Case Document 98-2 Filed 06/18/19 Page 1 of 50 Exhibit Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 2 of 50 Alf 106 (SONY Rev. 01/17) Application for a Search Warrant UNITED STATES DISTRICT COURT for the In the Matter of the Search of (Briefly describe the property to be searched or identify the person by name and address) See Attachment A ) l ~ Case No. S1 17 Cr. 548 (PAC) ) ) ) APPLICATION FOR A SEARCH AND SEIZURE WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location): located in the ___S_o_u_th_e_r_n_ _ District of _____N_e_w_Y_o_rk_ _ _ _ , th~re is now concealed (identify the person or describe the property to be seized): See Attached Affidavit and its Attachment A The basis for the search under Fed. R. Crim. P. 41(c) is liO evidence of a crime; (check one or more): ixJ contraband, fruits of crime, or other items illegally possessed; :0 property designed for use, intended for use, or used "in committing a crime; 0 a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section(s) Offense Description(s) 18 U.S.C. §§ 401; 793; 1030·, 1503,· 179 1 ·, 22_52 A Contempt of court; unlawful disclosure of classified information; unauthorized computer access; obstruction of justice; smuggling contraband into prison; illegal acts related to child pornography. The application is based on these facts: See Attached Affidavit and its Attachment A ,&{ Continued on the attached sheet. ~ Delayed notice of _lQ_ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested w:ider 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. ~~~{!~-· / ,_.u____,·~_/ :,Applicant's signature . .. ____J_eff_r_ey'.6avi1.~or'ialds~n, Fl31 Special Agent . P;intr3d ncqne .and title Sworn to before me and signed in my presence. Date: 10/03/2018 City and state: _N_e_w_Y_o_r_k~,N_Y_ _ _ _ _ _ __ ;t~,.·.·. ---------Ji-ucf;~ignat,...,'ur_e_ _ _ _ _ _ _ __ The Honorable Paul A. Crotty, U.S.D.J. Printed name and title JAS_021086 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 3 of 50 MAG 4 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United States of America for a Search and Seizure Warrant for Documents Found in a Cell at the Metropolitan Correctional Center, 150 Park Row, New York, New York 10007, previously inhabited by Joshua Adam Schulte TO BE FILED UNDER SEAL Agent Affidavit in Support of Application for Search Warrant SOUTHERN DISTRICT OF NEW YORK) ss.: JEFF D. DONALDSON, being duly sworn, deposes and says: I. Introduction A. Affiant 1. I am a Special Agent of the Federal Bureau oflnvesfigation ("FBI") assigned to the New York Field Office, and have been employed by the FBI since 2010. I am currently assigned to a squad responsible for counterespionage matters and have wor~ed in the field of counterintelligence from 2010 to present. In the course of my duties as a Special Agent, I am responsible for investigating offenses involving espionage and related violations of law, including unauthorized retention, gathering, transmitting or losing classified documents or materials; unauthorized removal and retention of classified documents or materials; illegally acting in the United States as a foreign agent; other national security offenses; and the making of false statements. As a result of my involvement in espionage investigations and investigations involving the unauthorized disclosure or retention of classified information, as well as my training in counterintelligence operations, I am familiar with the tactics, methods, and techniques of United States persons who possess, or have possessed a United States Government security clearance and may choose to harm the United States by misusing their access to classified information. I am also 1 JAS_021087 f Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 4 of 50 familiar, though my training and experience with the use of compu ters in criminal activity and the forensic analysis of electronically stored information. 2. I make this Affidavit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to seize and review certain materials identified during the search of the Metropolitan Correctional Center ("MCC"), pursuant to a search warrant signed by the Court on Octob which took place on October 3, 2018 er 2, 2018 (the "MCC Search Warrant"). The MCC Search Warrant and underlying affidavit are attach ed to this application as Exhibit A and is incorporated by reference, including the defined terms identified therein. 3. As described in more detail, this application seeks the author ity to seize and search documents (the "Schulte Cell Documents") collected from a cell formerly inhabited by Joshua Adam Schulte, among others. At least some of the Schulte Cell Documents appear to relate to the use of the Contraband Cellphones in the MCC and the creatio n of a false exculpatory document (specifically, a document purportedly written by an FBI whistleblower to Wikileaks exonerating Schulte), which are described in more detail below. Other of the Schulte Cell Documents, which the agents have not reviewed, bear indications that they were potentially created to aid in the preparation of Schulte's legal defense. As a result, and out of an abundance of caution, this application requests permission to have law enforcement agents and prosecutors who are not part of the prosecution team (the "Wall Team") search the Schul te Cell Documents first and segregate out any non-privileged documents that are responsive to this warrant. Only the segregated, nonprivileged Schulte Cell Documents will be provided to the prosecution team. The remaining documents will be returned to the MCC for delivery to Schul te within 48 hours. 4. This Affidavit is based upon my personal knowledge; my review of documents and other evidence; my conversations with other law enforc ement personnel; and my training, 2 JAS_021088 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 5 of 50 experience and advice received concerning the use of computers in criminal activity and the forensic analysis of electronically stored information. Because this Affidavit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts that I have learned during the course of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in .substance and in part, except where otherwise indicated. B. The Subject Offenses 5. For the reasons detailed below, I believe that there is probable cause that the Schulte Documents contain evidence, fruits, and instrumentalities of Title 18, United States Code, Sections 401 (contempt of court), 793 (unlawful disclosure of classified information); 1030 (unauthorized computer access), 1503 (obstruction of justice), 1791 (smuggling contraband into a federal detention facility) and 2252A (illegal acts related to child pornography); as well as conspiracies and attempts to violate these provisions and aiding and abetting these offenses (the "Subject Offenses"). II.· Probable Cause and Request to Search 6. Based on my training, experience, and participation in this investigation, as well as my conversations with others, I have learned, among other things, that: a. On October 3, 2018, I and other law enforcement officers executed the MCC Search Warrant. Prior to the search, MCC officials had removed the Schulte Cell Documents, among other things, from Schulte's former cell and stored them in an official office attheMCC. b. The Schulte Cell Documents are comprised of more than approximately 300 pages of materials. In executing the MCC Search Warrant, the agents began to review the Schulte 3 JAS_021089 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 6 of 50 Cell Documents. During that search, law enforcement officers encountered, among other things, the following: i. ii. iii. The Schulte Articles, as described in the MCC Search Warrant; The Pro Se Bail Motion, as described in the MCC Search Warrant 1; A document that bore the name of an email account Gohnsmith742965@gmail.com) identified on one of the Contraband Cellphones, as well as what appears to be the password for that account (the "JohnSmith Document")2; iv. A document that was purportedly authored by a member of the FBI that appears to be intended for Wikileaks (the "Fake FBI Document"). 