKOLAY YURYEVICH KOZACHEK, * PAVEL VYACHESLAVOVICH * YERSHOV, * ARTEM ANDREYEVICH * MALYSHEV, * ALEKSANDR VLADIMIROVICH * OSADCHUK, * ALEKSEY ALEKSANDROVICH * POTEMKIN, and * ANATOLIY SERGEYEVICH * KOVALEV, * * Defendants. * * ******* INDICTMENT The Grand Jury for the District of Columbia charges: COUNT ONE (Conspiracy to Commit an Offense Against the United States) 1. In or around 2016, the Russian Federation (“Russia”) operated a military intelligence agency called the Main Intelligence Directorate of the General Staff (“GRU”). The GRU had multiple units, including Units 26165 and 74455, engaged in cyber operations that involved the staged releases of documents stolen through computer intrusions. These units conducted largescale cyber operations to interfere with the 2016 U.S. presidential election. Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 2 of 29 2. Defendants VIKTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV, ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV, NIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM ANDREYEVICH MALYSHEV, ALEKSANDR VLADIMIROVICH OSADCHUK, and ALEKSEY ALEKSANDROVICH POTEMKIN were GRU officers who knowingly and intentionally conspired with each other, and with persons known and unknown to the Grand Jury (collectively the “Conspirators”), to gain unauthorized access (to “hack”) into the computers of U.S. persons and entities involved in the 2016 U.S. presidential election, steal documents from those computers, and stage releases of the stolen documents to interfere with the 2016 U.S. presidential election. 3. Starting in at least March 2016, the Conspirators used a variety of means to hack the email accounts of volunteers and employees of the U.S. presidential campaign of Hillary Clinton (the “Clinton Campaign”), including the email account of the Clinton Campaign’s chairman. 4. By in or around April 2016, the Conspirators also hacked into the computer networks of the Democratic Congressional Campaign Committee (“DCCC”) and the Democratic National Committee (“DNC”). The Conspirators covertly monitored the computers of dozens of DCCC and DNC employees, implanted hundreds of files containing malicious computer code (“malware”), and stole emails and other documents from the DCCC and DNC. 5. By in or around April 2016, the Conspirators began to plan the release of materials stolen from the Clinton Campaign, DCCC, and DNC. 6. Beginning in or around June 2016, the Conspirators staged and released tens of thousands of the stolen emails and documents. They did so using fictitious online personas, including 2 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 3 of 29 “DCLeaks” and “Guccifer 2.0.” 7. The Conspirators also used the Guccifer 2.0 persona to release additional stolen documents through a website maintained by an organization (“Organization 1”), that had previously posted documents stolen from U.S. persons, entities, and the U.S. government. The Conspirators continued their U.S. election-interference operations through in or around November 2016. 8. To hide their connections to Russia and the Russian government, the Conspirators used false identities and made false statements about their identities. To further avoid detection, the Conspirators used a network of computers located across the world, including in the United States, and paid for this infrastructure using cryptocurrency. Defendants 9. Defendant VIKTOR BORISOVICH NETYKSHO (Нетыкшо Виктор Борисович) was the Russian military officer in command of Unit 26165, located at 20 Komsomolskiy Prospekt, Moscow, Russia. Unit 26165 had primary responsibility for hacking the DCCC and DNC, as well as the email accounts of individuals affiliated with the Clinton Campaign. 10. Defendant BORIS ALEKSEYEVICH ANTONOV (Антонов Борис Алексеевич) was a Major in the Russian military assigned to Unit 26165. ANTONOV oversaw a department within Unit 26165 dedicated to targeting military, political, governmental, and non-governmental organizations with spearphishing emails and other computer intrusion activity. ANTONOV held the title “Head of Department.” In or around 2016, ANTONOV supervised other co-conspirators who targeted the DCCC, DNC, and individuals affiliated with the Clinton Campaign. 11. Defendant DMITRIY SERGEYEVICH BADIN (Бадин Дмитрий Сергеевич) was a Russian military officer assigned to Unit 26165 who held the title “Assistant Head of Department.” In or around 2016, BADIN, along with ANTONOV, supervised other co-conspirators who targeted the DCCC, DNC, and individuals affiliated with the Clinton Campaign. 3 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 4 of 29 12. Defendant IVAN SERGEYEVICH YERMAKOV (Ермаков Иван Сергеевич) was a Russian military officer assigned to ANTONOV’s department within Unit 26165. Since in or around 2010, YERMAKOV used various online personas, including “Kate S. Milton,” “James McMorgans,” and “Karen W. Millen,” to conduct hacking operations on behalf of Unit 26165. In or around March 2016, YERMAKOV participated in hacking at least two email accounts from which campaign-related documents were released through DCLeaks. In or around May 2016, YERMAKOV also participated in hacking the DNC email server and stealing DNC emails that were later released through Organization 1. 13. Defendant ALEKSEY VIKTOROVICH LUKASHEV (Лукашев Алексей Викторович) was a Senior Lieutenant in the Russian military assigned to ANTONOV’s department within Unit 26165. LUKASHEV used various online personas, including “Den Katenberg” and “Yuliana Martynova.” In or around 2016, LUKASHEV sent spearphishing emails to members of the Clinton Campaign and affiliated individuals, including the chairman of the Clinton Campaign. 14. Defendant SERGEY ALEKSANDROVICH MORGACHEV (Моргачев Сергей Александрович) was a Lieutenant Colonel in the Russian military assigned to Unit 26165. MORGACHEV oversaw a department within Unit 26165 dedicated to developing and managing malware, including a hacking tool used by the GRU known as “X-Agent.” During the hacking of the DCCC and DNC networks, MORGACHEV supervised the co-conspirators who developed and monitored the X-Agent malware implanted on those computers. 