Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 1 of 18 U.S. Department of Justice [Type text] United States Attorney Southern District of New York The Silvio J. Mollo Building One Saint Andrew’s Plaza New York, New York 10007 January 21, 2020 Via ECF The Honorable Paul A. Crotty United States District Judge Southern District of New York United State Courthouse 500 Pearl Street, Courtroom 14C New York, New York 10007 Re: United States v. Joshua Adam Schulte, S2 17 Cr. 548 (PAC) Dear Judge Crotty: The Government submits this letter in response to the Court’s order, dated January 15, 2020 (the “Order”), and the defense’s letter, also dated January 15, 2020 (the “Letter”). In the Order, the Court directed the Government to identify the specific portions of the defendant’s notebooks and loose documents (collectively the “MCC Notebooks”) that the Federal Bureau of Investigation (the “FBI”) seized from the Metropolitan Correctional Center (the “MCC”) upon which the Government intends to rely at trial, and to explain the relevance of those portions. The Court issued that Order in light of the defense’s contention that the writings in the notebooks can be explained based on purported advice counsel provided to the defendant, which, in their view, mitigates the inculpatory impact of those notebooks. The Government has supplied information in response to the Order in Point II below. After the Court issued the Order, defense counsel filed the Letter. In the Letter, the defense has now violated a direct order from this Court and refused to provide the Government with the purported advice at the center of this fabricated controversy, forcing the Government to respond to the Order in the blind and the Court to address resolve the controversy without the benefit of both sides’ informed views. The defense has left the Court with no choice—the Government respectfully submits that the Court should enforce its order as it warned the defense it would, by precluding the defendant from advancing an advice of counsel defense with respect to the MCC Notebooks or calling any witnesses relating to that defense. Moreover, if the Court precludes the advice of counsel defense, the purported conflict issue surrounding the MCC Notebooks disappears, which, in turn, significantly limits the controversy at trial surrounding the notebooks. I. THE COURT SHOULD PRECLUDE THE DEFENDANT FROM ADVANCING A DEFENSE BASED ON THE PURPORTED ADVICE PROVIDED BY HIS COUNSEL On January 13, 2020, the Court ordered the defendant “to disclose the attorney-advice that Schulte relies on to defend against the Government’s allegations.” (Dkt. 248, at 2). The Court Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 2 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 2 issued that ruling based on an extensive record stretching back to when the Federal Defenders first raised this issue in August 2019. Since that time, the parties have filed almost a dozen letters on this topic—in which the defense, among other things, sought severance and disqualification based on purported attorney advice that they assert is admissible but nevertheless refused to disclose— and the Court held a Curcio hearing at which the defendant “unequivocally stated he wishes to retain his right to call both Mr. Larsen and Ms. Shroff at trial.” (Id. at 7). Based on that record, the Court (i) ordered the defendant to “disclose all ex parte letters concerning the purported testimony to the Government” and (ii) stated that the “[f]ailure to provide this discovery will preclude reliance on an advice-of-counsel defense at trial.” (Id. at 12-13). On January 15, 2020, defense counsel filed the Letter, making clear that they refuse to comply with the Court’s order. Defense counsel’s conduct is extraordinary, following months of litigation concerning the purported conflict and the fact that the Court, at the defense’s request, has already once stayed its ruling directing the defense to disclose the advice to allow for additional briefing. As an initial matter, it is axiomatic that attorneys cannot simply refuse to follow orders they do not agree with. See United States v. United Mine Workers of Am., 330 U.S. 258, 293 (1947) (“[A]n order issued by a court with jurisdiction over the subject matter and person must be obeyed by the parties until it is reversed by orderly and proper proceedings.”). Moreover, defense counsel’s purported bases for refusing to follow the Court’s order—to protect the defendant’s attorney-client privilege and appeal rights—are disingenuous and without merit. With respect to his attorney-client privilege, the Court has already found, based on an extensive factual record, that the defendant waived the privilege. That ruling is sound and “[f]ederal court orders are to be obeyed unless and until litigants succeed in having them duly overturned by the appropriate court of appeals. Litigants may not defy court orders because their commands are not to the litigants’ liking.” United States v. Philip Morris USA Inc., 287 F. Supp. 2d 5, 14 (D.D.C. 2003). The defendant has stated repeatedly that he intends to rely on this advice (or at least is strongly considering relying on that advice) at trial. In those circumstances, the Government is entitled to discovery in advance of trial concerning, at a minimum, the substance of the anticipated attorney advice so that the parties can litigate whether the advice should be admitted at all. The defendant’s contrary position—that the has an absolute right to withhold this information until he decides to disclose it—is lawless and, if adopted, would be a radical change to discovery in advice of counsel cases. It is extremely troubling that at this point in the litigation, less than two weeks before trial, the defense is still obstinately refusing to disclose even minimal summaries of advice that they claim exonerates the defendant of one of the charges for which he faces trial. The defendant’s appellate rights are also plainly preserved. It is abundantly clear that the defense has repeatedly taken a position that the advice should not be disclosed. But objecting to a Court order is not the same thing as refusing to follow it. The path defense counsel has chosen has nothing to do with preserving appellate rights and everything to do with their continued campaign to delay this trial. Defense counsel’s brazen disregard of the Order leaves the Court with no choice: the Court should preclude the defendant from introducing any evidence concerning his attorney’s advice at trial. United States v. Levin, No. 15 CR. 101 (KBF), 2016 WL 299031, at *7 (S.D.N.Y. Jan. 25, 2016) (“A failure to comply with disclosure obligations can result in preclusion or another order that is just under the circumstances.”). Indeed, several courts in this Circuit have enforced preclusion for a party’s failure to comply with its disclosure obligations. See, e.g., United States Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 3 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 3 v. Weiss, 930 F.2d 185, 199 (2d Cir. 1991); United States v. Mahaffy, No. 05 Cr. 613, 2007 WL 1213738, at *3 (E.D.N.Y. Apr. 24, 2007) (precluding expert testimony where defendant ignored pre-trial discovery