3 The Fake FBI Document is purportedly from a whistleblower within the FBI who states, in substance and in part, that Schulte was not responsible for the Leak and that the FBI planted child pornography on his computer. c. As the agents were reviewing the Schulte Cell Documents pursuant to the MCC Search Warrant, they identified documents upon which there were markings that indicated they were potentially prepared to aid in Schulte's defense. 7. In light of the foregoing, this application seeks authority for the Wall Team to review the Schulte Cell Documents to segregate out any privileged documents. The Wall Team will then turn over the remainder of the documents to the FBI case agents involved in the prosecution who would review those documents for evidence of the Subject Offenses, including: 1 The MCC Search Warrant does not permit the Government to seize the Pro Se Bail Motion, and the Government is not seeking that authority in this application. 2 The Government is seeking a search warrant to search this email account in a separate search warrant. 3 In prison calls with his parents, Schulte discussed, in substance and in part, having his parents attempt to contact Wikileaks. 4 JAS_021090 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 7 of 50 The Schulte Articles, which are already subject to seizure pursuant to the a. MCC Search Warrant; b. Any documents, including the JohnSmith Document, pertaining to the smuggling in of the Contraband Cellphones and/or their use, which are already subject to seizure pursuant to the MCC Search Warrant; c. Any documents, including the Fake FBI Document, reflecting an attempt to obstruct justice through the creation of false documents; d. Any other documents that would be subject to seizure pursuant to the MCC Search Warrant. 8. All privileged documents and documents not subject to seizure pursuant to this warrant will be returned to the MCC within 48 hours for delivery to Schulte pursuant to MCC protocols. 5 JAS_021091 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 8 of 50 III. Conclusion and Ancill~ry Provisions 9. Based on the foregoing, I respectfully request the court to issue a warrant to search and seize the items and information specified in Attachment A to this Affidavit and to the Search and Seizure Warrant. 10. In light of the confidential nature of the continuing investigation, I respectfully request that this Affidavit be maintained under seal until the Court orders otherwise. S cial Agent Federal Bureau of Investigation Sworn to before me on this 3rd day of October 2018 THE HONORABLE PAUL A. CROTTY UNITED STATES DISTRICT JUDGE SOUTHEB,.Nl)tS'~W:OT OF NEW YORK \ I i _1, , I 6 JAS_021092 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 9 of 50 Attachment A I. Identification of Documents to Be Searched On October 3, 2018, law enforcement officers executed a search warrant at the Metropolitan Correctional Center ("MCC") pursuant to a search warrant signed by the Court on October 2, 2018 (the "MCC Search Warrant"). The MCC Search Warrant is attached hereto as Exhibit A and is incorporated by reference, including the defined terms identified therein. Prior to that search, MCC officials had removed approximately 300 documents from a cell formerly inhabited by Joshua Adam Schulte (the "Schulte Cell Documents") and moved those documents to an official office in the MCC. The Schulte Cell Documents are the subject of this warrant. II. Execution of the Warrant Law enforcement agents are permitted to execute the search warrant at any time in the day or night. Upon the execution of this warrant, notice will be provided at or as soon as possible after the execution of the search. III. Items to Be Searched and Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses Pursuant to the process described below, the Schulte Cell Documents may be searched for the seizure of the following evidence, fruits, and instrumentalities of: Title 18, United States Code, Sections 401 (contempt of court); Title 18, United States Code, Section 793 (unlawful disclosure of classified information); Title 18, United States Code, Section 1030 (unauthorized computer access), Title 18, United States Code, Section 1503 (obstruction of justice), Title 18, United States Code, Section 1791 (smuggling contraband into a federal detention facility) and Title 18, United States Code, Section 2252A (illegal acts related to child pornography); as well as conspiracies and attempts to violate these provisions and aiding and abetting these offenses (the "Subject Offenses"): JAS_021093 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 10 of 50 a. The Schulte Articles, which are already subject to seizure pursuant to the MCC Search Warrant; b. Any documents, including the JohnSmith Document, pertaining to the smuggling in of the Contraband Cellphones and/or their use, which are already subject to seizure pursuant to the MCC Search Warrant; c. Any documents, including the Fake FBI Document, reflecting an attempt to obstruct justice through the creation of false documents; d. Any other documents that would be subject to seizure pursuant to the MCC Search Warrant. B. Wall Team Search Procedures 1. The Schulte Cell Documents will first be reviewed by law enforcement agents and prosecutors who are not part of the prosecution team (the "Wall Team") to segregate out any privileged documents. 2. The Wall Team will then turn over the remainder of the documents to the FBI case agents involved in the prosecution who would review those documents for evidence of the Subject Offenses, as described above. 3. All privileged documents and documents not subject to seizure pursuant to this warrant will be returned to the MCC within 48 hours for delivery to Schulte pursuant to MCC protocols. 2 JAS_021094 Case Document 98-2 Filed 06/18/19 Page 11 of 50 EXHIBIT A 095 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 12 of 50 AO 106 (SDNY Rev. 01/17) Application for a Search Warrant UNITED STATES DISTRICT COURT for the In the Matter of the Search of (Briefly describe the property to be searched or identify theperson by name arid address) See Attachment A I8MAG8377 ) ) ~ ) Case No. S1 17 Cr. 548 (PAC) ) APPLICATION FORA SEARCH AND SEIZURE WARRANT I, a federal law enforcement o.ffic\')r or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that oi:J. the following person or property (identify the person or describe the property to be seaichedandgive its location): N_ew_Y,_o_r_k____ , there is now concealed (identify the located in the ___S_o_u_th_e_rn___ District of _____ person or describe the property to be seized): ·See Attached Affidavit and its Attach merit A The basis for the Search under Fed. R. Crim. P, 41 (c) is (check one or more): 00 evidence of a crime; iXJ contraband, fruits of crime, or other items illegally possessed; ® property designed for use, intended for use, or used in committing a crime; 0 a person to be ru.resteci or a person w}1o is unlawfully restrained. The search is related to a violation of: Ojj'fmse Description(s) Code Sectiori(s) 18 u.s.c. §§ 401; 793; 1030; 1343; 1503; 1791;2252A Contempt of court; unlawful disclosure of classified information; unauthorized computer access; wire fraud; obstruction of justice; smuggUng .contraband into prisoh; illegal acts related to child pornography. The application is based on these facts: See Attached Affidavit and its Attachment A M Continued on the attached sheet . ) is requested rlf Delay()d notice of 30 days (give exact ending date if more than 30 days: , under 18 U.S.C. § 3103a~ the basis ofwhfoh is set forth on tlie attached she.et, lJ:~Q·..·.:. ~ ' ·.'' . .~pplicant 's ) I __. ~ J J :,&:·, ·l·· \,,P.~..... ~;Y . :' ,.,·{ • \ ' =·',,,..·- - - - - - - sig,ia!tp:.e • ' • 1 Jeff;:~v, David .DQnElldson,: FS,1 ',Sj:iecial Agent :··. ' '. '. ,' Pi'inted.~c(lrie ~,1r] tit/¢: ··' Swam to before me and signed inmy presence. 10/4~~01~ Date: 46ffla72018 City and state: New York, NY The Honorable Paul A. Crotty,.U.S.D.J. Printed name and title JAS_021096 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 13 of 50 18MAG8377 UNITED STATES DISTRICT COURT· SOUTHERN DISTRICT OF NEW YORK ..... ____ .., ___ .............. ___________ ,. .