15. Defendant NIKOLAY YURYEVICH KOZACHEK (Козачек Николай Юрьевич) was a Lieutenant Captain in the Russian military assigned to MORGACHEV’s department within Unit 26165. KOZACHEK used a variety of monikers, including “kazak” and “blablabla1234565.” KOZACHEK developed, customized, and monitored X-Agent malware used to hack the DCCC 4 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 5 of 29 and DNC networks beginning in or around April 2016. 16. Defendant PAVEL VYACHESLAVOVICH YERSHOV (Ершов Павел Вячеславович) was a Russian military officer assigned to MORGACHEV’s department within Unit 26165. In or around 2016, YERSHOV assisted KOZACHEK and other co-conspirators in testing and customizing X-Agent malware before actual deployment and use. 17. Defendant ARTEM ANDREYEVICH MALYSHEV (Малышев Артём Андреевич) was a Second Lieutenant in the Russian military assigned to MORGACHEV’s department within Unit 26165. MALYSHEV used a variety of monikers, including “djangomagicdev” and “realblatr.” In or around 2016, MALYSHEV monitored X-Agent malware implanted on the DCCC and DNC networks. 18. Defendant ALEKSANDR VLADIMIROVICH OSADCHUK (Осадчук Александр Владимирович) was a Colonel in the Russian military and the commanding officer of Unit 74455. Unit 74455 was located at 22 Kirova Street, Khimki, Moscow, a building referred to within the GRU as the “Tower.” Unit 74455 assisted in the release of stolen documents through the DCLeaks and Guccifer 2.0 personas, the promotion of those releases, and the publication of anti-Clinton content on social media accounts operated by the GRU. 19. Defendant ALEKSEY ALEKSANDROVICH POTEMKIN (Потемкин Алексей Александрович) was an officer in the Russian military assigned to Unit 74455. POTEMKIN was a supervisor in a department within Unit 74455 responsible for the administration of computer infrastructure used in cyber operations. Infrastructure and social media accounts administered by POTEMKIN’s department were used, among other things, to assist in the release of stolen documents through the DCLeaks and Guccifer 2.0 personas. 5 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 6 of 29 Object of the Conspiracy 20. The object of the conspiracy was to hack into the computers of U.S. persons and entities involved in the 2016 U.S. presidential election, steal documents from those computers, and stage releases of the stolen documents to interfere with the 2016 U.S. presidential election. Manner and Means of the Conspiracy Spearphishing Operations 21. ANTONOV, BADIN, YERMAKOV, LUKASHEV, and their co-conspirators targeted victims using a technique known as spearphishing to steal victims’ passwords or otherwise gain access to their computers. Beginning by at least March 2016, the Conspirators targeted over 300 individuals affiliated with the Clinton Campaign, DCCC, and DNC. a. For example, on or about March 19, 2016, LUKASHEV and his co-conspirators created and sent a spearphishing email to the chairman of the Clinton Campaign. LUKASHEV used the account “john356gh” at an online service that abbreviated lengthy website addresses (referred to as a “URL-shortening service”). LUKASHEV used the account to mask a link contained in the spearphishing email, which directed the recipient to a GRU-created website. LUKASHEV altered the appearance of the sender email address in order to make it look like the email was a security notification from Google (a technique known as “spoofing”), instructing the user to change his password by clicking the embedded link. Those instructions were followed. On or about March 21, 2016, LUKASHEV, YERMAKOV, and their co-conspirators stole the contents of the chairman’s email account, which consisted of over 50,000 emails. b. Starting on or about March 19, 2016, LUKASHEV and his co-conspirators sent spearphishing emails to the personal accounts of other individuals affiliated with 6 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 7 of 29 the Clinton Campaign, including its campaign manager and a senior foreign policy advisor. On or about March 25, 2016, LUKASHEV used the same john356gh account to mask additional links included in spearphishing emails sent to numerous individuals affiliated with the Clinton Campaign, including Victims 1 and 2. LUKASHEV sent these emails from the Russia-based email account hi.mymail@yandex.com that he spoofed to appear to be from Google. c. On or about March 28, 2016, YERMAKOV researched the names of Victims 1 and 2 and their association with Clinton on various social media sites. Through their spearphishing operations, LUKASHEV, YERMAKOV, and their co-conspirators successfully stole email credentials and thousands of emails from numerous individuals affiliated with the Clinton Campaign. Many of these stolen emails, including those from Victims 1 and 2, were later released by the Conspirators through DCLeaks. d. On or about April 6, 2016, the Conspirators created an email account in the name (with a one-letter deviation from the actual spelling) of a known member of the Clinton Campaign. The Conspirators then used that account to send spearphishing emails to the work accounts of more than thirty different Clinton Campaign employees. In the spearphishing emails, LUKASHEV and his co-conspirators embedded a link purporting to direct the recipient to a document titled “hillaryclinton-favorable-rating.xlsx.” In fact, this link directed the recipients’ computers to a GRU-created website. 22. The Conspirators spearphished individuals affiliated with the Clinton Campaign throughout the summer of 2016. For example, on or about July 27, 2016, the Conspirators 7 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 8 of 29 attempted after hours to spearphish for the first time email accounts at a domain hosted by a thirdparty provider and used by Clinton’s personal office. At or around the same time, they also targeted seventy-six email addresses at the domain for the Clinton Campaign. Hacking into the DCCC Network 23. Beginning in or around March 2016, the Conspirators, in addition to their spearphishing efforts, researched the DCCC and DNC computer networks to identify technical specifications and vulnerabilities. a. For example, beginning on or about March 15, 2016, YERMAKOV ran a technical query for the DNC’s internet protocol configurations to identify connected devices. b. On or about the same day, YERMAKOV searched for open-source information about the DNC network, the Democratic Party, and Hillary Clinton. c. On or about April 7, 2016, YERMAKOV ran a technical query for the DCCC’s internet protocol configurations to identify connected devices. 