order and waited until the first day of trial to make Rule 16(b) disclosure); United States v. Ryan, 448 F. Supp. 810, 810 (S.D.N.Y. 1978); see also Fed. R. Crim. P. 16(d)(2)(C) (stating that if a party fails to comply with a discovery order, the Court may “prohibit that party from introducing the undisclosed evidence”). If the Court does preclude the defendant from calling any of his attorneys at trial and relying on the purported legal advice because of their refusal to comply with the Court’s order, then the alleged conflict issue underlying defense counsel’s serial motions to disqualify themselves and adjourn the trial would also evaporate. As the Court is well aware, the use of the attorney advice at trial provides the sole basis for the relief the defendant sought over the past few months—first severance and now disqualifications. Precluding the defendant from offering evidence as to that advice would completely eliminate the purported ethical and conflict issues, leaving no obstacle to proceeding to trial on February 3, 2020 with the defendant’s current counsel. II. THE PORTIONS OF THE DEFENDANT’S NOTEBOOKS THAT THE GOVERNMENT INTENDS TO RELY ON AT TRIAL ARE ADMISSIBLE Assuming the Court precludes the defendant presenting an advice of counsel defense, the only question left open concerning the MCC Notebooks would be what portions of them are admissible under the Federal Rules of Evidence. In this vein, the Court directed the Government in the Order to (i) “identity the specific documents and statements it intends to introduce from the MCC notebooks”; (ii) “explain why the specific documents should be admitted and what the specific evidence will be offered to prove (e.g., Guilty Conscience)”; and (iii) explain “why the other non-notebook evidence is insufficient or incomplete.” (Dkt. 252, at 2). The Government has provided that information below. As set forth below, the MCC Notebooks are directly relevant to the crimes charged in the Superseding Indictment and devastating proof of the defendant’s guilt. To be clear—the MCC Notebooks are not simply additional or attenuated proof of the defendant’s conduct in the MCC, but rather central evidence that goes to the heart of the charges against the defendant, which neither implicate his communications with his attorneys nor reflect only his private thoughts. For example, Count Four of the Superseding Indictment charges the defendant not only with transmitting national defense information (as he did when he communicated with a reporter) but also with attempting to transmit national defense information that he drafted in the MCC Notebooks expressly for disclosure. Moreover, the portions of these documents that show the defendant’s rage at being imprisoned, his declaration of an “information war,” and his avowed intention to destroy the United States’ diplomatic relationships demonstrate conclusively that the defendant had reason to believe these transmissions would or could harm the United States, which is an element of Counts Two, Three, and Four. Indeed, that was his explicit intent in drafting and attempting to disseminate the materials contained the MCC Notebooks. Finally, while the Court is correct that the Government collected other evidence of the defendant’s criminal conduct in prison, the MCC Notebooks are necessary to connect the defendant to that other evidence. The MCC Notebooks show, for example, that it was the defendant who emailed national defense Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 4 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 4 information to a reporter using an encrypted email account that was not in the defendant’s name and in which the defendant pretended to be another person. Put simply, the Government’s insistence on relying on the MCC Notebooks and the defendant’s vociferous resistance to their introduction at trial are grounded in the same fact—these documents are overwhelming evidence of the defendant’s guilt. A. The MCC Notebooks are Relevant and Not Duplicative 1. Overview The Government anticipates that the evidence at trial will show, in substance and in part, the following: Following the defendant’s arrest in August 2017, the defendant has engaged in a campaign to drum up media attention for his case and to paint himself as an innocent man. As part of that campaign, the defendant drafted a series of “articles” that he wanted to disseminate to the media for publication. After the defendant was detained in December 2017, he increasingly began to rely on members of his family to convince reporters to write news stories about his case. While at the MCC, he also considered using online methods to submit additional information to WikiLeaks. One of the primary focuses of the defendant’s articles were the search warrants executed during the investigation of the Vault 7 leaks (the “Protected Search Warrants”), which the defendant claims, incorrectly, were illegally obtained. The Government produced the Protected Search Warrants to the defendant in discovery pursuant to a protective order from the Court (the “Protective Order”), which prohibited disclosure of the Protected Search Warrants to individuals outside of the defense team. In flagrant violation of the Protective Order, the defendant caused the Protected Search Warrants and several of the defendant’s articles to be delivered to at least one reporter. In addition, in April 2018, the defendant had at least one conversation from prison with an apparent reporter in which, despite acknowledging that the Protected Search Warrants were subject to the Protective Order, the defendant nevertheless described the information in one of the affidavits for the Protected Search Warrants. In May 2018, The Washington Post and The New York Times both published stories (the “Post Story” and the “Times Story”) in which the authors referenced the Protected Search Warrants. After these news articles were published, the Court scheduled a hearing at the Government’s request, at which the Court reiterated the requirements of the Protective Order and confirmed that the defendant understood its terms. Undeterred, the defendant pressed ahead with his attempts to have his articles publicly disseminated. Because he was incarcerated, the defendant enlisted his family to communicate with reporters and to post the defendant’s articles online, including on a public Facebook page (the “John Galt Facebook Page”). While the defendant’s family was able to post a version of the defendant’s articles on the John Galt Facebook Page, the articles apparently did not result in the swell of press attention for which the defendant hoped. Over the summer and into the fall of 2018, the defendant grew angrier at his detention, but also his family’s inability, and eventually unwillingness, to publish all of the defendant’s articles and the media’s apparent lack of interest in the defendant’s case. Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 5 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 5 Around this time, the defendant and another inmate (“Inmate-1”) arranged to have several contraband cellphones (the “Contraband Cellphones”) smuggled into the MCC for their use. While both the defendant and Inmate-1 had access to the cellphones, the defendant typically used Samsung cellphones, while Inmate-1 preferred Apple iPhones. The defendant and Inmate-1 used these cellphones to, among other things, draft material about the prosecutions against them, with the defendant even drafting a purported “expert report” for Inmate-1’s case. At the same time, the defendant also began to use one of the Contraband Cellphones (the “Samsung Phone”) to rewrite and recover his articles, and to communicate with individuals outside of the MCC about publishing his articles. In or about August 2018, the defendant’s frustration with his family boiled over, and he decided to take matters into his own hands. Rewriting his articles from scratch would take time, however, so the defendant requested that his family provide him with electronic copies of his articles to edit and disseminate. His family refused to further disseminate the articles, or to give them back to the defendant so he could do it himself. Angry at this turn of events and his continued detention, the defendant lashed out against the United States government, pledging to destroy the country’s diplomatic relationships and to engage in an “information war” against the nation through the public dissemination of sensitive information. The defendant began to plan his “information war” in August 2018. He took over the John Galt Facebook Page, intending to use it as a platform upon which he could post his articles from the MCC. The defendant also created blogs through another social media service, Word Press, and began to post content on those blogs (collectively, the “Blogs”). At the same time, the defendant began to rewrite his articles, including his tenth article, “Malware of the Mind” (the “Malware Article”). Because it was difficult to rewrite these articles in the MCC, however, the defendant attempted to enlist the author of the Post Story (the “Reporter”) to assist him. To that end, in late August, the defendant sent the Reporter an email using the email account annon1204@protonmail.com (the “Annon Account”). The Annon Account is an encrypted email account serviced by the provider, Proton Mail (“Proton”). The defendant also created at least two other Proton Mail accounts from the MCC as well (together with the “Annon Account,” the “Encrypted Email Accounts”). In his correspondence with the Reporter, the defendant, pretending to be the defendant’s family and friends, asked the Reporter to send him the versions of the defendant’s articles that the defendant and his family had previously provided to the Reporter. When the Reporter demurred and sought confirmation from the defendant’s family whether the Reporter could provide the defendant’s articles to the user of the Annon Account, the defendant, posing as a member of his family, used a secure messaging application, Signal, to authorize release of the articles. In these Signal communications (the “Signal Messages”), the defendant claimed that the user of the Annon Account was a member of the hacktivist group Anonymous, of which, according to the defendant, the defendant was once a member. Anonymous has collaborated in the past with WikiLeaks to disclose stolen sensitive information. Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 6 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 6 During this period, the defendant also began to take steps to conceal his conduct. He deleted evidence in his email accounts and on the cellphone(s) he used, and began to link his social media accounts to Proton Mail accounts, rather than his personal email account. The defendant also began to operationalize his “information war.” In September 2018, he used the Annon Account to email (the “September 2018 Emails”) the Reporter another copy of the materials for one of the Protected Search Warrants and a purported refutation of the statements in the affidavit submitted in support of the warrants, in which the defendant included classified information. Later in September 2018, the defendant sent another email to the Reporter promising a disclosure of more sensitive information if the Reporter would agree to publish materials on a timeframe the defendant dictated. Around this time, the defendant also drafted tweets (the “Fake Authentication Tweets”) in the MCC Notebooks, in which he claimed that the author of the tweets was one of his former CIA colleagues, and, in which, to “authenticate” the purported author’s employment with the CIA, he included classified information about CIA employees, operations, and tools. Some of the tweets also alleged that the purported author had information that someone other than the defendant was responsible for the leak. To disseminate those tweets, the defendant created a Twitter account (the “Bourne Account,” and together with the John Galt Facebook Page and the Blogs, the “Social Media Accounts”) from the MCC—named after “Jason Bourne,” a fictional movie character who worked as a special operative for the CIA. Before the defendant could provide additional classified information to the Reporter or post the Fake Authentication Tweets, however, the FBI searched the MCC and disrupted the defendant’s plans. 2. The Classified Information Underlying Count Four of the Superseding Indictment The Government charged the defendant with two additional crimes based principally on his prison conduct: one count of violating 18 U.S.C. § 793, in connection with his unlawful disclosure and attempted disclosure of national defense information from the MCC (Count Four, the “MCC Leak Charge”), and one count of violating 18 U.S.C. § 401(3), in connection with his willful violation of the discovery protective order (Count Eleven, the “Contempt Charge”). These counts are predicated on the following disclosures and attempted disclosures of national defense information (the “MCC National Defense Information”) 1: 1  First, in one of the articles that the defendant provided to his family for public dissemination, the defendant identified the location of an undisclosed, covert CIA technical base located overseas (the “Classified Article”).  Second, while incarcerated in the MCC, in the September 2018 Emails, the defendant attached a document that contained classified information concerning the The Government has specifically identified the classified portions of these documents for both the Court and defense counsel in prior classified submissions, including the Government’s formal notice pursuant to Section 10 of the Classified Information Procedures Act (“CIPA”), dated July 29, 2019, that these were “portions of the material that [the Government] reasonably expects to rely upon to establish the national defense element of the offenses charged in the superseding indictment.” Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 7 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 7 CIA’s network structure (the “Network Structure Document”) and a copy of Protected Search Warrant materials (which is the basis of the Contempt Charge).  