__ .,. ... _________ .,. _____ .,. ________ . - ____ .,_ In the Matter of the Application of the United ( States of° America for a Search Warrant for the : Premises Known and Described as 7 South Unit, : 7 North Unit, Including the Cells Located In·: Those Units, arid the Education Department's : Law Library on the Second Floor, located in ( Metropolitan Co1Tectional Center, 150 Park Row, ~ New York; New York 10007, as well as Any: Closed Containers/Items Contained in the \ Premises --- ------ ------------------------ - -------- ---------- ---- -- TO BE FILED UNDER SEAL Agent Affidavit in Support of Application for Search Warrant SOUTIIERN DISTRICT OF NEW YORK) ss.: JEFF D. DONALDSON, being duly sworn, deposes and says: I. Introduction A. Mfiant 1. I am a Special Agent of the Federal Bureau ofinvesti.gation ("FBI'') assigned to the New York Field Office, and have been employed by the FBI sin.ce 20 IO. I am cuiwntly assigned to a squad responsible for counterespic>rtage matters and have worked in the fiel~ of counterintelligence from 2010 to present. In the course of my duties as· a Special Agent, I am responsible for investigating offenses involving espionage and related via lations of law, including unauthorized retention, gathering, transmitting or losing classified documents or materi&ls; unauthorized removal and retention of classified documents or materi'als; illegally acting in the United States as a foreign agent; other national security offenses; and the making of false statements. As. a result of my :involvement b.i espionage investigations and investigations involving the unauthorized disclosure or retention of classified information, as well as my training in counterintelligence operations, I am familiar with the. tactics, methods, and techniques of United States persons who possess, or have possessed a United States Governtnent secwity clearance and 1 JAS_021097 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 14 of 50 may choose to hann the United States by misusing their access to classified information. I am also familiar, though my training and experience with the use of computers in criminal activity and the forensic analysis of electronically stored information. 2. I make this Affidavit in support ef an application pursuant to Rule 41 of the Federal Rules of. Criminal Procedure for a second warrant to search the premises specified below (the "Subject Premises") :for the items and information d(;lscribed in Attachment A. This Affidavit is based upon my personal knowledge; my review of documents and other evidence; my conversations with other law enforcement personnel; and m.y training, experience and advice received concerning the use of computers in criminal activity and the forensic analysis of electronically stored information ("ESI"). Because this Affidavit is being submitted for the limited purpose of establishing probable cause, it does not inc;lude all the facts that I have learned during the course of my investigation. Where the contents of documents and the actions, statements, and convetsations of others are reported herein, they are rep01te.d in substance and in pim-, except where otherwise indicated. B. The Subject Premises 3. The Subject Premises is particularly described as the 7 South Unit (l'Unit-1''), 7 North Unit ("Unit-2"), including the cells located in those units> and the Education Department's law librmy on the second floor (the "Law Library," together with "Unit-1" and "Unit-2," the "Subject Premises") located .in Metropolitan Correctional Center, 150 Park Row, New York, New York 10007. C. The Subject Offenses 4. For the reasons detailed below, I 9elieve that there is probable cause that the Subject Premises cqntain evidence, fruits, and instrumentalities of Title 18, United States Code, Sections 401 (contempt of court), 793 (unlawful disclosure of classified information); 1030 (unauthorized 2 JAS_021098 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 15 of 50 computer access), 1343 (wire fraud), 1503 (obstructfon of justice), 1791 (smuggling contraband into a federal detention facility) and 2252A (illegal acts related to child pornography); as well as conspiracies and attempts to violate these provisions and aiding and abetting these offenses, among other statutes (the "Subject Offenses"). D. Terminology 5. The tetm "computer," as used herein, is defined as set forth in 18 U.S.C. § 1030(e)(l). 6. The terms "records," "documents,'' and "materials" include all information recorded in any form, visual or oral, and by any means, whether in handmade form (including, but not limited to, writings, drawings, paintings), photographic form (including, but not limited to, microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures, photocopies) or electrical, electronic or magnetic form (including, but not limited to, tape recotdmgs, cassettes, compact discs, electronic or magnetic storage devices such as floppy diskettes, hard disks, CD" ROMs, digital video disks (DVDs), Personal Digital Assistants (PDAs), Multi Media Cards· (MMCs), memoty sticks, optical discs, printer buffers, smart cards, memory calculators, electronic dialers, Bernoulli drives, or electronic notebooks, as well as digital data files and printouts 01· readouts from any magnetic, electrical or electronic storage device), as well as the equipment needed to record such information (including but not limited to cameras and video recording md storage devices) .. II. Probable Cause and Request to Search A. Overview 7. As described in further detail below, through this application, the Government seek~ a wan-ant to search the Subject Premises for two iPhcines one with !MEI 358793052665161 and one with IMEI 354444064445994 (the "Contraband iPhones"); a Samsung cellphone with 3 JAS_021099 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 16 of 50 IMEI number 357073084445432 and/or Serial Number R58J61 Q0JCD (the "Schultt;:: Cellphone," together with the Contraband iPhones, the "Contraband Cellphones''); and copies of certain documents written by Joshua Adam Schulte (the "Schulte Documents"), 1 Schulte-who has been indicted for, among other things, possession of child pornography and unlawful disclosure of classified information-and another inp1ate, Omar Amanat-who was convicted at trial of various forms of fraud, including securities fraud-have been usi~g the Contraband Cellphones that were smuggled into the MCC to, among other thing-s, fabricate evidence and disseminate information that is either protected by a court-entered protective order or that is classified. B. Background on Amanat and Schulte's Detention at the MCC 8. Based on my tr1:1,ining and experience, my participation in this investigation, and my conversations with other law enforcement agents and others, and my review ofreports prepared . by others, including other FBI agents, I have learned, among other things, that: a. Between in or about 2012 and November 2016, Schulte was employed by the Central Ifitellige:p.ce Agency (the ''CIA"). b. At the CIA, Schulte worked at a specific group (the "CIA Grm;tp") that, among other things, developed computer applications that the CIA used to gather intelligence abroad. c. As part of his w:ork, Schulte developed specialized skills in, among other things, hacking computers and computer networks and secretly obtaining data from computers and computer networks, d. In or about November 2016, Schulte resigned from the CIA. Prior to his resignation, Schulte had disclosed to other CIA employees that he was angry at what he perceived 1 One of the Contraband iPhones was seized by the MCC on or about September 26, 2018. 