24. By in or around April 2016, within days of YERMAKOV’s searches regarding the DCCC, the Conspirators hacked into the DCCC computer network. Once they gained access, they installed and managed different types of malware to explore the DCCC network and steal data. a. On or about April 12, 2016, the Conspirators used the stolen credentials of a DCCC Employee (“DCCC Employee 1”) to access the DCCC network. DCCC Employee 1 had received a spearphishing email from the Conspirators on or about April 6, 2016, and entered her password after clicking on the link. b. Between in or around April 2016 and June 2016, the Conspirators installed multiple versions of their X-Agent malware on at least ten DCCC computers, which allowed them to monitor individual employees’ computer activity, steal passwords, and maintain access to the DCCC network. 8 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 9 of 29 c. X-Agent malware implanted on the DCCC network transmitted information from the victims’ computers to a GRU-leased server located in Arizona. Conspirators referred to this server as their “AMS” panel. The KOZACHEK, MALYSHEV, and their co-conspirators logged into the AMS panel to use X-Agent’s keylog and screenshot functions in the course of monitoring and surveilling activity on the DCCC computers. The keylog function allowed the Conspirators to capture keystrokes entered by DCCC employees. The screenshot function allowed the Conspirators to take pictures of the DCCC employees’ computer screens. d. For example, on or about April 14, 2016, the Conspirators repeatedly activated X-Agent’s keylog and screenshot functions to surveil DCCC Employee 1’s computer activity over the course of eight hours. During that time, the Conspirators captured DCCC Employee 1’s communications with co-workers and the passwords she entered while working on fundraising and voter outreach projects. Similarly, on or about April 22, 2016, the Conspirators activated X-Agent’s keylog and screenshot functions to capture the discussions of another DCCC Employee (“DCCC Employee 2”) about the DCCC’s finances, as well as her individual banking information and other personal topics. 25. On or about April 19, 2016, KOZACHEK, YERSHOV, and their co-conspirators remotely configured an overseas computer to relay communications between X-Agent malware and the AMS panel and then tested X-Agent’s ability to connect to this computer. The Conspirators referred to this computer as a “middle server.” The middle server acted as a proxy to obscure the connection between malware at the DCCC and the Conspirators’ AMS panel. On or about April 9 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 10 of 29 20, 2016, the Conspirators directed X-Agent malware on the DCCC computers to connect to this middle server and receive directions from the Conspirators. Hacking into the DNC Network 26. On or about April 18, 2016, the Conspirators hacked into the DNC’s computers through their access to the DCCC network. The Conspirators then installed and managed different types of malware (as they did in the DCCC network) to explore the DNC network and steal documents. a. On or about April 18, 2016, the Conspirators activated X-Agent’s keylog and screenshot functions to steal credentials of a DCCC employee who was authorized to access the DNC network. The Conspirators hacked into the DNC network from the DCCC network using stolen credentials. By in or around June 2016, they gained access to approximately thirty-three DNC computers. b. In or around April 2016, the Conspirators installed X-Agent malware on the DNC network, including the same versions installed on the DCCC network. MALYSHEV and his co-conspirators monitored the X-Agent malware from the AMS panel and captured data from the victim computers. The AMS panel collected thousands of keylog and screenshot results from the DCCC and DNC computers, such as a screenshot and keystroke capture of DCCC Employee 2 viewing the DCCC’s online banking information. Theft of DCCC and DNC Documents 27. The Conspirators searched for and identified computers within the DCCC and DNC networks that stored information related to the 2016 U.S. presidential election. For example, on or about April 15, 2016, the Conspirators searched one hacked DCCC computer for terms that included “hillary,” “cruz,” and “trump.” The Conspirators also copied select DCCC folders, including “Benghazi Investigations.” The Conspirators targeted computers containing information 10 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 11 of 29 such as opposition research and field operation plans for the 2016 elections. 28. To enable them to steal a large number of documents at once without detection, the Conspirators used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks. The Conspirators then used other GRU malware, known as “X-Tunnel,” to move the stolen documents outside the DCCC and DNC networks through encrypted channels. a. For example, on or about April 22, 2016, the Conspirators compressed gigabytes of data from DNC computers, including opposition research. The Conspirators later moved the compressed DNC data using X-Tunnel to a GRU-leased computer located in Illinois. b. On or about April 28, 2016, the Conspirators connected to and tested the same computer located in Illinois. Later that day, the Conspirators used X-Tunnel to connect to that computer to steal additional documents from the DCCC network. 29. Between on or about May 25, 2016 and June 1, 2016, the Conspirators hacked the DNC Microsoft Exchange Server and stole thousands of emails from the work accounts of DNC employees. During that time, YERMAKOV researched PowerShell commands related to accessing and managing the Microsoft Exchange Server. 30. On or about May 30, 2016, MALYSHEV accessed the AMS panel in order to upgrade custom AMS software on the server. That day, the AMS panel received updates from approximately thirteen different X-Agent malware implants on DCCC and DNC computers. 