Third, in the Malware Article, which appears to be addressed to members of the information technology industry, the defendant discussed classified aspects of the defendant’s work at the CIA (the “Malware Disclosure”). Although there is no evidence that the defendant successfully transmitted the Malware Article, the evidence shows that it was one of the defendant’s articles that was intended for public dissemination, and is thus a basis for the charge of attempted disclosure of national defense information.  Fourth, in the Fake Authentication Tweet, the defendant included information concerning the name and purpose of a specific CIA tool, as well as how the tool could be used in an intelligence gathering operation. Although it is not clear whether the Fake Authentication Tweet actually was posted, the evidence, including the creation of the Bourne Account, shows that he intended to post it and is similarly a basis for the charge of attempted disclosure of national defense information. 3. The Portions of the Notebooks Upon Which the Government Intends to Rely and the Reasons for Offering the Evidence The MCC Notebooks are comprised of five notebooks/notepads, only two of which (the “Blue Notebook” and the “Red Notebook”) the Government intends to rely upon at trial. The Government also seized other loose documents that the defendant kept in his cell, including the Malware Article. The Government proposes introducing the below portions of the Blue Notebook, Red Notebook, and the Malware Article at trial. The Government also identifies below the specific purpose for which the Government will offer each of these portions at trial, and the category of evidence set forth in the Government’s motions in limine (see Dkt. 195, at 37-38) into which each portion fits (i.e., as “Use Evidence,” “MCC Classified Information Evidence”; “Intent Evidence”; “Nonpublic Information Evidence”; or “Guilty Conscience Evidence”). In addition to the portions identified below, the Government also intends to introduce the cover pages of the Blue Notebook, the Red Notebook, and the Malware Article, as they include the dates on which these documents were created.2 The Government is seeking to offer only 23 2 In the normal course, the Government would introduce the entirety of these documents to authenticate them. To the extent the Court or the defendant believes it is more appropriate to only introduce selections of the MCC Notebooks, and particularly given that the defendant has already acknowledged that the MCC Notebooks are his in substantial motion practice, the Government would seek a stipulation from the defendant, or, if the defendant refused to so stipulate, a ruling from the Court that the MCC Notebooks and the portions of them that the parties seek to introduce have been properly authenticated. In the absence of such a ruling or stipulation, the Government respectfully submits that the full notebooks should be admitted so that the Government can Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 8 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 8 pages out of the 383 pages in the combined MCC Notebooks and three pages out of the 147 pages in the Malware Article. The Blue Notebook (dated July 2018)  “Ask WikiLeaks” (014099) (undated): In the middle of the page, the defendant writes, “If you need help ask WikiLeaks for my code.”3 The defendant’s direction to consult WikiLeaks about his “code” is admissible as Nonpublic Information Evidence, because it is a statement that WikiLeaks is in possession of source code for tools upon which the defendant worked and that are contained in the back-up file that was stolen, even though WikiLeaks has not publicly disclosed that it possesses any source code for all of the tools. Schulte’s knowledge of non-public aspects of the information that was given to WikiLeaks helps to demonstrate that he was the one who gave that information to WikiLeaks in the first place.  “Wrong Articles” (014110) (undated): On this page, the defendant describes how he is “disappointed” because his family had uploaded old versions of the first seven articles that he had written on Facebook. This section is admissible as, among other things, Use Evidence, in that it shows that he was seeking to disclose his articles through a Facebook account and Intent Evidence because it shows that the defendant was growing frustrated with having to rely on others to disseminate his writings.  “New Articles Plan” (014114) (July 14, 2018): On this page, the defendant lists a “‘new article plan,” that appears to contain ideas for additional articles, including an article describing how both the FBI and the CIA are purportedly biased against President Trump, and how the CIA leaked documents to make the president look bad. This portion is admissible as Intent Evidence because it shows that the defendant planned to craft his “articles” to be embarrassing to the CIA and the FBI (a theme that is carried through in the defendant’s correspondence with the Reporter through the Annon Account, in which, for example, the defendant claims to have sensational information about President Trump). establish their authenticity by, among other things, the fact much of what is written in these documents is unique to the defendant. See United States v. Maldonado-Rivera, 922 F.2d 934, 957 (2d Cir. 1990) (the writing can be authenticated upon showing that it “deals with a matter sufficiently obscure or particularly within the knowledge of the persons corresponding so that the contents of the writing were not a matter of common knowledge”). 3 Because several of the pages in the MCC Notebooks upon which the Government intends to rely contain classified information, the Government has only described the unclassified portions here. The Government is submitting the actual pages identified in this letter to the Court for its review. In addition, the Government reserves the right to introduce additional portions of the MCC Notebooks or the Malware of the Mind Article in the trial on the child pornography charges pending against the defendant. Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 9 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 9  “What We Expect to Find in Emails” (014136) (undated): At the top of this page, the defendant writes “What we expect to find in emails.” On the remainder of the page, the defendant writes a list of items, many of which contained classified information. This portion of the Blue Notebook is admissible as Intent Evidence and MCC Classified Information Evidence, because it shows the defendant cataloguing classified information that, if publicly disclosed, would likely be harmful to the United States. Indeed, some of the categories of information identified by the defendant on this page—such as certain operations—is the same as the classified information contained in the Fake Authentication Tweet, which serves to show that the defendant’s intent was to collect these materials for dissemination, not for any legitimate purpose related to his defense. The Red Notebook (Dated July 25 through September 2018)  “Breakup Diplomatic Relationships” (014263) (Dated August 8, 2018): On this page in the Red Notebook, the defendant states: “If govt doesnt pay me $50 billion in restitution & prosecute the criminals who lied to the judge and presented this bs case then I will visit every country in the world and bear witness to the treachery that is the USG. I will look to breakup diplomatic relationships, close embassies, and U.S. occupation across the world & finally reverse U.S. jingoism. If this is the way the U.S. govt treats one of their own, how do you think they treat allies?” This statement is obviously Intent Evidence—it shows not only that the defendant is growing increasingly frustrated, but, more importantly, that his frustration has risen to the point that he now—according to his own words—plans to destroy the United States’ relationships with its allies, leading to, for example, the shuttering of U.S. embassies in other nations.  “Stage My Information War” (014287) (Dated August 14, 2018): On this page, the defendant discusses starting his “information war,” including by using social media accounts he set up from prison. In particular, the defendant writes: “Got to use last night. The way is clear. I will setup wordpress of joshschulte.wordpress.com and presumptionofinnocence.wordpress.com. From here, I will stage my information war: Facebook I will rename, simply, ‘Who is John Galt?’ or ‘Who is Josh Schulte?’ From FB, I will post links to the articles and blogs as I write them. The presumption of innocence blog will only contain my 10 articles 1-10, ending on the presumption of innocence. I will post each of them on the FB & delete the previous articles.” The defendant also states “Give me a phone & a blog & I will change the world.” This portion of the Red Notebook includes Intent Evidence, in that the defendant openly declared his plan to start an “information war” designed to harm the United States through the public posting of his articles. Moreover, this entry also includes Use Evidence, because the defendant explicitly identified as the instrumentalities of his “information war” some of the Blogs and the John Galt Facebook Page. Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 10 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 10  Using WhatsApp and Signal (014298): On this page, the defendant discusses using a cellphone from prison, complains about his father not providing him with his articles, and indicates that he wanted to set up an encrypted Proton Mail account for him. The defendant states: “I text my dad from whatsapp & signal incessantly & finally got a response @ 1% battery. I said please put articles on drafts in gmail. Response: My lawyer advised me not to. Fucking incredible. Fucking. Incredible.” Later, the defendant continues that he thought he had convinced his father to “setup a protonmail email acct for me to upload the articles.” This entry contains both Intent Evidence and Use Evidence. First, with respect to Intent Evidence, this section plainly demonstrates that the defendant is growing increasingly angry at his inability to disseminate his articles. Second, as for Use Evidence, here, the defendant acknowledges using Signal—which was the messaging application found on the Samsung Phone that the defendant used to communicate with the Reporter—and his plan to use a “protonmail email acct,” like the Encrypted Email Accounts.  Checklist of Deletions (014301) (Dated August 21, 2018): On this page, the defendant discusses systematically deleting evidence from social media accounts and from a prison cellphone or cellphones; creating new encrypted email accounts; and researching whether gmail maintains deleted emails. In particular, the defendant states: 1) 2) 3) 4) 5) Delete all Google Docs from johnsmith Delete all emails from johnsmith Delete suspicious emails from my gmail a. New logins from phones b. Paypal c. Wordpress d. PW changes Create new protonmail presumedguilty@protonmail.com Migrate wordpress to protonmail Research 1) Gmail keep deleted emails? 2) Changing Samsung IMEI a. Without rooting b. Generate new IMEI 6) 7)  Clean off apps Reset factory phone The same page also includes: “setup Whatsapp, Signal, telegram all with different numbers!”; “They got IMEI of my phone via subpoena of phone #”; “Subpoena for IMEI? Worst case all 3 have compromised IMEIs”; “new phone use old phone’s whatsapp?”; and “need to setup whatsapp with non-cell number.” This entry Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 11 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 11 contains both Use Evidence and Guilty Conscience Evidence. For example, in identifying “suspicious emails” to be deleted from his Gmail account, the defendant lists “Word Press,” which is the service provider for the Blogs, thus demonstrating that the defendant was trying to covertly operate the Blogs. Similarly, the defendant writes that he plans to change the “IMEI”—an identifying number—for “Samsung,” which proves that the defendant was seeking to use a Samsung cellphone (like the Samsung Phone) without detection. More generally, references to, among others, “delete suspicious emails,” “clean off apps,” “reset factory phone,” and “Gmail keep deleted emails?” all show that the defendant was trying to destroy evidence, a classic example of Guilty Conscience Evidence. Finally, the defendant also explicitly indicated that he planned to create another Proton Mail account, which is one of the Encrypted Email Accounts, and associate a Word Press blog with that Encrypted Email Account. These statements show the defendant’s use of and control over these accounts, and is thus Use Evidence.  Encrypted Accounts and Passwords (014302): Immediately after the previous page, the defendant lists several of the Encrypted Email and Social Media Accounts, as well as the passwords for those accounts. Similarly, this demonstrates the defendant’s use of and control over these accounts, and is thus Use Evidence.  Setting Up ProtonMail and Emailing the Reporter (014306) (Dated August 23, 2018): On this page, a page in which the defendant discusses deleting materials from a phone, setting up an encrypted email account, and emailing the Reporter. The defendant states: “Well a lot has happened lately. Yesterday I started cleansing the phone & in the process setup a new protonmail which I transferred the wordpress too. I also noticed that no msgs were responded on whatsapp so I asked my bro. He went back and forth but they decided for me not to publish the articles – well, rather, not to give me my own fucking articles. Isnt that incredible? They fucked up to begin with & published the wrong (old!) versions THEN they didn’t publish the two most important parts (8&9) and now they are withholding ALL of them. . . . Yesterday I started emailing [the Reporter] from the Washington Post.” This portion contains Intent, Use, and Guilty Conscience Evidence. For example, with respect to Intent Evidence, as with other entries, this portion shows that the defendant is angry that his family failed to post the “articles” that he wanted disclosed publicly, including the “two most important parts,” and believes that his family is now “withholding” his “articles.” With respect to Guilty Conscience Evidence, the defendant writes that he was engaged in “cleansing the phone,” an apparent reference, given the August 21, 2018 checklist of items to delete or destroy, to destroying evidence from a cellphone. Finally, with respect to Use Evidence, the defendant also writes that he has created a new Proton Mail account, and that he began to email with “Shane” “yesterday,” i.e., August 22, 2018, which is the date of the first email from the defendant to the Reporter (whose first name is “Shane”) in the Annon Account. Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 12 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 12  Identifying Malware of the Mind as Article 10 (014319): On this page, the defendant identifies the Malware Article as article 10: “I’m hoping to write /edit my 9 articles. I don’t know how I can them—oh I may text [the Reporter] from [my cousin’s] number. Omar claims that some service exists to do this – I’m dubious. [Redacted]. Although I feel this may not work either . . . IDK Basically on hold for my publication. Secondly, I want to rewrite article #10: Malware of the Mind!” After a line drawn on the page, the page also includes, among other things, the phrase “Anonymous,” and the phrase “classified information.” This entry includes Intent Evidence, in that it shows that the defendant plans to re-draft his articles, including the Malware Article. Furthermore, the defendant’s statement that he might text the Reporter from his cousin’s telephone number, thus continuing to conceal his identity during those communications, is Guilty Conscience Evidence. Finally, the defendant’s reference to “Anonymous” and “classified information” is consistent with the defendant’s claims in his Signal messages that Anonymous is seeking to help prove his innocence by providing information to the Reporter.  FreeJasonBourne Twitter Account (014320-21): These pages include a circle in which is written “freejasonbourne” followed by “protonmail.com,” which is also the name of another of the Encrypted Email Accounts, and a series of letters and numbers. The page also includes, among other things, “—Twitter— ‘FreeJasonBourne,” which appears to be a reference to the Bourne Account. Following this reference appears the Fake Authentication Tweet. This entry has the MCC Classified Information Evidence—namely the Fake Authentication Tweet—and Use Evidence, in that these pages reference the Bourne Account and the specific Encrypted Email Account that was used to manage the Bourne Account.  Draft Tweet (014324-26): Over these three pages, Schulte wrote the following. At the top of the first page, Schulte wrote “#TopSecret#FuckYourTopSecret,” and under that draws an arrow to the phrase “or dump the secrets here:”. At the top of the page Schulte also wrote “establish credibility,” and, underneath that appears another version of the Fake Authentication Tweet. Later, the defendant recommends to U.S. intelligence agency employees to “send all your govt’s secrets here: WikiLeaks” until the U.S. government “honors” their service. As with the last entry, this is entry contains MCC Classified Information Evidence in the form of the Fake Authentication Tweet. In addition, the instruction to intelligence agency employees to give their “secrets” to WikiLeaks is Intent Evidence.  Signal and Twitter to Send Articles and Tweets (014327) (Sept. 2, 2018): In this portion of the Red Notebook, Schulte writes, among other things, “Well its September now. Locked in all day. Hopefully tonight I can setup Signal from my cell & msg [last name of the Reporter] to confirm anon’s permission and get my fucking articles. I also need to confirm my twitter.” This page contains Use Evidence. In particular, the defendant references setting up Signal “from my Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 13 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 13 cell”—which supports that the defendant was using Signal on the Samsung Phone—to confirm “anon’s permission”—which shows that the defendant was using the Anon Account to “get [his] fucking articles.” The defendant also made clear that he had created a Twitter account when he wrote “I also need to confirm my twitter.”  Schedule Pages (014337) (September 12, 2018): At the bottom of the page, Schulte writes down a schedule of upcoming tasks he plans to accomplish, including “[f]inalize copy by Friday;” “DL Disc. UL WL;” and “schedule tweets 27th.” This entry is Intent Evidence. Initially, in context, the phrase “DL Disc. UL WL” appears to be a reference to “download discovery” and “upload to WikiLeaks,” which is consistent with the defendant’s researching of submission methods to WikiLeaks. Moreover, the reference to “schedule tweets” demonstrates that the defendant actually intended to use the Bourne Account.  Posts to FB and John Galt (014348) (September 17, 2018): “I posted the FB thing – on the John Galt page & changed the pw. We’ll see what happens! Maybe a little interest? In a week I’m going to dump all my stuff.” This entry has both Use and Intent Evidence. Initially, the defendant states that he posted information on the John Galt Facebook Page and changed the password for the page (“I posted the FBI thing—on the John Galt page & changed the pw”), which shows his control over that page at this time. The defendant also indicated his hope that his post would result in more media attention (“Maybe a little interest?”) and that the following week, he plans to release more information (“In a week I’m going to dump all my stuff”). The Malware Article (undated)  “To my fellow engineers and the tech industry” (013723): In this introductory page, the defendant writes “to my fellow engineers and the tech industry” and proceeds to claim that the FBI and the U.S. Government are manipulating the technology industry by, among other things, introducing “technology that was never intended for use in the court of law or to definitively ascertain culpability.” This section contains Intent Evidence—specifically, given that the defendant addressed it to his “fellow engineers and the tech industry,” it seems clear that he drafted this “article” for dissemination.  “My Specialty” (013804): This page contains the Malware Disclosure. In addition, the defendant also goes on to write that he designed his “own crypto – how better to fool bafoons like forensic examiners and the FBI then to have custom software that doesn’t fit into their 2-week class where they become forensic ‘experts.’” The defendant then provides classified details of specifics of his work at the CIA. Accordingly, this page contains MCC Classified Information Evidence. In addition, the defendant’s self-professed expertise at covertly stealing data is also Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 14 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 14 evidence of how he could have stolen the Vault 7 information without detection at the CIA. B. The MCC Notebooks Are Not Duplicative 1. The Other Prison Evidence In addition to the MCC Notebooks, the Government expects to offer at trial the following additional evidence of the defendant’s conduct at the MCC. That evidence includes (i) testimony from a cooperating witness (“CW-1”) about CW-1’s interactions with Schulte at the MCC; (ii) a Samsung cellphone (the “Samsung Phone”) Schulte used at the MCC, (iii) records related to and the contents of the Encrypted Email Accounts; (iv) records related to and the contents of the Social Media Accounts; and (v) Schulte’s recorded calls from the MCC (the “MCC Calls,” and