4 JAS_021100 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 17 of 50 to be his mistreatment by CIA management in connection with a dispute Schulte had had with another CIA employee. e. Beginning on or about March 7, 2017 through in or about November 2017, the website wikileaks.org ("WikiLeaks") published information from the CIA Group at which Schulte previously worked (the "Leak"). The Leak appears to be the largest unauthorized public disclosure of CIA information in the history of the agency. f On or about August 24, 2017, the FBI arrested Schulte for, among other things, possession of child pornography, based on, in part, the FBI' s discovery of approximately - 10,000 images of apparent child pomogtaphy oti a personal desktop computer used by Schulte. g. Schulte was initially released on bail on or about September 15, 2017, over the Government's objection. Schulte's bail was revoked, however, in connection with his violation of his bail conditions, in particular, restrictfons on his use of computers or the Internet. Sch11lte's actions included, among other things, using an online network that allows for anonymous browsing of the Internet. Schulte has been detained at the MCC since on or about December 14, 2017. h. On or about June 18, 2018, the Government filed a superseding indictment that, in addition to containing the original child. pornography charges, also charged Schulte with violations of, among other statutes, Title 18, United States Code, Sections 793 and 1030, in connection with the Leak. i. The Goven:nuent has produced to Schulte certain search wanant affidavits (the "Schulte Search Warrant Affidavits") pursuant to a protective order entered by the Court on or about September 18, 2017 (the "Schulte Protective Order"). Based on the terms ofthe protective order, Schulte and his defense team were not permitted to disclose the Schulte Search Wall'ant 5 JAS_021101 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 18 of 50 Affidavits or the info1mation contained in them to anyone not involved in the preparation of Schulte's defense. 9. Based ?n my training and experience, my participation in this investigation; my review of reports and other documents prepared by others, and niy conversations with other law enforcement agents and others, including an FBI agent involved in an ear~ier investigation and prosecution of Amanat, I have learned, among other things, that: a. · On or ·about July 13, 2016, the Government filed a superseding indictment c~arging Amanatwith wire fraud, conspiracy to commit wire fraud, aidittg and abetting investment advisor fraud, and conspiracy to commit securities :fraud. b. Amanat was arrested that day and released on bail on or about July 22, 201 q. c. On or about December 26, 2017, Arn.anat was convicted on all counts after a jury trial before the Honorable Paul G. Gardephe. d. Am.anat has been detained at the MCC since on or about December 26, e. Amanat is cm"rently scheduled to be sentenced on or about October 18, 2018 2017. although that sentencing date may be adjourned because of requests by defense counsel for Amanat and his co~defendant, l{aleil Isaza Tuzman, for aFatico hearing. Isaza Tuzman was also convicted on or about December 26~ 2017 and is 01,111:ently-on bail pending sentencing. f. Amanat's brother and co-defenda-q.t, Irfan Amanat, is scheduled to proceed to trial before Judge Gardephe on October 22, 2018, on charges 6:f wire fraud, conspiracy to commit wire fi:aud, aiding and abetting investment advisor fraud, and conspiracy to commit securities fraud. 6 JAS_021102 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 19 of 50 10. Based on my training and experience, my participation .in this investigation, my conversations with other law enforcement agents and others, and my review of reports and recorded telephone conversations, I have learned, among other things, that: · a. 2 Schulte and Amanat ai-e cellmates at the MCC} and are housed in Unit-1. b. 3 During recorded telephone conversations from the MCC, Schulte has stated that he and Amanat are friends and that Schulte is helping Amanat with a rep01t that will help to prove Amanat's alleged innocence. C. Schulte's Violation of the Schulte Protective Order and Disclosure of Classified Information While at the MCC 11. B_ased on my training and experience, my conversations with other law enforcement agents and others, my participation in this investigation, and my review of reports and recorded conversations, I have learned, among other things, that: a. In .or about April 2018, in recorded calls from the MCC, Schulte discussed · with members of his family his desire to talk to members of the media about his case. Schulte also indicated that he had written several documents, which he called "articles," that discussed his case (the "Schulte Articles") and which he wanted to be disseminated to the media. It appears from the calls that at least some of the Schulte Articles may have been provided to one or more members ot'the media. b. In or about April 2018, in a recorded call from the MCC, Schulte spoke with an .individual who appeared to b·e a member of the media. During the call, Schulte discussed the information contained i:p. one of the Schulte Search Wanant Affidavits and why he felt that I understand that based on some of the conduct described in this Affidavit, MCC officials may move Schulte to another part of the MCC so that he is no longer Amanat's cellmate. 2 All conversations or documents referenced in this Affidavit are described in substance and in part. 3 7 JAS_021103 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 20 of 50 information was inaccurate. When asked if the information he was discussing was classified, Schulte responded that it was not classified, but. that it was protected by the "protective order." Nevertheless, Schulte continued to disclose :information found in one of the Schulte Search Warrant Affidavits. Ort or about May 15, 2018, the Washington Post and the New York Times c. published articles about Scb.ulte's case, in which they :indicated that their reporters had learned of information contained in at least one of the Schulte Search Warrant Affidavits. On or about May 21, 2018, at the Governinent' s request, the Court held a d. conference to address Schulte's violation of the Schulte Protective Order. During the hearing, the Government noted, among other things, that it had reviewed recordings of calls Schulte had participated in from the MCC. On or about June 20, 2018, at his arraignment on tlle superseding e. indictment, Schulte submitted a handwritten pro se bail motion to the Court (the "Pi'o Se Bail 4 Motion,'; ±ngether with the SCIDJloo A rtiows, ta@ "ge11• Deettffi@~) . ')~O The day after Schulte submitted the Pro Se Bail Motion, the Government f. informed Sohulte's counsel thafthe Pro Se Bail Motion was undergoing a review by the CIA to determine whether it contained classified information. It appears that after the Govemment informed Schulte' s counsel about the g. cfassification review, Schulte may have sent the Pro Se Bail Motion to an attorney and.his parents. The CIA has reviewed the Pro Se Bail Motion and the Schulte Articles, and h. has determined that the Pi:o Se Bail Motion and at least one of the Schulte Articles conta:in classified information. 4 The Schulte Document, arcy;oro particularlY. described in Attachment A,_. Gn ~ -the >ch ✓k )1 rftc k1 I "'n/ (,, c. U • ~ 15~ JAS_021104 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 21 of 50 D. Am~mat's Fabrication of Evidence During His Trial 12. Based on my training and experience, my participation in this investigation, and my conversations with other law enforcement agents and others, including an FBI agent involved in a prior investigation and prosecution of Amanat, I have learned, among other things, the following: During his trial, Amanat sought to introduce, among other things, a. approximately five emails (the "AmanatFabrica tedEmails"), four of which were admitted initially several in redacted form. In response, during two hearings held outside the presence of the jmy as b. well as in a rebuttal case before the jury, the Government submitted evidence showing that the Amanat Fabricated Emails had been faked by AmaJ.J.at, including, among other things: i. Evidence of discrepancies in header infonnation, including time stamps associated with the Amanat Fabricated Emails and other emails introduced at trial. ii. Evidence that certain of the Amanat Fabricated Emails were not found in certain email accounts or on electronic media used by the purported recipients of the emails. iii. Evidence that the Amanat Fabricated Emails were inconsistent with other contemporaneous and inculpatory communications involving Amanat. iv. An email communication between Amanat and his brother and co- defendant, Irfan Amanat, conceml!ig how to delete emails from a certain email account v. Expert tesfunony from an experienced FBI Special Agent assigned to a cyber squad that four of the five AmanatFabrioatedEmails were fake and/or were nbt sent on the date and titne on which they appeared to have been sent c. As noted above, Amanat was convicted by the jury of all counts. 