31. During the hacking of the DCCC and DNC networks, the Conspirators covered their tracks by intentionally deleting logs and computer files. For example, on or about May 13, 2016, the Conspirators cleared the event logs from a DNC computer. On or about June 20, 2016, the 11 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 12 of 29 Conspirators deleted logs from the AMS panel that documented their activities on the panel, including the login history. Efforts to Remain on the DCCC and DNC Networks 32. Despite the Conspirators’ efforts to hide their activity, beginning in or around May 2016, both the DCCC and DNC became aware that they had been hacked and hired a security company (“Company 1”) to identify the extent of the intrusions. By in or around June 2016, Company 1 took steps to exclude intruders from the networks. Despite these efforts, a Linux-based version of X-Agent, programmed to communicate with the GRU-registered domain linuxkrnl.net, remained on the DNC network until in or around October 2016. 33. In response to Company 1’s efforts, the Conspirators took countermeasures to maintain access to the DCCC and DNC networks. a. On or about May 31, 2016, YERMAKOV searched for open-source information about Company 1 and its reporting on X-Agent and X-Tunnel. On or about June 1, 2016, the Conspirators attempted to delete traces of their presence on the DCCC network using the computer program CCleaner. b. On or about June 14, 2016, the Conspirators registered the domain actblues.com, which mimicked the domain of a political fundraising platform that included a DCCC donations page. Shortly thereafter, the Conspirators used stolen DCCC credentials to modify the DCCC website and redirect visitors to the actblues.com domain. c. On or about June 20, 2016, after Company 1 had disabled X-Agent on the DCCC network, the Conspirators spent over seven hours unsuccessfully trying to connect to X-Agent. The Conspirators also tried to access the DCCC network using previously stolen credentials. 12 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 13 of 29 34. In or around September 2016, the Conspirators also successfully gained access to DNC computers hosted on a third-party cloud-computing service. These computers contained test applications related to the DNC’s analytics. After conducting reconnaissance, the Conspirators gathered data by creating backups, or “snapshots,” of the DNC’s cloud-based systems using the cloud provider’s own technology. The Conspirators then moved the snapshots to cloud-based accounts they had registered with the same service, thereby stealing the data from the DNC. Stolen Documents Released through DCLeaks 35. More than a month before the release of any documents, the Conspirators constructed the online persona DCLeaks to release and publicize stolen election-related documents. On or about April 19, 2016, after attempting to register the domain electionleaks.com, the Conspirators registered the domain dcleaks.com through a service that anonymized the registrant. The funds used to pay for the dcleaks.com domain originated from an account at an online cryptocurrency service that the Conspirators also used to fund the lease of a virtual private server registered with the operational email account dirbinsaabol@mail.com. The dirbinsaabol email account was also used to register the john356gh URL-shortening account used by LUKASHEV to spearphish the Clinton Campaign chairman and other campaign-related individuals. 36. On or about June 8, 2016, the Conspirators launched the public website dcleaks.com, which they used to release stolen emails. Before it shut down in or around March 2017, the site received over one million page views. The Conspirators falsely claimed on the site that DCLeaks was started by a group of “American hacktivists,” when in fact it was started by the Conspirators. 37. Starting in or around June 2016 and continuing through the 2016 U.S. presidential election, the Conspirators used DCLeaks to release emails stolen from individuals affiliated with the Clinton Campaign. The Conspirators also released documents they had stolen in other spearphishing operations, including those they had conducted in 2015 that collected emails from individuals 13 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 14 of 29 affiliated with the Republican Party. 38. On or about June 8, 2016, and at approximately the same time that the dcleaks.com website was launched, the Conspirators created a DCLeaks Facebook page using a preexisting social media account under the fictitious name “Alice Donovan.” In addition to the DCLeaks Facebook page, the Conspirators used other social media accounts in the names of fictitious U.S. persons such as “Jason Scott” and “Richard Gingrey” to promote the DCLeaks website. The Conspirators accessed these accounts from computers managed by POTEMKIN and his co-conspirators. 39. On or about June 8, 2016, the Conspirators created the Twitter account @dcleaks_. The Conspirators operated the @dcleaks_ Twitter account from the same computer used for other efforts to interfere with the 2016 U.S. presidential election. For example, the Conspirators used the same computer to operate the Twitter account @BaltimoreIsWhr, through which they encouraged U.S. audiences to “[j]oin our flash mob” opposing Clinton and to post images with the hashtag #BlacksAgainstHillary. Stolen Documents Released through Guccifer 2.0 40. On or about June 14, 2016, the DNC—through Company 1—publicly announced that it had been hacked by Russian government actors. In response, the Conspirators created the online persona Guccifer 2.0 and falsely claimed to be a lone Romanian hacker to undermine the allegations of Russian responsibility for the intrusion. 