together with CW-1’s testimony, the Samsung Phone and its contents, and the Prison Electronic Accounts, the “Prison Evidence”). Below is a brief description of each category of the Prison Evidence:  CW-1’s Testimony: The Government anticipates that CW-1 will testify, in substance and in part, that the defendant and at least one other inmate used contraband cellphones while in the MCC; that the defendant principally used at least two Samsung cellphones (which other evidence will show includes the Samsung Phone) that had been smuggled into the MCC and adopted security measures in connection with the Contraband Cellphones he used, including by having CW-1 store these cellphones when the defendant was not using them and encrypting the defendant’s cellphones. CW-1 will also testify about the defendant’s growing frustration in the MCC and desire to harm the CIA. Finally, the Government expects to introduce through CW-1 various images and videos of the defendant using the Contraband Cellphones in the MCC (including the Samsung Phone) and images showing the display screen of some of these cellphones, which show, among other things, one of the Encrypted Email Accounts in use.4  The Samsung Phone: Although the Samsung Phone was not found in the defendant’s cell, the Government intends to show that it was one of the cellphones that the defendant used at the MCC through various pieces of evidence, including by comparing identifying information appearing on the Samsung Phone to one of the images taken by CW-1 of one of the cellphones the defendant used in prison. The Samsung Phone contains, among other things, evidence that Encrypted Email Accounts were accessed on the cellphone, but not the actual communications from those accounts. The Samsung Phone also contains the Signal Messages in which the defendant, among other things, pretended to be a third person and attempted The Government anticipates that it may call additional witnesses about the defendant’s attempts to disseminate his articles, and in particular, the Classified Article. 4 Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 15 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 15 to convince the Reporter that the user of one of the Encrypted Email Accounts with whom the Reporter was corresponding (but who was in fact the defendant) is a member of the online hacktivist group Anonymous who is trying to help the defendant.  The Encrypted Email Accounts: The Annon Account contains the defendant’s correspondence with the Reporter, including the September 2018 Emails that attached the classified Network Structure Document and the Protected Search Warrant. The other Encrypted Email Accounts also contain records related to the defendant’s use and control of the Social Media Accounts, such as, for example, email notifications when the defendant modified the Social Media Accounts.  The Social Media Accounts: The evidence concerning the Social Media Accounts includes, among other things, records from the service providers for these accounts showing, for instance, when the accounts were created and how they were modified. This evidence also shows how the defendant posted some of his writings to the Social Media Accounts while detained at the MCC, and that he planned to post additional writings to the Social Media Accounts in the future— for example, on the John Galt Facebook Page, the defendant indicated that he would use Twitter to post content in the future.  The MCC Calls: In the MCC Calls, the defendant, among other things, discusses the information in the Protected Search Warrant with an apparent reporter, after specifically acknowledging that the search warrant materials are subject to the Protective Order. The MCC Calls also include conversations during which the defendant states his intent to pursue his so-called media campaign, even though his attorneys advised him against doing so. 2. The MCC Notebooks Are a Necessary Part of the Government’s Case As the Court noted in its Order, the Government has amassed a significant quantity of Prison Evidence apart from the MCC Notebooks. To be sure, the Prison Evidence satisfies much of the Government’s burden with respect to proving the MCC Leaks Charge and the Contempt Charge. Nevertheless, the Government’s case would be weakened in significant and material ways if the Government did not introduce at least the portions of the MCC Notebooks described above. First, the MCC Leaks Charge charges the defendant with both the actual transmission of national defense information and attempted transmission of national defense information. As the Government has previously notified the Court and the defense, the MCC National Defense Information is found in four documents: (1) the Classified Article; (2) the Network Structure Document; (3) the Fake Authentication Tweet; and (4) the Malware Disclosure. The defendant transmitted two of those four documents, the Classified Article and the Network Structure Document, which supports an actual transmission theory. The attempted transmission theory is based on the defendant’s handling of the Fake Authentication Tweet and the Malware Disclosure, both of which are found exclusively in the MCC Notebooks—they do not reappear in any of the Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 16 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 16 other Prison Evidence. As a result, if the Government were precluded from introducing the portions of the MCC Notebooks that included the Fake Authentication Tweet and the Malware Disclosure, then the Government would have to abandon the attempted transmission theory charged by the grand jury. Similarly, to prevail on an attempt theory, the Government must show that the defendant took a “substantial step” to transmitting this national defense information. See, e.g., United States v. Desposito, 704 F.3d 221, 233 (2d Cir. 2013) (“Thus, a rational jury could find beyond a reasonable doubt that his persistent writing and mailing of letters constituted substantial steps toward obstructing his criminal trial.”). If the Government could not introduce the evidence in the MCC Notebooks that concerned the defendant’s creation and use of the Bourne Account or the Social Media Accounts, the avenues through which the defendant intended to transmit publicly the Fake Authentication Tweet and the Malware Article, then the jury would lose critical context about the existence of these accounts, including that the defendant created and controlled them. For example, without the MCC Notebooks, the jury would not learn of the defendant’s statement that he intended to post his articles on the John Galt Facebook Account, or that he was planning to “schedule tweets” before being caught by law enforcement. In other words, without the MCC Notebooks, the Government’s attempted transmission theory would be critically, if not fatally, weakened. Second, with respect to both the actual and attempted transmission theories, the MCC Notebooks also supply a critical piece of evidence—the defendant’s motive. For example, the defendant’s explicit declaration of an “information war” and his desire to destroy the United States’ diplomatic relationships show why the defendant wanted to transmit