9 . JAS_021105 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 22 of 50 E. Schulte and Amanat Arrange to have Cellphones Smuggled into the MCC 13. I have participated in an interview of an inmate at the MCC who was housed in Unit-I withAman at and Schulte until recently (the "CS~'). 5 During that interview, the CS reported that, mnong other things: a. For the,past several months, the CS has been paid by Amanat to store and charge the Contrabl:J-i1d Cellphones. b. The Contraband Cellphones were smuggled into the MCC and protected from detection through a netwmk ofvisitors to the facility, inmates, and correctional officers. o. For a time, the CS was tasked with storing and charging the Contraband Cellphones in the CS's cell. During that time-period; the CS also knew the passwords for the devices. d. At s~me point, Schulte decided that he no longer wanted the CS to know the password for the Schulte Cellphone or to store it. Since around that time, the Schulte Cellphone has been stored in other inmates' cells. e. Schulte told the CS that Schulte had implemented certain security protocols with respect to the Schulte Cellphone, such as changing the cellphone's unique device identifier and enabling a function by which all the data on the Schulte Cellphone would be deleted if someone other than Schulte tried to access the phone. f. Prior to Schulte' s retrieval of the Schulte Cellphone, the CS Would regularly take screenshots of messages and recorded videos involving the Contraband Cellphones. The CS The CS is facing immigration and narcotics 1J:afficking charges, and is cooperating i:,n the hope of receiving a more lenfont sent!;lnce and potentially immigration benefits. As described in this Affidavit, the CS's information has been at least partly corroborated by, among other things; a seizure of at least one contraband cellphone. 5 10 JAS_021106 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 23 of 50 subsequently stored those screenshots in an email account the CS created (the "CS Accounf'). Based on these messages and the CS' s conversations with Schulte and A:manat, the CS understood that, among other things: i. Schulte and Amanat were using the Contraband Cellphones in connection with the creation of some sort ofreportthat would be submitted to A:mana:t' s sentencing judge (Judge Gardephe) to show that the Amanat Fabricated Emails were allegedly real. ii. The CS also recalled a communication over at least one of the Contrabanq Cellphones relating to "Vault 7," which is the nar:p_e used by WikiLeaks for the Leak. g. .Amanat and Schulte a:lso discussed their need to have the Contraband Cellphones with them when they accessed discovery at the Law Library. h. During the interview, the CS consented to the search of the CS Account, and provided not only the name of the CS Account, but also the passWol'd for it. 14. Based on my participation in this investigation, conversations with other participants in the investigation; and my review of rep~rts prepared during the investigation, I have learned, among other things, that: a. Unit-I and Unit-2 are on the san1e floor of the MCC and are connected by b. Although inmates from the two units are prohibited from interacting with a corridor. each other in the co1ridor between Unit-1 and Unit-2, imrtafos are, at times, able to meet briefly in that space. c. On ol' about on or about Septewber 26, 2018, MCC officials recovered one of the Contraband iPhones from Unit-1. It does hot appear, however~ that the other Contraband 9ellphones have been recovered by.MCC officials yet. 11 JAS_021107 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 24 of 50 d. The search for the other Contraband Cellphones is ongoing, and has included, among other things, seawhing multiple cells in Unit-1, including Schulte and Amanat's eel~ and cells in proximity to their cell. F. Evidence of Schulte's and Amanat's Illegal Activity Using the Contraband Cellphones 15. Based on my review of the CS Account, my participation in this investigation, conversations with other participants in the investigation, and my review of reports prepared during the investigation, I have learned, among other things, that: a. The CS Account contains approximately 450 electronic files (including , videos and photographs) of the Contraband Cellphones. These files include, among other things, video recordings of Schulte and Amanat using the' Contraband Cellphones and screenshots (or images) of communications received and/or sent using the Contraband Cellphones in connection with Schulte's and Amanat's intended fabrication of evidence and/or dissemination of:i:naterials protected by the Protective O:r:der or that appear classified, including the Schulte Documents. b. Below are several still images taken from videos retrieved from the CS Account that show Schulte and Amanat using the Contraband. Cellphones in the MCC: Video 1 (Image 1) 12 JAS_021108 Document 98-2 Filed 06/18/19 Page 25 of 50 Case 1 13 JAS 021109 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 26 of 50 Video 2 {Image 1) Video ·2 (Image 2) 14 JAS_021110 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 27 of 50 Below are images from the CS Account reflecting communications using c. the Contraband Cellphones: i. The image below from one of the Contraband Cellphones appears to be a draft report prepared by Schulte and Amanatre lated to the fabricated emails fromAma ti.at's trial. I: Introducti,,oiJ 15 JAS_021111 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 28 of 50 ii. The image· below from. one of the Contraband Cellphones appears to be an email describing an excerpt from one of the Schulte Articles: r 16 JAS_021112 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 29 of 50 iii. The image below is a screenshot of what appears to be an email sent over one of the Contraband Cellphone~. ''Protomnail" is an encrypted email service based abroad, and the file "Schulte_Ha..._Notes.pdf' appears to be a reference to the information.contained in the Pro Se Bail Motion. 17 JAS_021113 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 30 of 50 iv. The image below is a screen.shot of one of the Contqiband Cellphones that depicts. certain applications that have been downloaded to the phone, including "Secure Delete" and "IShredder": 18 JAS_021114 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 31 of 50 G. Probable Cause Justifying Search ofESI 16. that Based on the foregoing, and based on my train.mg and experiencer I know among other things, Aman.at and Schulte have used (or are using) the Contraband Cellphones to, r, like individuals create documents and communicate with others outside the MCC. Moreove engaged in anY. other kind of activity, individuals who engage in the Subject Offenses store records on electronic relating to their illegal activity and to persons involved with them in that activity logs of online devices such as the Contraband Cellphones. Such records can include, for example of co-conspirators, "chats'} with co-conspirators; email correspondence; contact information ng and social including telephone numbers, email addresses, and identifiers for instant messagi g bank accoUnt medial accounts; stolen financial and personal identification data, includin and social security numbers, credit card numbers, and names, addresses, telephone numbers, financifl-1 and numbers of other individuals; and/or records of illegal transactions using stolen such records in personal identification data. Individuals engaged in crirninal activity often store ion; (2) keep a order to, among other thing;, (1) keep track of co-conspirators' contact informat illegal proceed s for record of illegal transactions for future reference; (3) keep an accounting of and (4) store stolen purposes of, among other things, dividing those proceeds with co-conspirators; data for future exploitation. 