41. On or about June 15, 2016, the Conspirators logged into a Moscow-based server used and managed by Unit 74455 and, between 4:19 PM and 4:56 PM Moscow Standard Time, searched for certain words and phrases, including: 14 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 15 of 29 Search Term(s) “some hundred sheets” “some hundreds of sheets” dcleaks illuminati широко известный перевод [widely known translation] “worldwide known” “think twice about” “company’s competence” 42. Later that day, at 7:02 PM Moscow Standard Time, the online persona Guccifer 2.0 published its first post on a blog site created through WordPress. Titled “DNC’s servers hacked by a lone hacker,” the post used numerous English words and phrases that the Conspirators had searched for earlier that day (bolded below): Worldwide known cyber security company [Company 1] announced that the Democratic National Committee (DNC) servers had been hacked by “sophisticated” hacker groups. I’m very pleased the company appreciated my skills so highly))) [. . .] Here are just a few docs from many thousands I extracted when hacking into DNC’s network. [. . .] Some hundred sheets! This’s a serious case, isn’t it? [. . .] I guess [Company 1] customers should think twice about company’s competence. F[***] the Illuminati [Company 1]!!!!!!!!! 43. and their conspiracies!!!!!!!!! F[***] Between in or around June 2016 and October 2016, the Conspirators used Guccifer 2.0 to release documents through WordPress that they had stolen from the DCCC and DNC. The Conspirators, posing as Guccifer 2.0, also shared stolen documents with certain individuals. a. On or about August 15, 2016, the Conspirators, posing as Guccifer 2.0, received a 15 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 16 of 29 request for stolen documents from a candidate for the U.S. Congress. The Conspirators responded using the Guccifer 2.0 persona and sent the candidate stolen documents related to the candidate’s opponent. b. On or about August 22, 2016, the Conspirators, posing as Guccifer 2.0, transferred approximately 2.5 gigabytes of data stolen from the DCCC to a then-registered state lobbyist and online source of political news. The stolen data included donor records and personal identifying information for more than 2,000 Democratic donors. c. On or about August 22, 2016, the Conspirators, posing as Guccifer 2.0, sent a reporter stolen documents pertaining to the Black Lives Matter movement. The reporter responded by discussing when to release the documents and offering to write an article about their release. 44. The Conspirators, posing as Guccifer 2.0, also communicated with U.S. persons about the release of stolen documents. On or about August 15, 2016, the Conspirators, posing as Guccifer 2.0, wrote to a person who was in regular contact with senior members of the presidential campaign of Donald J. Trump, “thank u for writing back . . . do u find anyt[h]ing interesting in the docs i posted?” On or about August 17, 2016, the Conspirators added, “please tell me if i can help u anyhow . . . it would be a great pleasure to me.” On or about September 9, 2016, the Conspirators, again posing as Guccifer 2.0, referred to a stolen DCCC document posted online and asked the person, “what do u think of the info on the turnout model for the democrats entire presidential campaign.” The person responded, “[p]retty standard.” 45. The Conspirators conducted operations as Guccifer 2.0 and DCLeaks using overlapping computer infrastructure and financing. a. For example, between on or about March 14, 2016 and April 28, 2016, the 16 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 17 of 29 Conspirators used the same pool of bitcoin funds to purchase a virtual private network (“VPN”) account and to lease a server in Malaysia. In or around June 2016, the Conspirators used the Malaysian server to host the dcleaks.com website. On or about July 6, 2016, the Conspirators used the VPN to log into the @Guccifer_2 Twitter account. The Conspirators opened that VPN account from the same server that was also used to register malicious domains for the hacking of the DCCC and DNC networks. b. On or about June 27, 2016, the Conspirators, posing as Guccifer 2.0, contacted a U.S. reporter with an offer to provide stolen emails from “Hillary Clinton’s staff.” The Conspirators then sent the reporter the password to access a nonpublic, password-protected portion of dcleaks.com containing emails stolen from Victim 1 by LUKASHEV, YERMAKOV, and their co-conspirators in or around March 2016. 46. On or about January 12, 2017, the Conspirators published a statement on the Guccifer 2.0 WordPress blog, falsely claiming that the intrusions and release of stolen documents had “totally no relation to the Russian government.” Use of Organization 1 47. In order to expand their interference in the 2016 U.S. presidential election, the Conspirators transferred many of the documents they stole from the DNC and the chairman of the Clinton Campaign to Organization 1. The Conspirators, posing as Guccifer 2.0, discussed the release of the stolen documents and the timing of those releases with Organization 1 to heighten their impact on the 2016 U.S. presidential election. a. On or about June 22, 2016, Organization 1 sent a private message to Guccifer 2.0 to “[s]end any new material [stolen from the DNC] here for us to review and it will 17 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 18 of 29 have a much higher impact than what you are doing.” On or about July 6, 2016, Organization 1 added, “if you have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the DNC [Democratic National Convention] is approaching and she will solidify bernie supporters behind her after.” The Conspirators responded, “ok . . . i see.” Organization 1 explained, “we think trump has only a 25% chance of winning against hillary . . . so conflict between bernie and hillary is interesting.” b. After failed attempts to transfer the stolen documents starting in late June 2016, on or about July 14, 2016, the Conspirators, posing as Guccifer 2.0, sent Organization 1 an email with an attachment titled “wk dnc link1.txt.gpg.” The Conspirators explained to Organization 1 that the encrypted file contained instructions on how to access an online archive of stolen DNC documents. On or about July 18, 2016, Organization 1 confirmed it had “the 1Gb or so archive” and would make a release of the stolen documents “this week.” 48. On or about July 22, 2016, Organization 1 released over 20,000 emails and other documents stolen from the DNC network by the Conspirators. This release occurred approximately three days before the start of the Democratic National Convention. Organization 1 did not disclose Guccifer 2.0’s role in providing them. The latest-in-time email released through Organization 1 was dated on or about May 25, 2016, approximately the same day the Conspirators hacked the DNC Microsoft Exchange Server. 