the MCC National Defense Information—because he wanted to, in fact, harm the United States. That desire, coupled with the defendant’s experience at the CIA, clearly establishes, as the Government is required to for Count Four, that the defendant had reason to believe that by transmitting the MCC National Defense Information, he would be harming the United States. Similarly, the defendant’s explicit linking of his “information war” and increased desperation evidenced in the MCC Notebooks helps to explain why he progressed from writing polemics about the criminal justice system to trying to send tweets that provide information about CIA tools and operations. Without seeing the defendant’s thought process—which is laid out only in the MCC Notebooks—the jury will be hard-pressed to understand why the defendant would take that drastic step from the MCC, and the Government would be unable to rebut the false claim that the defendant’s writings had any legitimate purpose. Third, the MCC Notebooks uniquely establish that it was the defendant who used the Samsung Phones, the Encrypted Email Accounts, and the Social Media Accounts to create and attempt to disseminate the MCC National Defense Information. In the Prison Evidence, the defendant tried to insulate himself from detection by using false identities or encrypted communication facilities. And, during one hearing, defense counsel previewed that the defense may argue that it was not in fact the defendant who sent some of the messages upon which the Government intends to rely. Given that the issue of whether it was the defendant who was using the Encrypted Email Accounts, the Samsung Phone, and the Social Media Accounts during the critical periods may be contested, the Use Evidence in the MCC Notebooks is critical. For example, in his correspondence with the Reporter through the Annon Account, the defendant pretends to be a member of his family—on the other hand, in the Red Notebook, the defendant not Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 17 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 17 only lists the password for that account and the account itself (which is obviously proof that he was using it), but also makes statements that clearly identify him as the user of the account, such as when he writes that he started corresponding with the Reporter to ask for his “articles” on the same day that the Annon Account first emailed the Reporter asking for the “articles.” Indeed, in the MCC Notebooks, the defendant clearly identifies the specific Social Media Accounts that he would use for his “information war.” These arguments are not available to the Government, however, if the defendant’s statements in the MCC Notebooks are not before the jury. Put simply, the MCC Notebooks foreclose any argument that the defendant was not the user of the Samsung Phone, the Encrypted Email Accounts, or the Social Media Accounts. Fourth, the MCC Notebooks also establish that the defendant was not using the Samsung Phone, the Encrypted Email Accounts, or the Social Media Accounts for any innocent purpose because these documents are replete with Guilty Conscience Evidence that is not found anywhere else in the Prison Evidence. It is difficult to overstate, for example, the significance of the defendant’s reminder to himself to “delete suspicious emails”—the only logical conclusion is that the defendant did not want those emails to come to light because they are evidence of a crime. Similarly, the Government is plainly entitled to argue that the fact that the defendant was “cleansing” his cellphone, as he wrote in the Red Notebook, showed the defendant was not engaged in innocent activity when he used an encrypted messaging application (Signal) from a cellphone (the Samsung Phone) to convince the Reporter that a member of Anonymous (a group the defendant claimed once to be a part of that has cooperated with WikiLeaks in the past) was trying to give the Reporter sensitive information to publish after the defendant had declared an “information war” against the United States intended to destroy the nation’s diplomatic relationships. The Guilty Conscience Evidence defeats any argument that the defendant’s conduct at the MCC was undertaken in good faith, an argument that the defendant appears prepared to make at trial. Fifth, these portions of the MCC Notebooks and the Malware Article are also admissible as direct and Rule 404(b) evidence with respect to the original leak charges because they demonstrate the defendant’s modus operandi. The defendant has stated that he will argue at trial that he is not responsible for disclosing the CIA information at issue in this case to WikiLeaks. Portions of the MCC Notebooks that contain Nonpublic Information, for example, undercut that defense, because they show that the defendant has knowledge of what WikiLeaks possesses that he could not know unless he was the perpetrator. Similarly, the MCC Notebooks and the Malware Article help to demonstrate a pattern of conduct that is highly probative of Schulte’s guilt of the WikiLeaks charges. In both instances, the defendant (1) grew infuriated with components of the U.S. government; (2) threatened to expose allegedly damaging information about the CIA to coerce the agency into acting as Schulte wished; and (3) used technologically sophisticated means to conceal his actions, using encrypted accounts and cellphones, and IP-masking techniques at the MCC and deleting logs and securely wiping removable media at the CIA. These portions of the MCC Notebooks and the Malware Article are thus also admissible as proof of the defendant’s guilt of the original WikiLeaks charges. See, e.g., United States v. Stevens, No. S1 03 Cr. 669 (JFK), 2004 WL 2002978, at *2 (S.D.N.Y. Sept. 7, 2004) (“Evidence that in the past he robbed other banks, in New York City, committing the robberies within weeks of each other, threatening the use of a bomb and demanding money, tends to suggest that the defendant was the person who Case 1:17-cr-00548-PAC Document 257 Filed 01/21/20 Page 18 of 18 The Honorable Paul A. Crotty, U.S.D.J. January 21, 2020 Page 18 committed the robberies charged in the Indictment. In other words, this evidence goes to the issue of identity.”); United States v. Hinton, 31 F.3d 817, 822 (9th Cir. 1994) (admitting evidence of four previous assaults of victim under Rule 404(b) because “the charged and prior conduct were part of a pattern of abuse involving the same victim and . . . similar modus operandi”). Conclusion For the reasons set forth above, the Government respectfully submits that the Court should (i) preclude the defense from raising or introducing any evidence of an advice of counsel defense at trial, and (ii) admit at least the portions of the MCC Notebooks and the Malware Article described herein. These portions are highly probative of the defendant’s guilt, plainly not privileged on their face, and not duplicative of other evidence the Government intends to introduce at trial. Respectfully submitted, GEOFFREY S. BERMAN United States Attorney By: Cc: Defense Counsel (via ECF) /s/ David W. Denton, Jr. Sidhardha Kamaraju Matthew Laroche Assistant United States Attorneys Tel.: 212-637-2744 / 6523 / 2420