17. nes As a result, there is probable cause to believe that the Contraband Cellpho contain some or all of the following: a. The phone numbers associated with the Contraband Cellphones, as well as , call log information of phone numbers of incomin g and outgoing, and missed or unanswered calls to and from the Contraband Cellphones; b. Address books and contai:,t lists stored on the Contraband Cellphones or its memory card(s); 19 JAS_021115 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 32 of 50 c. s; Voicemail messages, opened or unopened, wlated to the Subject Offense d. of Evidi:ince concerning the identity or location of the owner(s) or user(s) the Contraband Cellphones; e. al(s) Evidence concerning the identity and/or location of the individu involved in the commission of the Subject Offenses; f. in or Evidence of conununications among, or concerning, paiticipants witnesses to the conunissfon of the Subject Offenses; g. of Contact information of co-conspirators and witnesses to the commission and identifiers for instant the Subject Offenses, :including telephone numbers, email addresses, messaging and social media accounts; h. es, Text, data, '~chats," :MMS ("Multimedia Mess!l-ging Service") messag and e-mail messages, any SMS (''Short Message Service'') messages, FaceTime messages, and any associated attachments to those messages, such as digital photographs and videos, the message was sent, information, such as the phone number or e~mail address from which pertaining to the Subject Offenses; i. Digital photographs and videos related to the Subject Offenses; j. the Browsing history~ websites visited, and iri.temet searches conducted on Contraband Cellphones related to the Subject Offenses. 18. ers are used Based on my training ,:\nd experience, I also know that, where comput often be found m.onths·or in furtherance of criminal activity, evidence of the criminal activity can even years after it occurred. This is typically true because: • and users thus Electronic files can be stored on a hard drive for years at little or no cost future. the in consult to have little incentive to delete data that may be useful 20 JAS_021116 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 33 of 50 • Even when a user does choose to delete data, the data can often be recovered months or years later with the appropriate forensic tools. When a fili:, is "deleted" on a home computer, the data contained in the file does not actually disappear, but instead remains on the hard drive, in "slack space? until it is overwritten by new data that cannot be stored elsewhere on the computer. Similarly, files tllat have been viewed on the futernet are generally download ed hi.to a temporaiy Intemet directory or "cache;" which is only overwritten as the "cache'' fills up and is replaced with more recently viewed Internet pages. Thus, the ability to retrieve from a hard drive or other electronic storage media depends less on when the file was created or viewed than on a. particular user's habits. computer and capacity, storage system, operating • In the event that a user changes computers, the user will typically transfer files from the old computer to the new computer, so as not to lose data. In addition, users.ofte n keep backups of their data on electronic storage media such as thumb drives, flash memory cards, CD-ROMs, or portable hard drives. 19. Based on the foregoing, I respectfu lly submit there is probable cause to believe that S~hulte andAman at are engaged in the Subject Offenses, and that evidence of this crimmal activity is likely to be found in the Subject Premises and on the Contraband Cellphones. ill. Procedures for Searching ESI A. Execution ofWarrantforESI 20. Federal Rule of Criminal Procedur e 41(e)(2)(B) provides that a warrant to search seizure or for and seize property "may auth fruits, and instrumentalities of: Title 18, United States Code, Sections 401 (contemp on); court); Title 18, United States Code, Section 793 (unlawful diaclosure of classified informati Title 18, United States Code, Section 1030 (unauthorized computer access), Title 18, United States on of Code, Section 1343 (wire fraud), Title 18, United States Code, Section 1503 (obstructi justice), Title 18, United States Code, Section 1791 (smuggling contraband into a federal detention to child facility) and Title 18, United States Code, Section 2252A (illegal acts related and pornography); as well as conspiracies and attempts to violate these provisions and aiding abetting these offenses, among other statutes (the '"Subject Offenses"): i. A Samsµng cellphone with IMEI 35707308 4445432 and/or Serial Number R58J61Q 0JCD (the "Schulte Cellphone"). JAS_021121 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 38 of 50 2. "); An iPhone cellphone with IMEI 358793052665161 ("iPhone-1 3. ne-2/' together with An iPhone cellphone with IMEI 354444064445994 ("iPho ones"). iPhone-1 and the Schulte Cellphone, the "Contraband Cellph 4. Cellphones. Evidence pertaining to the smuggling in of the Contraband 5. ions wi~ any coEvidence concerning the identity or location of, and collllliunicat conspirators. 6. als, in any format Any and all notes, documents, records, correspondence, or materi , papexs, e-mail messages, chat logs and medium (jncluding, but not limited to, envelopes, letters cache infonnation, and handwritten and electronic messages, other digital data files and web ing, and transmission of classified notes), pe1taining to the unauthorized retention, gather retention of classified do.cuments or documents or materials, and the unauthorized removal and ing titles materials, and, in particular, the documents bearing the follow or descriptions: nces" · a. s of gdeva Article 1: "Presumption oflnnocence: A petif;ion for redres b. Article 2: "Presumption of Innocence: A loss of oitize nshii c. a game" Article 3: "Presumption of Innocence: Do you wantt o play d. ment" Aiticle 4: "Pres ~tion of Innocence: Detention is not punish e. n Wealthy;' Article 5: "Presumption oflnnocence: Innocent until prove f. accused?" Article 6: "Presumption of Innocence: Can you afford to be g. n" Atticle 7: "Presumption of Innocence: A proposed solutio h. Article 8: '1Presumption oflnnocence: Origins" i. Liberty and Article 9: " ... unalienable Rights, that among these ate Life, 1 the pursuit of Happiness" 2 JAS_021122 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 39 of 50 }. MtmtkvHtt:e:tJ 4eetlfl:lvnt dated u1t 01 aoout Jmre 7, 2018 ana ttt!vd "Unite( ,t:;3'1 ~- . J -~,Statesv. Joslm1tAdam Schuito, 17 Cr:")21:8--(P:A.CJ, PR:O SJ;;;-BAU, APPP CA~ 7. Evidence of the Subject Offenses on the Contraband Cellphones, including: a. The phone numbers associated with the Contraband Cellphones, as well as call log information of phone numbers of incoming cind outgoing, and missed or 1]11answered calls to and from the Conttaband CeIIphones; b. Address books and contact lists stored on the Contraband Cellphones or its memory card(s); c. Voicemail messages, opened or unopened, related to the Subject Offenses; d. Evidence concerning the identity or location of the owner(s) or user(s) of the Contraband Cellphones; e. Evidemce concerning the identity and/or location of the individual(s) involved in the commission of the Subject Offenses; · f. Evidence of communications among, or concerning, particjpants in or wjtnesses to the commission ofthe Subject Offenses; g. Contact information of co-conspirators and witnesses to the commission of the Subject Offenses, including telephone numbers, email addresses, and identifiers for inst~t messaging and social media accounts; h. Text, data, "chats," MMS (''Multimedia Messaging Service") messages, SMS ("Short Message Service'i) messages, FaceTime messages, and eMmail messages, any attachments to those messages, such as digital photographs and videos, and any associated :information, such as the phone number or e-mail address from which the message was sent, pertaining to the Subject Offenses; i. Digital photographs and videos related to the Subject Offenses; 3 JAS_021123 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 40 of 50 ·~· . ,;\ j. on the Browsi ng history, websites visited, and inteme t searches. conducted Contraband Cellphones related to the Subject Offenses. 