49. On or about October 7, 2016, Organization 1 released the first set of emails from the chairman of the Clinton Campaign that had been stolen by LUKASHEV and his co-conspirators. Between on or about October 7, 2016 and November 7, 2016, Organization 1 released 18 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 19 of 29 approximately thirty-three tranches of documents that had been stolen from the chairman of the Clinton Campaign. In total, over 50,000 stolen documents were released. Statutory Allegations 50. Paragraphs 1 through 49 of this Indictment are re-alleged and incorporated by reference as if fully set forth herein. 51. From at least in or around March 2016 through November 2016, in the District of Columbia and elsewhere, Defendants NETYKSHO, ANTONOV, BADIN, YERMAKOV, LUKASHEV, MORGACHEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, and POTEMKIN, together with others known and unknown to the Grand Jury, knowingly and intentionally conspired to commit offenses against the United States, namely: a. To knowingly access a computer without authorization and exceed authorized access to a computer, and to obtain thereby information from a protected computer, where the value of the information obtained exceeded $5,000, in violation of Title 18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B); and b. To knowingly cause the transmission of a program, information, code, and command, and as a result of such conduct, to intentionally cause damage without authorization to a protected computer, and where the offense did cause and, if completed, would have caused, loss aggregating $5,000 in value to at least one person during a one-year period from a related course of conduct affecting a protected computer, and damage affecting at least ten protected computers during a one-year period, in violation of Title 18, United States Code, Sections 1030(a)(5)(A) and 1030(c)(4)(B). 52. In furtherance of the Conspiracy and to effect its illegal objects, the Conspirators committed the overt acts set forth in paragraphs 1 through 19, 21 through 49, 55, and 57 through 19 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 20 of 29 64, which are re-alleged and incorporated by reference as if fully set forth herein. 53. In furtherance of the Conspiracy, and as set forth in paragraphs 1 through 19, 21 through 49, 55, and 57 through 64, the Conspirators knowingly falsely registered a domain name and knowingly used that domain name in the course of committing an offense, namely, the Conspirators registered domains, including dcleaks.com and actblues.com, with false names and addresses, and used those domains in the course of committing the felony offense charged in Count One. All in violation of Title 18, United States Code, Sections 371 and 3559(g)(1). COUNTS TWO THROUGH NINE (Aggravated Identity Theft) 54. Paragraphs 1 through 19, 21 through 49, and 57 through 64 of this Indictment are re-alleged and incorporated by reference as if fully set forth herein. 55. On or about the dates specified below, in the District of Columbia and elsewhere, Defendants VIKTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV, ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV, NIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM ANDREYEVICH MALYSHEV, ALEKSANDR VLADIMIROVICH OSADCHUK, and ALEKSEY ALEKSANDROVICH POTEMKIN did knowingly transfer, possess, and use, without lawful authority, a means of identification of another person during and in relation to a felony violation enumerated in Title 18, United States Code, Section 1028A(c), namely, computer fraud in violation of Title 18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B), knowing that the means of identification belonged to another real person: 20 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 21 of 29 Count Approximate Date Victim Means of Identification 2 March 21, 2016 Victim 3 Username and password for personal email account 3 March 25, 2016 Victim 1 Username and password for personal email account 4 April 12, 2016 Victim 4 5 April 15, 2016 Victim 5 6 April 18, 2016 Victim 6 7 May 10, 2016 Victim 7 8 June 2, 2016 Victim 2 9 July 6, 2016 Victim 8 Username and password for DCCC computer network Username and password for DCCC computer network Username and password for DCCC computer network Username and password for DNC computer network Username and password for personal email account Username and password for personal email account All in violation of Title 18, United States Code, Sections 1028A(a)(1) and 2. COUNT TEN (Conspiracy to Launder Money) 56. Paragraphs 1 through 19, 21 through 49, and 55 are re-alleged and incorporated by reference as if fully set forth herein. 57. To facilitate the purchase of infrastructure used in their hacking activity—including hacking into the computers of U.S. persons and entities involved in the 2016 U.S. presidential election and releasing the stolen documents—the Defendants conspired to launder the equivalent of more than $95,000 through a web of transactions structured to capitalize on the perceived anonymity of cryptocurrencies such as bitcoin. 58. Although the Conspirators caused transactions to be conducted in a variety of currencies, including U.S. dollars, they principally used bitcoin when purchasing servers, registering domains, and otherwise making payments in furtherance of hacking activity. Many of these payments were 21 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 22 of 29 processed by companies located in the United States that provided payment processing services to hosting companies, domain registrars, and other vendors both international and domestic. The use of bitcoin allowed the Conspirators to avoid direct relationships with traditional financial institutions, allowing them to evade greater scrutiny of their identities and sources of funds. 59. All bitcoin transactions are added to a public ledger called the Blockchain, but the Blockchain identifies the parties to each transaction only by alpha-numeric identifiers known as bitcoin addresses. To further avoid creating a centralized paper trail of all of their purchases, the Conspirators purchased infrastructure using hundreds of different email accounts, in some cases using a new account for each purchase. The Conspirators used fictitious names and addresses in order to obscure their identities and their links to Russia and the Russian government. For example, the dcleaks.com domain was registered and paid for using the fictitious name “Carrie Feehan” and an address in New York. In some cases, as part of the payment process, the Conspirators provided vendors with nonsensical addresses such as “usa Denver AZ,” “gfhgh ghfhgfh fdgfdg WA,” and “1 2 dwd District of Columbia.” 60. The Conspirators used several dedicated email accounts to track basic bitcoin transaction information and to facilitate bitcoin payments to vendors. One of these dedicated accounts, registered with the username “gfadel47,” received hundreds of bitcoin payment requests from approximately 100 different email accounts. For example, on or about February 1, 2016, the gfadel47 account received the instruction to “[p]lease send exactly 0.026043 bitcoin to” a certain thirty-four character bitcoin address. Shortly thereafter, a transaction matching those exact instructions was added to the Blockchain. 61. On occasion, the Conspirators facilitated bitcoin payments using the same computers that they used to conduct their hacking activity, including to create and send test spearphishing emails. 22 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 23 of 29 Additionally, one of these dedicated accounts was used by the Conspirators in or around 2015 to renew the registration of a domain (linuxkrnl.net) encoded in certain X-Agent malware installed on the DNC network. 62. The Conspirators funded the purchase of computer infrastructure for their hacking activity in part by “mining” bitcoin. Individuals and entities can mine bitcoin by allowing their computing power to be used to verify and record payments on the bitcoin public ledger, a service for which they are rewarded with freshly-minted bitcoin. The pool of bitcoin generated from the GRU’s mining activity was used, for example, to pay a Romanian company to register the domain dcleaks.com through a payment processing company located in the United States. 63. In addition to mining bitcoin, the Conspirators acquired bitcoin through a variety of means designed to obscure the origin of the funds. This included purchasing bitcoin through peer-to-peer exchanges, moving funds through other digital currencies, and using pre-paid cards. They also enlisted the assistance of one or more third-party exchangers who facilitated layered transactions through digital currency exchange platforms providing heightened anonymity. 64. The Conspirators used the same funding structure—and in some cases, the very same pool of funds—to purchase key accounts, servers, and domains used in their election-related hacking activity. a. The bitcoin mining operation that funded the registration payment for dcleaks.com also sent newly-minted bitcoin to a bitcoin address controlled by “Daniel Farell,” the persona that was used to renew the domain linuxkrnl.net. The bitcoin mining operation also funded, through the same bitcoin address, the purchase of servers and domains used in the GRU’s spearphishing operations, including accountsqooqle.com and account-gooogle.com. 23 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 24 of 29 b. On or about March 14, 2016, using funds in a bitcoin address, the Conspirators purchased a VPN account, which they later used to log into the @Guccifer_2 Twitter account. The remaining funds from that bitcoin address were then used on or about April 28, 2016, to lease a Malaysian server that hosted the dcleaks.com website. c. The Conspirators used a different set of fictitious names (including “Ward DeClaur” and “Mike Long”) to send bitcoin to a U.S. company in order to lease a server used to administer X-Tunnel malware implanted on the DCCC and DNC networks, and to lease two servers used to hack the DNC’s cloud network. Statutory Allegations 65. From at least in or around 2015 through 2016, within the District of Columbia and elsewhere, Defendants VIKTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV, ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV, NIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM ANDREYEVICH MALYSHEV, ALEKSANDR VLADIMIROVICH OSADCHUK, and ALEKSEY ALEKSANDROVICH POTEMKIN, together with others, known and unknown to the Grand Jury, did knowingly and intentionally conspire to transport, transmit, and transfer monetary instruments and funds to a place in the United States from and through a place outside the United States and from a place in the United States to and through a place outside the United States, with the intent to promote the carrying on of specified unlawful activity, namely, a violation of Title 18, United States Code, Section 1030, contrary to Title 18, United States Code, Section 1956(a)(2)(A). All in violation of Title 18, United States Code, Section 1956(h). 24 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 25 of 29 COUNT ELEVEN (Conspiracy to Commit an Offense Against the United States) 66. Paragraphs 1 through 8 of this Indictment are re-alleged and incorporated by reference as if fully set forth herein. Defendants 67. Paragraph 18 of this Indictment relating to ALEKSANDR VLADIMIROVICH OSADCHUK is re-alleged and incorporated by reference as if fully set forth herein. 68. Defendant ANATOLIY SERGEYEVICH KOVALEV (Ковалев Анатолий Сергеевич) was an officer in the Russian military assigned to Unit 74455 who worked in the GRU’s 22 Kirova Street building (the Tower). 