8. el will If law enforcement personnel seize the Contraband Cellphones, the personn 60 days from the date of search the device within a reasonable amount of time, not to exceed ted, it is determined that a execution of the warrant. If, after such a search has been conduc Government will r~tain the computer or device contains any data listed in paragraphs 2 and 3, the s) are no longer necessary computer or device. If it is determined that the. computer(s) or device( pursuan t to Federal Rule to retrieve and preserve the data, and the itetns are not subject to seizure of Criminal Procedure 41 (b), such materials and/or equipment will be returne d within a reasonable d no later than 60 days from time. In any event, such materials and/or equipment shall be returne Court. the execution of this warrant, unless :further application is made to the B. Search and Seizure of Electronically Stored Information any cellphones The items to be searched and seized fi'om the Subject Premises also include the categories set forth in that may contain any electronically stored information falling within to, desktop and laptop Section III.A of this Attachm ent above, including, but not lim,ited ts, smru.t phones, digital computers, disk drives, modems, thumb drives, personal digital assist;m the Subject Premises also cameras, and scanners. The items to be searched and seized from include: 1. or copied Any items· or records needed to access the data stored on any seized physical keys, encryption computer devices or storage media, including but not limited to any devices, or records oflogin credentials, passwords, private encryption, keys,. or sjmil.ar intorination. 4 JAS_021124 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 41 of 50 2. computer Any items or records that may facilitate a forensic examination of the s or other information devices or storage media, including any hardware or software manual concerning the configuration of the seized or copied computer devices 3. or storage media. hip of Any evidence concerning the petsons with access to, control over, or owners the seized or copied computer devices or storage media. C. R,eview ofESI the creation of Following seizure of any computer devices and storage media and/or to law enforcement forensic image copies, law enforcement personnel (including, in addition of the officers and agents, and depending on the natul'e of the ESI and the status investigation and staff, agency personnel related proceedings, attorneys for the government, attor.µey support ex.perts under government assisting the government in "this investigation, and outside teclmical control) are authorized to review the ESI contained therein for information responsive to the warrant. techniques, In conducting this review, law enfotcem.ent personnel may use various including but not limited to: • (analogous to surveying vario.us file "directories" and the individual files they contain looking at the ou,tside of a file cabinet for the )llatkings it contains and opening a drawer believed to contain pertinent files); • 11 11 to determine opening or cursorily reading the first few pages of such files in order their precise contents; • scanning storage areas to discover and pot3sibly recover :recently deleted • scanning storage areas for deliberately hidden files; files; 5 JAS_021125 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 42 of 50 • performing key word searches through all electronic storage areas to determine whether occurrences oflanguage contained in such storage areas existthat are intimately related to the subject matter of the investigation; and • making rea~onable efforts to utilize computer search methodology to search only for files, documents, or other electronically stored information within the categories identified in this Attachment. 6 JAS_021126 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 43 of 50 AO 93 (SDNY Rev. 01/17) Search and Sf)izure Wartal)t UNITED STATES DISTRICT COURT for the ofNewYork District Southern ) ) ) ) ) ) in the Matter of the Search of (B.riefly describe the property to be searched or identify the pel'SCJn by name and address) See Attachment A ]., 8 MAG f)) !{t, 7·-. 7 Case No. S117 Cr. 548 (PAC) SEARCHAND .SEIZURE WARRANT To: Any authorized law enforcement officer An application by a federal law enforcement officer or an attorney for the government requests the search New York District of Southern of the following person or property located in the {identify the person oi· describe the property to be searched and give its location): See Attachment A Th\;l person or property to be searched, described above, is believed to conceal (iden~ify the person or describe the property to be seized}: See Attachment A The search and seizure are related to violation(s) of (insert statutory citations): TIiie 18, United States Code, Sections 401 (contempt of court), 793 {Unlawful disclosure ofcJasslfied infonnalion); 1030 (unauthorized computer access), 1343 (wii:a fraud), 1503 (obstruction of justice), 1791 (smuggling contraband into a federal detef)tion facility) and 2252A (illegal acts related to child pornography) I find that the affidavit(s), or any recorded testimony, establish probable ca1:1se to search and seize the person or property. October 15, 2018 YOU ARE CO.MMA.Ni>ED to execute this warrant on or before (not to exceed 14 days) 0 in the daytime 6;00 a.m. to 10 p.m. ref at any time in the day or night as I find reasonable cause has been established. Unless delay<1d notice is authorized below, you must give a copy of the warrant and a repeipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the . , .· .. ( . place wheretheptopertywas taken. The officer executing this warrant, or fill officer present during the exec~tio:n'. o±: tb.7 ~atrartf·tp.1.ist prepare; an , inventory as required by law and promptly return this warrant arid inventory to t\ilCle:i;kd;fthe c;outt · P,v 111 · ~ Upon its return, this wan·ant and inventory should be filed unde1' seal by;-'t,p:e µJerk of ~h. e Cpurt,. . .'- >'.,,'i.;:,. • • · , ·• • \ { · .,.-.i,-'-rs&~:Y_L_m_'ti_al._s . .· ,- , , ! • ~ •• • .~'!elay ii I find that .immediate notification may have an adverse result listed in 'i 8\{r.~,c.' § i16s. (eid~,i:it:for prop\;lrfy, will be of trial), and authorize the officer executing this warrant to delay notice to the p,0.r~9n'.. v,:p.o, or whi:\se 30 days (not to exceed 30). · -. i . , • • ·, ,. searched or seized (check the appropriate box) &effor • until, the facts justifying, e latel' s~~cWo' of ·, • ~a~e I 1/J ! , 1 ,\, Date and time issued: Q(()~ Ci1.y and state: _N_e_w_Y_o_rk~,_N_Y_ _ _ __ The Honorable Paul A Crotty, U.S.O.J. Printed name and title JAS_021127 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 44 of 50 AO 93 (SDNY Rev. 01117) Search and Seizure Warrant (Page 2) Case No.: IDate and time Return wan."fillt exequted: ICopy of warrant and :inventory left with: S1 17 Cr. 548 (PAC) Inventory 'rl;lade 1Il. the presence of : Inventory of the property taken and name of any _person(s) seized: Cer-tifieation along with the original wru:rant I declare under penalty of perjuty that this fuventmy is c01rect and was returned to the Coutt. Date: _ _ _ _ _ _ __ · · E.xectitfrig officer'.~ signatui·e. Ptinred name and title JAS_021128 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 45 of 50 AttachmeJ1t A I. Premis~ to be Se~rched-Subjlclct Premises The premises to be searched (the "Subject Premis,es") is desCJribed as follows, and includes all iqcked and closed contain¢rs found therein: The Subject Premises is particularly described as the 7 South Unit, 7 North Unit, including. the cells located in those units, and the Education Department's la,w library on the second floor of the building, foi;.;_ated in Mettbpoiitah Correctiortal Center:, 150 Park Row, New York, New York 10007. II. Execution of the Warrant Law enforcement a,gents are permitted to execute the search wattant at ai).y time in the. cfay or n,ight. Upon the execution of this warrant, notice will be provided at or as soon as possibfo a:fte.r the execution ofthe search. III. Items to 13e Searched and Seized A. Evid,mce; )fruits, a:qd Instrumentalities of the Subject Offenses The items to be searched and/or seized from the Subject Premises include the following evidence, fruits, and instrumentalities of: Title 18; United States Code, .Se•ti:ons 401 (c~mtempt of court)~ Title 18; United States Code, SectioJ+ 793 (unlawful disclosure of clas.slfied informatioh); Title l 81 United State$ Code, Section 1030 (unauthorized computer access),_ Title 18, United States Code, Section 1343 (wire fraitd), Tjtle lS, United States Code, 'Section 15.03 (obstruction of justice), Title 18; United States Code, Section l 79i (smugglii::i.g co;trtraband into a federal detention faci\ity) and Title 18, United States. Code, Section .2252.A (illegal acts related to child pornography); as well as conspiracies and attempts to violate these ptovisioii.s aQ.d aiding and abetting these. offenses, atnqng other statutes (the ''S1J,bject Offenses"): 1. A Samsung cellph01;1e with XME;[ 357073084445432 and/or Serial Number R58J61 QOJCD (the «Schulte Cellphone"). JAS_021129 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 46 of 50 2. An iPhone cellphone withIMEI 358793052665161 C'iPhone-1';); 3. An iPhone cellphone with IMEI 354444064445994 ('~iPhone-2/' t9gether with iPhone- l and the S-chulte Cellphone; the "Contraband Cellphones''). 