69. Defendants OSADCHUK and KOVALEV were GRU officers who knowingly and intentionally conspired with each other and with persons, known and unknown to the Grand Jury, to hack into the computers of U.S. persons and entities responsible for the administration of 2016 U.S. elections, such as state boards of elections, secretaries of state, and U.S. companies that supplied software and other technology related to the administration of U.S. elections. Object of the Conspiracy 70. The object of the conspiracy was to hack into protected computers of persons and entities charged with the administration of the 2016 U.S. elections in order to access those computers and steal voter data and other information stored on those computers. Manner and Means of the Conspiracy 71. In or around June 2016, KOVALEV and his co-conspirators researched domains used by U.S. state boards of elections, secretaries of state, and other election-related entities for website vulnerabilities. KOVALEV and his co-conspirators also searched for state political party email addresses, including filtered queries for email addresses listed on state Republican Party websites. 25 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 26 of 29 72. In or around July 2016, KOVALEV and his co-conspirators hacked the website of a state board of elections (“SBOE 1”) and stole information related to approximately 500,000 voters, including names, addresses, partial social security numbers, dates of birth, and driver’s license numbers. 73. In or around August 2016, KOVALEV and his co-conspirators hacked into the computers of a U.S. vendor (“Vendor 1”) that supplied software used to verify voter registration information for the 2016 U.S. elections. KOVALEV and his co-conspirators used some of the same infrastructure to hack into Vendor 1 that they had used to hack into SBOE 1. 74. In or around August 2016, the Federal Bureau of Investigation issued an alert about the hacking of SBOE 1 and identified some of the infrastructure that was used to conduct the hacking. In response, KOVALEV deleted his search history. KOVALEV and his co-conspirators also deleted records from accounts used in their operations targeting state boards of elections and similar election-related entities. 75. In or around October 2016, KOVALEV and his co-conspirators further targeted state and county offices responsible for administering the 2016 U.S. elections. For example, on or about October 28, 2016, KOVALEV and his co-conspirators visited the websites of certain counties in Georgia, Iowa, and Florida to identify vulnerabilities. 76. In or around November 2016 and prior to the 2016 U.S. presidential election, KOVALEV and his co-conspirators used an email account designed to look like a Vendor 1 email address to send over 100 spearphishing emails to organizations and personnel involved in administering elections in numerous Florida counties. The spearphishing emails contained malware that the Conspirators embedded into Word documents bearing Vendor 1’s logo. Statutory Allegations 77. Between in or around June 2016 and November 2016, in the District of Columbia and 26 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 27 of 29 elsewhere, Defendants OSADCHUK and KOVALEV, together with others known and unknown to the Grand Jury, knowingly and intentionally conspired to commit offenses against the United States, namely: a. To knowingly access a computer without authorization and exceed authorized access to a computer, and to obtain thereby information from a protected computer, where the value of the information obtained exceeded $5,000, in violation of Title 18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B); and b. To knowingly cause the transmission of a program, information, code, and command, and as a result of such conduct, to intentionally cause damage without authorization to a protected computer, and where the offense did cause and, if completed, would have caused, loss aggregating $5,000 in value to at least one person during a one-year period from a related course of conduct affecting a protected computer, and damage affecting at least ten protected computers during a one-year period, in violation of Title 18, United States Code, Sections 1030(a)(5)(A) and 1030(c)(4)(B). 78. In furtherance of the Conspiracy and to effect its illegal objects, OSADCHUK, KOVALEV, and their co-conspirators committed the overt acts set forth in paragraphs 67 through 69 and 71 through 76, which are re-alleged and incorporated by reference as if fully set forth herein. All in violation of Title 18, United States Code, Section 371. FORFEITURE ALLEGATION 79. Pursuant to Federal Rule of Criminal Procedure 32.2, notice is hereby given to Defendants that the United States will seek forfeiture as part of any sentence in the event of Defendants’ convictions under Counts One, Ten, and Eleven of this Indictment. Pursuant to Title 18, United 27 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 28 of 29 States Code, Sections 982(a)(2) and 1030(i), upon conviction of the offenses charged in Counts One and Eleven, Defendants NETYKSHO, ANTONOV, BADIN, YERMAKOV, LUKASHEV, MORGACHEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, POTEMKIN, and KOVALEV shall forfeit to the United States any property, real or personal, which constitutes or is derived from proceeds obtained directly or indirectly as a result of such violation, and any personal property that was used or intended to be used to commit or to facilitate the commission of such offense. Pursuant to Title 18, United States Code, Section 982(a)(1), upon conviction of the offense charged in Count Ten, Defendants NETYKSHO, ANTONOV, BADIN, YERMAKOV, LUKASHEV, MORGACHEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, and POTEMKIN shall forfeit to the United States any property, real or personal, involved in such offense, and any property traceable to such property. Notice is further given that, upon conviction, the United States intends to seek a judgment against each Defendant for a sum of money representing the property described in this paragraph, as applicable to each Defendant (to be offset by the forfeiture of any specific property). Substitute Assets 80. If any of the property described above as being subject to forfeiture, as a result of any act or omission of any Defendant -a. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third party; c. has been placed beyond the jurisdiction of the court; d. has been substantially diminished in value; or e. has been commingled with other property that cannot be subdivided without difficulty; it is the intent of the United States of America, pursuant to Title 18, United States Code, Section 28 Case 1:18-cr-00215-ABJ Document 1 Filed 07/13/18 Page 29 of 29