4. Evidence pe:ttawing t-0 the smuggling in o:f the Contraband Cellphones. 5. Evidence conqern.mgthe identity or location ot alld comm®ications with, any co- conspirators. 6. Any and all notes, documents, records, correspondence, or materials, in an,y form.at and medium (in~luding, hut not limited to, envelopes:, letters, papers, e-mail messages, chat logs and electronic messages, other digital data files a,nd web cache in.formation, and handwritten notes)~ pertaining to the unauthorized retention, g!;IJhe.tmg; and transmission of classifiep. or documents or materials, and the unauthorized removai and. retention of classified documents materi::tls, and, in particular, the documents bearing the following titles or desoriptions: a. Article 1,: 'Tresw,nption oflnnocence: A petition for re.dress of grievl;i,noes" b. Article 2: '~Presumption ofinnocence: A loss of citizenship,, c. Article 3: "Presumption of Innocence: Do you want to play a game" d. Article 4: "Presumption 9flnnocenc~: Detention is riot punishmep.t'' e. Article 5: 1'Presumption oflnnoc.ence: Innocent until proven Wealthi ' f. Article 6: 1'Presumptio11 of Innocence, Can you afford to be accused?" g. Article 7: ''Presumption oflnnocence: A proposed solution" h. Article 8: "Ptes4tnption ofI:nnoce.rice.: Origins'' i. Article 9: " ... Ulialienable Rights, that among these are Life,. Liberty and the pursuit of Happiness" 2 JAS_021130 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 47 of 50 j. Hand,w,4tten d0eiat1re nt dared 011 oi about »IPv 7 2018 and titJed Hfln,i,tea-c. ~~..r;.,,, HOH. t:_ .,States ". Joshua t.dnm Sehulte? 17 Cr 548 Qt? '\C), PRO gg Bi\IL APl?I,IG 6 7. l"'i)W Evidence of the Subject Offenses on the Contraband Cellphones, including: a. The phone numbers associated with the Contraband Cel!phones, as well as red calls call log information of phone numbers of incoming and outgoing, and missed or unanswe to and from the Contraband Cellphorn~s; b. Address books and contact lists stored on the Contrab~nd Cellphones or its memory card(s); c, Vciiceinail messages, opened or unopened, related to the Subject Offenses; d. Evidence concerning the identity or location of the owner(s) or user(s) of the Contraband Cellphones; e. Evidence concerning the identity and/or location of the individual(s) h?-volved in the commission of the Subject Offenses; f. Evidence of communications among, or concerning, participants ih or witnesses to the commission of the Subject Offenses; g. Contact information of co-conspirators and witnesses to the commission of s for instant the Subject Offenses, including telephone numbers, l:lrnail addresses, and identifier messaging and social media accounts; h. Text, data, "chats," MMS ("Multimedia Messaging Service") messages; messages; any SMS ("Short Message Service") messages, FaceTime messages, and e-mail any associa,ted attachments to those inessag~s, such as digital photographs and videos, and was sent, information, suoh as the phone number or e~mail address from which the message pertaining to the Subject Offenses; i. Digital photographs and videos related to the Subject Offenses; 3 JAS_021131 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 48 of 50 ~. 1./~ . ./' , ·"'• • j. Browsing history, websites visited, and internet searches conducted on the Cop:traband Cellphones related to the Subject Offenses. &. If law enforcement personnel seize the Contraband Cellphones, the personnel will search the device within a reaso:uable amount of time, not to exceed 60 days from the date of execution of the warrant. If, after such a search has beett tonducted, it is determined that a computer or device contains any data listed in paragraphs Z and 3, tht:; Governttieutw:ill retain the corpputet ot device. If it is determined that the computer(s) or device(s) are no lohger necessary to retrieve and preserve the data, and the items are not subject to s.eizure. pursuant to F e.deral Rule of Criminal Procedure 41 (b), such materials and/or equipmentwill be returned within a reasonable time. In any event, such materiais and/or equipment shall be retµttj~d n~ later than 60 days from the execution of this warrant, unless further application is made to the Couti:. B. Search and Seizure of Electronically Stored Informatlon The items to be searched ands?.ized from the SubjectPremises also include any oellphoneg that may contain any electtom.caliy stored information falling within the categories set forth in r • •• Section III.A of this Attachment above, irtoh.tditig, b,trt not limited to, desktop and laptop computers; disk drives, modems, thunib drives, personal digit<.11 a.ssistants, smart phones, digital camer~s, a:n;d scanners. The items to be searched and sei:z;ed from the. Subject Premises ::i.!so inclu.de: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media1 including but rtot limited to any physical keys, encryption devices~ orrecords of login cre.dentialsj passwords, private encryption keys, or simifat information. 4 JAS_021132 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 49 of 50 .,Jl 'ir r Any items or records that may facilitate ·a forensic examination of the compute 2; other information devices or storage media, including any hardware or software manuals or concern ing the configuration of the seized or copied computer devices or storage media. ip of Any evidence concerning the persons with access to, control overi or ownersh 3. the seized or copied computer devices or storage media. C. Review of ESI creation of Following seizure of any cornputer devices and storage media and/or the to law enforcement forensic image copies, law enforcement personnel (including, in addition investigation and . officers and agents, and depending on the nature of the ESI and the stahls of the agency personnel related proceedipgs, attorneys for the government, attorney support staff, under government assisting the government in this investigation, and outside technical c;xperts responsi ve to the control) are authorized to review the ESI contained therein for information warrant. techniques, In conducting this review, law enforcement personn el may use various includin g but not limited to: • us to surveying various file '~directories" and the individual files they contain (analogo looking at the outside of a file cabinet for the markings it contains and opening a drawer · believed to contain pertinen t files); • 11 11 e opening or cui'soriiy reading the first few pages of such :files in order to determin their precise contents; • scanning storage areas to discover and p9ssibly recover recently deleted files; • scanning storage areas for deliberately hidden files; 5 JAS_021133 Case 1:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 50 of 50 • ne whether performing key word searches through all electroiric storage areas to determi ly teli;i.te~ occ1Wences of language contained in such storage areas exist that are intimate to the subject matter of the i:rivestigation; and • only for making reasonable efforts to utilize computer search methodology to s~atch categories files, documents, or other electronically stored infotmation within th;!;: identified mthis Attac.hment. 6 JAS_021134